octopize.deploy_tool 2.7.2__tar.gz → 2.7.3__tar.gz

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: octopize.deploy_tool
-Version: 2.7.2
+Version: 2.7.3
 Summary: Deployment configuration tool for Octopize Avatar platform
 Project-URL: Homepage, https://octopize.io
 Project-URL: Documentation, https://docs.octopize.io/docs/deploying/self-hosted

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "octopize.deploy_tool"
-version = "2.7.2"
+version = "2.7.3"
 description = "Deployment configuration tool for Octopize Avatar platform"
 readme = "README.md"
 requires-python = ">=3.13"

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/src/octopize_avatar_deploy/__init__.py

@@ -10,7 +10,7 @@ from .version_compat import (
     validate_template_version,
 )
 
-__version__ = "2.7.2"
+__version__ = "2.7.3"
 __all__ = [
     "DeploymentRunner",
     "DeploymentConfigurator",

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/src/octopize_avatar_deploy/steps/nginx.py

@@ -4,7 +4,9 @@ import getpass
 import os
 import socket
 import stat
+import subprocess
 from collections.abc import Callable
+from enum import Enum
 from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
@@ -174,6 +176,105 @@ def is_port_in_use(port: int) -> bool:
         return sock.connect_ex(("127.0.0.1", port)) == 0
 
 
+class SelfSignedStatus(Enum):
+    """Result of a self-signed certificate detection attempt.
+
+    Attributes:
+        DEFINITELY_NOT: ``openssl verify`` succeeded — the cert chain is trusted
+            by the system CA store.  No special handling needed.
+        YES: ``openssl verify`` failed **and** the leaf certificate has
+            ``issuer == subject``, which is the defining property of a
+            self-signed certificate.
+        MAYBE: ``openssl verify`` failed but ``issuer != subject`` — the
+            certificate may be issued by a private (non-system-trusted) CA.
+        UNKNOWN: ``openssl`` could not parse the certificate at all (e.g. the
+            file contains placeholder/test content).  No determination can be
+            made; the caller should skip self-signed handling.
+    """
+
+    DEFINITELY_NOT = "definitely_not"
+    YES = "yes"
+    MAYBE = "maybe"
+    UNKNOWN = "unknown"
+
+
+def detect_self_signed_cert(cert_path: str) -> SelfSignedStatus:
+    """Detect whether a PEM certificate is self-signed or uses an untrusted chain.
+
+    The check is performed in two steps:
+
+    1. ``openssl verify -untrusted <cert> <cert>`` — if this succeeds the cert
+       is trusted by the system CA store and is *definitely not* self-signed.
+       The ``-untrusted`` flag is essential for fullchain PEM files: without it
+       OpenSSL only verifies the leaf certificate and ignores the bundled
+       intermediates, causing false "unable to get local issuer certificate"
+       failures even for valid CA-signed chains.
+    2. ``openssl x509 -noout -subject -issuer -in <cert>`` — if step 1 failed,
+       we compare the ``subject`` and ``issuer`` fields:
+       - Equal  → the leaf cert is self-signed (:attr:`SelfSignedStatus.YES`).
+       - Unequal → the cert may be from a private CA
+         (:attr:`SelfSignedStatus.MAYBE`).
+       - Cannot parse → :attr:`SelfSignedStatus.UNKNOWN`.
+
+    Args:
+        cert_path: Absolute or relative path to the PEM certificate file.
+
+    Returns:
+        :class:`SelfSignedStatus` indicating the detection result.
+    """
+    _timeout = 5  # seconds
+
+    # Step 1 — try to verify against the system CA bundle.
+    #
+    # `-untrusted cert_path` is required for fullchain PEM files: `openssl verify`
+    # only verifies the first (leaf) certificate in the file and does NOT
+    # automatically use the other certificates bundled in the same file as
+    # untrusted intermediates for chain building.  Passing the file as both
+    # `-untrusted` and the positional argument makes the bundled intermediates
+    # available so the full chain can be verified correctly.
+    try:
+        result = subprocess.run(  # noqa: S603
+            ["openssl", "verify", "-untrusted", cert_path, cert_path],  # noqa: S607
+            capture_output=True,
+            text=True,
+            timeout=_timeout,
+        )
+        if result.returncode == 0:
+            return SelfSignedStatus.DEFINITELY_NOT
+    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
+        # openssl not available or timed out — fall through to heuristic check.
+        pass
+
+    # Step 2 — compare subject and issuer fields.
+    try:
+        result = subprocess.run(  # noqa: S603
+            ["openssl", "x509", "-noout", "-subject", "-issuer", "-in", cert_path],  # noqa: S607
+            capture_output=True,
+            text=True,
+            timeout=_timeout,
+        )
+        if result.returncode != 0:
+            # Could not parse the certificate (e.g. invalid/test content).
+            return SelfSignedStatus.UNKNOWN
+
+        subject = ""
+        issuer = ""
+        for line in result.stdout.splitlines():
+            if line.startswith("subject="):
+                subject = line[len("subject=") :]
+            elif line.startswith("issuer="):
+                issuer = line[len("issuer=") :]
+
+        if subject and issuer and subject.strip() == issuer.strip():
+            return SelfSignedStatus.YES
+
+        # issuer != subject — likely signed by a private CA.
+        return SelfSignedStatus.MAYBE
+
+    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
+        return SelfSignedStatus.UNKNOWN
+
+
 class NginxTlsStep(DeploymentStep):
     """Handles Nginx TLS configuration."""
 
