ci(stepup-behat): generate HAProxy dev certificate before compose up - #98
Merged
Merged
Conversation
Commit 2291d6f stopped committing core/haproxy/haproxy.pem and moved its generation into core/scripts/create_dev_ca.sh, invoked only by start-dev-env.sh. The stepup-behat workflow runs 'docker compose up' directly, so haproxy.pem was missing; Docker created it as a directory and the haproxy container failed to start, taking down TLS routing and every Behat scenario with it. Run create_dev_ca.sh in the Init step, matching start-dev-env.sh's guard.
Since the CA became dynamically generated (2291d6f) the app containers no longer trust the HAProxy TLS certificate: the static stepup/haproxy/haproxy.crt that used to be committed is gone, and only start-dev-env.sh copies the freshly generated one into place. CI skipped that copy, so every inter-service HTTPS call failed with 'cURL error 60: self signed certificate in certificate chain', cascading into ~100 Behat failures. Copy core/haproxy/haproxy.crt to stepup/haproxy/haproxy.crt before compose up; the base image imports /config/haproxy/haproxy.crt and runs update-ca-certificates on startup.
This was referenced Sep 8, 2026
Mount a selfservice parameters override so logout redirects stay inside the dev/CI environment instead of following the baked-in www.surf.nl URLs. Update the Behat expectation to assert the local test SP target.
kayjoosten
force-pushed
the
fix/stepup-behat-haproxy-cert
branch
from
September 8, 2026 21:31
2d3ddb0 to
4faa694
Compare
The previous commit assumed the docker-compose bind mount of the full stepup/selfservice/parameters.yaml onto the container's config was a bug that clobbered the image's baked-in configuration, and replaced it with a partial merge against that baked-in config via an entrypoint script. That assumption was wrong. The full local parameters.yaml is the intentional, correct pattern already used for this dev/behat environment: it supplies the gateway, middleware and SAML values this environment actually needs (dev URLs, dev SAML certificates and credentials), which are not present in the image's baked-in config at all. Replacing it with a partial merge dropped all of those values and broke the SAML login redirect, which is why the Behat suite started failing (22 scenarios) right after that change. This reverts back to mounting the full local parameters.yaml, which is the state the Behat suite was passing against before.
create_dev_ca.sh always produces haproxy.pem and haproxy.crt together, but the regeneration check only looked at haproxy.pem. Check both so the CA cert copy step right after can't run against a missing haproxy.crt.
The upstream fix in Stepup-SelfService (parameters.yaml.dist now points logout_redirect_url at the local dev domain, matching every other URL in that file) is merged and published in the :test image, so this stack no longer needs its own bind-mounted parameters.yaml. selfservice now behaves like gateway/middleware/ra: no devconf-side config override needed.
Contributor
|
The pull request description seems to be much bigger than the actual changes? 7 commits for 2 changed files? Is the description still accurate? |
johanib
approved these changes
Sep 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
stepup-behatCI fails: HAProxy's dev TLS cert isn't generated beforedocker compose up, since commit 2291d6f moved that step intocreate_dev_ca.sh, which onlystart-dev-env.shcalls (not CI).Fix
compose upif missing(checking both
haproxy.pemandhaproxy.crt, which are always producedtogether), and copy the CA cert into the stack so containers trust HAProxy.
(
ssp.dev.openconext.local) instead of the public SURF one, now thatFix dev logout redirect default and stale :test image trigger Stepup-SelfService#559 fixes that redirect