@@ -301,6 +402,9 @@ class NginxTlsStep(DeploymentStep):
 
             config["NGINX_SSL_CERTIFICATE_PATH"] = cert_path
             config["NGINX_SSL_CERTIFICATE_KEY_PATH"] = key_path
+
+            # Detect if the certificate is self-signed and configure the API accordingly.
+            config["SELF_SIGNED_CERT_PATH"] = self._resolve_self_signed_cert(cert_path)
         else:
             http_port = self.get_config_or_prompt_generic(
                 PromptConfig(
@@ -329,6 +433,7 @@ class NginxTlsStep(DeploymentStep):
             config["NGINX_HTTP_PORT"] = http_port
             config["NGINX_SSL_CERTIFICATE_PATH"] = "/dev/null"
             config["NGINX_SSL_CERTIFICATE_KEY_PATH"] = "/dev/null"
+            config["SELF_SIGNED_CERT_PATH"] = ""
 
             try:
                 port_number = int(http_port)
@@ -349,3 +454,68 @@ class NginxTlsStep(DeploymentStep):
     def generate_secrets(self) -> dict[str, str]:
         """No secrets needed for Nginx TLS paths."""
         return {}
+
+    def _resolve_self_signed_cert(self, cert_path: str) -> str:
+        """Determine whether *cert_path* is self-signed and return the path or empty string.
+
+        The result drives ``SELF_SIGNED_CERT_PATH`` in the generated config:
+        - Non-empty path  → the cert is self-signed; mount it into API containers and
+          set ``SSL_CERT_FILE`` so Python trusts it.
+        - Empty string    → the cert is CA-trusted; no special handling needed.
+
+        If ``SELF_SIGNED_CERT_PATH`` is already present in the pre-loaded config
+        (e.g. from a saved YAML config), that value is returned as-is and detection
+        is skipped.
+
+        Args:
+            cert_path: Resolved path to the TLS certificate (same value as
+                ``NGINX_SSL_CERTIFICATE_PATH``).
+
+        Returns:
+            The certificate path if self-signed, or ``""`` if not.
+        """
+        # Respect pre-configured value from saved config / YAML.
+        if "SELF_SIGNED_CERT_PATH" in self.config:
+            return str(self.config["SELF_SIGNED_CERT_PATH"])
+
+        status = detect_self_signed_cert(cert_path)
+
+        if status == SelfSignedStatus.DEFINITELY_NOT:
+            return ""
+
+        if status == SelfSignedStatus.UNKNOWN:
+            # Cannot parse the certificate — skip self-signed handling silently.
+            return ""
+
+        if status == SelfSignedStatus.YES:
+            self.printer.print(
+                "  → Certificate is self-signed (issuer = subject). "
+                "The API services will be configured to trust it via SSL_CERT_FILE."
+            )
+            return cert_path
+
+        # SelfSignedStatus.MAYBE — ask the user.
+        confirmed = self.prompt_yes_no(
+            "Certificate could not be verified against the system CA store — "
+            "is it self-signed or issued by a private CA?",
+            default=False,
+            key="nginx_tls.is_self_signed_cert",
+            help_text=(
+                "The deployment tool tried to verify the certificate against the "
+                "system CA bundle but the verification failed.\n"
+                "\n"
+                "This can happen when:\n"
+                "  - the certificate was signed by a private/internal CA that is not\n"
+                "    installed on this machine\n"
+                "  - the certificate is self-signed (issuer = subject)\n"
+                "\n"
+                "If you answer yes, the deployment tool will:\n"
+                "  - set SSL_CERT_FILE=/certs/server.fullchain.crt inside every API\n"
+                "    container so that Python trusts your certificate\n"
+                "  - mount the certificate file into those containers\n"
+                "\n"
+                "If you answer no, no extra configuration is added and the API will\n"
+                "use the default system CA bundle."
+            ),
+        )
+        return cert_path if confirmed else ""

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/src/octopize_avatar_deploy/templates/docker-compose.yml.template

@@ -12,6 +12,9 @@ x-environment: &api-environment
     STORAGE_ENDPOINT_HOST: http://s3
     DASK_SCHEDULER: my-dask-scheduler:8786
     SECRETS_DIR: /var/run/secrets
+    {% if SELF_SIGNED_CERT_PATH %}
+    SSL_CERT_FILE: /certs/server.fullchain.crt
+    {% endif %}
   env_file:
     - path: .env
       required: true
@@ -93,6 +96,10 @@ services:
     depends_on:
       init-db:
         condition: service_completed_successfully
+    {% if SELF_SIGNED_CERT_PATH %}
+    volumes:
+      - {{ SELF_SIGNED_CERT_PATH }}:/certs/server.fullchain.crt:ro
+    {% endif %}
 
   init-db:
     image: *api-image-version
@@ -123,6 +130,10 @@ services:
         condition: service_started
       s3:
         condition: service_healthy
+    {% if SELF_SIGNED_CERT_PATH %}
+    volumes:
+      - {{ SELF_SIGNED_CERT_PATH }}:/certs/server.fullchain.crt:ro
+    {% endif %}
 
   init-storage:
     image: &seaweedfs-image ${AVATAR_SEAWEEDFS_REGISTRY-chrislusf}/seaweedfs:${AVATAR_SEAWEEDFS_VERSION-4.17}
@@ -167,6 +178,10 @@ services:
       - authjwt_secret_key
       - storage_admin_access_key_id
       - storage_admin_secret_access_key
+    {% if SELF_SIGNED_CERT_PATH %}
+    volumes:
+      - {{ SELF_SIGNED_CERT_PATH }}:/certs/server.fullchain.crt:ro
+    {% endif %}
 
   dask-worker:
     image: *api-image-version
@@ -196,6 +211,10 @@ services:
       - authjwt_secret_key
       - storage_admin_access_key_id
       - storage_admin_secret_access_key
+    {% if SELF_SIGNED_CERT_PATH %}
+    volumes:
+      - {{ SELF_SIGNED_CERT_PATH }}:/certs/server.fullchain.crt:ro
+    {% endif %}
 
   db:
     image: &postgres-image postgres:14-alpine

{octopize_deploy_tool-2.7.2/tests/fixtures/config_round_trip_first → octopize_deploy_tool-2.7.3/tests/fixtures/basic_deployment}/expected/.deployment-state.yaml

@@ -36,6 +36,7 @@ config:
   NGINX_TLS_ENABLED: true
   NGINX_SSL_CERTIFICATE_PATH: NORMALIZED_TLS_CERT_PATH
   NGINX_SSL_CERTIFICATE_KEY_PATH: NORMALIZED_TLS_KEY_PATH
+  SELF_SIGNED_CERT_PATH: NORMALIZED_SELF_SIGNED_CERT_PATH
   DB_NAME: avatar
   DB_USER: avatar
   DB_ADMIN_USER: avatar_dba

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/fixtures/cloud_storage/expected/.deployment-state.yaml

@@ -36,6 +36,7 @@ config:
   NGINX_TLS_ENABLED: true
   NGINX_SSL_CERTIFICATE_PATH: NORMALIZED_TLS_CERT_PATH
   NGINX_SSL_CERTIFICATE_KEY_PATH: NORMALIZED_TLS_KEY_PATH
+  SELF_SIGNED_CERT_PATH: NORMALIZED_SELF_SIGNED_CERT_PATH
   DB_NAME: avatar
   DB_USER: avatar
   DB_ADMIN_USER: avatar_dba

{octopize_deploy_tool-2.7.2/tests/fixtures/config_round_trip_second → octopize_deploy_tool-2.7.3/tests/fixtures/config_round_trip_first}/expected/.deployment-state.yaml

@@ -36,6 +36,7 @@ config:
   NGINX_TLS_ENABLED: true
   NGINX_SSL_CERTIFICATE_PATH: NORMALIZED_TLS_CERT_PATH
   NGINX_SSL_CERTIFICATE_KEY_PATH: NORMALIZED_TLS_KEY_PATH
+  SELF_SIGNED_CERT_PATH: NORMALIZED_SELF_SIGNED_CERT_PATH
   DB_NAME: avatar
   DB_USER: avatar
   DB_ADMIN_USER: avatar_dba

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/fixtures/config_round_trip_first/expected/deployment-config.yaml

@@ -22,6 +22,7 @@ AVATAR_SSO_ENABLED: 'true'
 NGINX_TLS_ENABLED: true
 NGINX_SSL_CERTIFICATE_PATH: NORMALIZED_TLS_CERT_PATH
 NGINX_SSL_CERTIFICATE_KEY_PATH: NORMALIZED_TLS_KEY_PATH
+SELF_SIGNED_CERT_PATH: NORMALIZED_SELF_SIGNED_CERT_PATH
 DB_NAME: avatar
 DB_USER: avatar
 DB_ADMIN_USER: avatar_dba

{octopize_deploy_tool-2.7.2/tests/fixtures/basic_deployment → octopize_deploy_tool-2.7.3/tests/fixtures/config_round_trip_second}/expected/.deployment-state.yaml

@@ -36,6 +36,7 @@ config:
   NGINX_TLS_ENABLED: true
   NGINX_SSL_CERTIFICATE_PATH: NORMALIZED_TLS_CERT_PATH
   NGINX_SSL_CERTIFICATE_KEY_PATH: NORMALIZED_TLS_KEY_PATH
+  SELF_SIGNED_CERT_PATH: NORMALIZED_SELF_SIGNED_CERT_PATH
   DB_NAME: avatar
   DB_USER: avatar
   DB_ADMIN_USER: avatar_dba

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/fixtures/configure_happy_path/expected/.deployment_states/v1/deployment_state.yaml

@@ -111,6 +111,9 @@ items:
   RESOLVED_PUBLIC_BASE_URL:
     source: user_input
     value: https://avatar.example.com
+  SELF_SIGNED_CERT_PATH:
+    source: user_input
+    value: ''
   SMTP_HOST:
     source: user_input
     value: smtp.example.com

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/fixtures/dev_mode_deployment/expected/.deployment-state.yaml

@@ -39,6 +39,7 @@ config:
   NGINX_TLS_ENABLED: true
   NGINX_SSL_CERTIFICATE_PATH: NORMALIZED_TLS_CERT_PATH
   NGINX_SSL_CERTIFICATE_KEY_PATH: NORMALIZED_TLS_KEY_PATH
+  SELF_SIGNED_CERT_PATH: NORMALIZED_SELF_SIGNED_CERT_PATH
   DB_NAME: avatar
   DB_USER: avatar
   DB_ADMIN_USER: avatar_dba

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/fixtures/no_telemetry/expected/.deployment-state.yaml

@@ -36,6 +36,7 @@ config:
   NGINX_TLS_ENABLED: true
   NGINX_SSL_CERTIFICATE_PATH: NORMALIZED_TLS_CERT_PATH
   NGINX_SSL_CERTIFICATE_KEY_PATH: NORMALIZED_TLS_KEY_PATH
+  SELF_SIGNED_CERT_PATH: NORMALIZED_SELF_SIGNED_CERT_PATH
   DB_NAME: avatar
   DB_USER: avatar
   DB_ADMIN_USER: avatar_dba

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/fixtures/non_interactive_complete/expected/.deployment-state.yaml

@@ -51,6 +51,7 @@ config:
   NGINX_TLS_ENABLED: true
   NGINX_SSL_CERTIFICATE_PATH: NORMALIZED_TLS_CERT_PATH
   NGINX_SSL_CERTIFICATE_KEY_PATH: NORMALIZED_TLS_KEY_PATH
+  SELF_SIGNED_CERT_PATH: NORMALIZED_SELF_SIGNED_CERT_PATH
   DB_ADMIN_USER: avatar_dba
   AUTHENTIK_DATABASE_NAME: authentik
   AUTHENTIK_DATABASE_USER: authentik

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/helpers/normalization.py

@@ -117,6 +117,7 @@ _SUBSTITUTIONS: list[tuple[str, str]] = [
     # Flat YAML key-value format (.deployment-state.yaml, deployment-config.yaml)
     (r"(NGINX_SSL_CERTIFICATE_PATH: )[^\n]+", r"\1NORMALIZED_TLS_CERT_PATH"),
     (r"(NGINX_SSL_CERTIFICATE_KEY_PATH: )[^\n]+", r"\1NORMALIZED_TLS_KEY_PATH"),
+    (r"(SELF_SIGNED_CERT_PATH: )[^\n]+", r"\1NORMALIZED_SELF_SIGNED_CERT_PATH"),
     # Nested YAML value field (deployment_state.yaml)
     (r"(    value: )[^\n]*server\.fullchain\.crt[^\n]*", r"\1NORMALIZED_TLS_CERT_PATH"),
     (r"(    value: )[^\n]*server\.decrypted\.key[^\n]*", r"\1NORMALIZED_TLS_KEY_PATH"),
@@ -129,6 +130,10 @@ _SUBSTITUTIONS: list[tuple[str, str]] = [
         r"(      - )[^\n]+:(/etc/nginx/tls/private/server\.decrypted\.key:ro)",
         r"\1NORMALIZED_TLS_KEY_PATH:\2",
     ),
+    (
+        r"(      - )[^\n]+:(/certs/server\.fullchain\.crt:ro)",
+        r"\1NORMALIZED_SELF_SIGNED_CERT_PATH:\2",
+    ),
     # --- Temp directory paths (compose.override.yaml) ---
     (r"/tmp/tmp[a-zA-Z0-9_-]+/", "/tmp/TEMP_DIR/"),
     # --- Remaining 64-char hex secrets (catch-all, after named patterns above) ---

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/unit/infra/test_configure_runner_adapter.py

@@ -141,3 +141,28 @@ class TestConfiguratorRunnerAdapterTranslate:
 
         assert result.items["organization_name"].value == "dev"
         assert result.items["organization_name"].source == DeploymentItemSource.LEGACY
+
+    def test_self_signed_cert_path_non_empty_propagated(self) -> None:
+        """SELF_SIGNED_CERT_PATH with a real path is propagated with USER_INPUT source.
+
+        SELF_SIGNED_CERT_PATH is not registered in the DeploymentItemRegistry, so it
+        falls through to the default spec whose MissingValuePolicy is PROMPT, which
+        maps to DeploymentItemSource.USER_INPUT in _source_from_policy.
+        """
+        base = _doc()
+        old = self._old_state(config={"SELF_SIGNED_CERT_PATH": "/tmp/server.fullchain.crt"})
+
+        result = self._adapter()._translate_to_document(base, old)
+
+        assert result.items["SELF_SIGNED_CERT_PATH"].value == "/tmp/server.fullchain.crt"
+        assert result.items["SELF_SIGNED_CERT_PATH"].source == DeploymentItemSource.USER_INPUT
+
+    def test_self_signed_cert_path_empty_string_propagated(self) -> None:
+        """SELF_SIGNED_CERT_PATH with an empty string (CA-trusted cert) is preserved as-is."""
+        base = _doc()
+        old = self._old_state(config={"SELF_SIGNED_CERT_PATH": ""})
+
+        result = self._adapter()._translate_to_document(base, old)
+
+        assert result.items["SELF_SIGNED_CERT_PATH"].value == ""
+        assert result.items["SELF_SIGNED_CERT_PATH"].source == DeploymentItemSource.USER_INPUT

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/unit/steps/test_nginx.py

@@ -11,6 +11,8 @@ import pytest
 from octopize_avatar_deploy.domain.validation import ValidationError, ValidationSuccess
 from octopize_avatar_deploy.steps import NginxTlsStep
 from octopize_avatar_deploy.steps.nginx import (
+    SelfSignedStatus,
+    detect_self_signed_cert,
     is_port_in_use,
     make_tls_cert_validator,
     make_tls_key_validator,
@@ -497,3 +499,121 @@ class TestMakeTlsKeyValidator:
 
         assert isinstance(result, ValidationSuccess)
         assert not any("pem" in w.lower() for w in printer.warnings)
+
+
+# ---------------------------------------------------------------------------
+# detect_self_signed_cert — unit tests (subprocess-mocked)
+# ---------------------------------------------------------------------------
+
+# Realistic subject/issuer lines as produced by ``openssl x509 -noout -subject -issuer``
+_LE_SUBJECT = "subject=CN=octopize.tech"
+_LE_ISSUER = "issuer=C=US, O=Let's Encrypt, CN=YE2"
+_SELF_SUBJECT = "subject=CN=myserver"
+_SELF_ISSUER = "issuer=CN=myserver"
+
+
+def _make_verify_result(returncode: int, stdout: str = "", stderr: str = "") -> MagicMock:
+    r = MagicMock()
+    r.returncode = returncode
+    r.stdout = stdout
+    r.stderr = stderr
+    return r
+
+
+def _make_x509_result(subject: str, issuer: str) -> MagicMock:
+    r = MagicMock()
+    r.returncode = 0
+    r.stdout = f"{subject}\n{issuer}\n"
+    r.stderr = ""
+    return r
+
+
+class TestDetectSelfSignedCert:
+    """Unit tests for detect_self_signed_cert using mocked subprocess.run."""
+
+    def test_definitely_not_when_openssl_verify_succeeds(self, tmp_path):
+        """A fullchain cert trusted by the system CA store returns DEFINITELY_NOT."""
+        cert = tmp_path / "fullchain.pem"
+        cert.write_text(FULL_CHAIN_CERT)
+
+        with patch("octopize_avatar_deploy.steps.nginx.subprocess.run") as mock_run:
+            mock_run.return_value = _make_verify_result(returncode=0)
+            result = detect_self_signed_cert(str(cert))
+
+        assert result == SelfSignedStatus.DEFINITELY_NOT
+        # Verify -untrusted flag is present in the openssl verify call
+        call_args = mock_run.call_args_list[0][0][0]
+        assert "-untrusted" in call_args, (
+            "openssl verify must pass -untrusted so bundled intermediates are used"
+        )
+
+    def test_verify_passes_cert_path_as_both_untrusted_and_positional(self, tmp_path):
+        """The cert path is passed as -untrusted <path> AND as the positional argument."""
+        cert = tmp_path / "fullchain.pem"
+        cert.write_text(FULL_CHAIN_CERT)
+        cert_str = str(cert)
+
+        with patch("octopize_avatar_deploy.steps.nginx.subprocess.run") as mock_run:
+            mock_run.return_value = _make_verify_result(returncode=0)
+            detect_self_signed_cert(cert_str)
+
+        call_args = mock_run.call_args_list[0][0][0]
+        untrusted_idx = call_args.index("-untrusted")
+        assert call_args[untrusted_idx + 1] == cert_str, "cert path follows -untrusted"
+        assert call_args[-1] == cert_str, "cert path is also the positional argument"
+
+    def test_yes_when_subject_equals_issuer(self, tmp_path):
+        """A cert whose subject == issuer is self-signed."""
+        cert = tmp_path / "self.pem"
+        cert.write_text(SINGLE_CERT)
+
+        with patch("octopize_avatar_deploy.steps.nginx.subprocess.run") as mock_run:
+            mock_run.side_effect = [
+                _make_verify_result(returncode=1),  # openssl verify fails
+                _make_x509_result(_SELF_SUBJECT, _SELF_ISSUER),  # subject == issuer
+            ]
+            result = detect_self_signed_cert(str(cert))
+
+        assert result == SelfSignedStatus.YES
+
+    def test_maybe_when_verify_fails_and_subject_ne_issuer(self, tmp_path):
+        """Verify fails but subject != issuer → private/unknown CA → MAYBE."""
+        cert = tmp_path / "private_ca.pem"
+        cert.write_text(FULL_CHAIN_CERT)
+
+        with patch("octopize_avatar_deploy.steps.nginx.subprocess.run") as mock_run:
+            mock_run.side_effect = [
+                _make_verify_result(returncode=1),  # openssl verify fails
+                _make_x509_result(_LE_SUBJECT, _LE_ISSUER),  # subject != issuer
+            ]
+            result = detect_self_signed_cert(str(cert))
+
+        assert result == SelfSignedStatus.MAYBE
+
+    def test_unknown_when_x509_parse_fails(self, tmp_path):
+        """If openssl x509 cannot parse the cert, return UNKNOWN."""
+        cert = tmp_path / "garbage.pem"
+        cert.write_text("not a certificate")
+
+        with patch("octopize_avatar_deploy.steps.nginx.subprocess.run") as mock_run:
+            x509_fail = MagicMock()
+            x509_fail.returncode = 1
+            x509_fail.stdout = ""
+            mock_run.side_effect = [
+                _make_verify_result(returncode=1),  # openssl verify fails
+                x509_fail,  # x509 parse fails too
+            ]
+            result = detect_self_signed_cert(str(cert))
+
+        assert result == SelfSignedStatus.UNKNOWN
+
+    def test_unknown_when_openssl_not_found(self, tmp_path):
+        """If openssl is not available, return UNKNOWN."""
+        cert = tmp_path / "fullchain.pem"
+        cert.write_text(FULL_CHAIN_CERT)
+
+        with patch("octopize_avatar_deploy.steps.nginx.subprocess.run") as mock_run:
+            mock_run.side_effect = FileNotFoundError("openssl not found")
+            result = detect_self_signed_cert(str(cert))
+
+        assert result == SelfSignedStatus.UNKNOWN

{octopize_deploy_tool-2.7.2 → octopize_deploy_tool-2.7.3}/tests/unit/test_deployment_configurator.py

@@ -190,7 +190,7 @@ class TestDeploymentConfigurator:
         assert "ORGANIZATION_NAME=acme" not in content  # It should be in secrets
         assert "NGINX_HTTP_PORT=" not in content
 
-    def test_render_nginx_assets_inline_concrete_settings(
+    def test_render_nginx_self_signed_certificate_assets_inline_concrete_settings(
         self, temp_templates_dir, temp_output_dir, defaults_file
     ):
         """Test rendered Nginx assets inline the resolved TLS/HTTP settings."""
@@ -205,13 +205,21 @@ class TestDeploymentConfigurator:
             "NGINX_TLS_ENABLED": True,
             "NGINX_SSL_CERTIFICATE_PATH": "./tls/server.fullchain.crt",
             "NGINX_SSL_CERTIFICATE_KEY_PATH": "./tls/private/server.decrypted.key",
+            # When using self signed certificate, we need to mount the certificate path
+            # in the api container
+            "SELF_SIGNED_CERT_PATH": "./tls/server.fullchain.crt",
         }
 
         configurator.render_template("docker-compose.yml.template", "docker-compose.yml")
 
         compose_file = temp_output_dir / "docker-compose.yml"
         content = compose_file.read_text()
-        assert "./tls/server.fullchain.crt:/etc/nginx/tls/server.fullchain.crt:ro" in content
+
+        # Make sure that the SSL_CERT_FILE is in the api service environment
+        # and that the volume mounts are correct (api, init-db, dask-scheduler, dask-worker)
+        assert "SSL_CERT_FILE: /certs/server.fullchain.crt" in content
+        assert content.count("./tls/server.fullchain.crt:/certs/server.fullchain.crt:ro") == 4
+
         assert (
             "./tls/private/server.decrypted.key:/etc/nginx/tls/private/server.decrypted.key:ro"
             in content
@@ -219,14 +227,57 @@ class TestDeploymentConfigurator:
         assert "${NGINX_SSL_CERTIFICATE_PATH}" not in content
         assert "${NGINX_SSL_CERTIFICATE_KEY_PATH}" not in content
 
+    def test_render_nginx_tls_certificate_assets_inline_concrete_settings(
+        self, temp_templates_dir, temp_output_dir, defaults_file
+    ):
+        """Test rendered Nginx assets inline the resolved TLS/HTTP settings."""
+        configurator = DeploymentConfigurator(
+            templates_dir=temp_templates_dir,
+            output_dir=temp_output_dir,
+            defaults_file=defaults_file,
+        )
+
         configurator.config = {
+            "PUBLIC_URL": "example.com",
+            "NGINX_TLS_ENABLED": True,
+            "NGINX_SSL_CERTIFICATE_PATH": "./tls/server.fullchain.crt",
+            "NGINX_SSL_CERTIFICATE_KEY_PATH": "./tls/private/server.decrypted.key",
+        }
+
+        configurator.render_template("docker-compose.yml.template", "docker-compose.yml")
+
+        compose_file = temp_output_dir / "docker-compose.yml"
+        content = compose_file.read_text()
+
+        # Make sure that the SSL_CERT_FILE is NOT in the api service environment
+        assert "SSL_CERT_FILE: /certs/server.fullchain.crt" not in content
+        assert content.count("./tls/server.fullchain.crt:/certs/server.fullchain.crt:ro") == 0
+
+        assert (
+            "./tls/private/server.decrypted.key:/etc/nginx/tls/private/server.decrypted.key:ro"
+            in content
+        )
+        assert "${NGINX_SSL_CERTIFICATE_PATH}" not in content
+        assert "${NGINX_SSL_CERTIFICATE_KEY_PATH}" not in content
+
+    def test_render_nginx_no_tls_assets_inline_concrete_settings(
+        self, temp_templates_dir, temp_output_dir, defaults_file
+    ):
+        """Test rendered Nginx assets inline the resolved HTTP settings when TLS is disabled."""
+        configurator2 = DeploymentConfigurator(
+            templates_dir=temp_templates_dir,
+            output_dir=temp_output_dir,
+            defaults_file=defaults_file,
+        )
+
+        configurator2.config = {
             "PUBLIC_URL": "example.com",
             "NGINX_TLS_ENABLED": False,
             "NGINX_HTTP_PORT": 8081,
         }
 
-        configurator.render_template("docker-compose.yml.template", "docker-compose-http.yml")
-        configurator.render_template("nginx.conf.template", "nginx-http.conf")
+        configurator2.render_template("docker-compose.yml.template", "docker-compose-http.yml")
+        configurator2.render_template("nginx.conf.template", "nginx-http.conf")
 
         no_tls_content = (temp_output_dir / "docker-compose-http.yml").read_text()
         assert '"8081:8081"' in no_tls_content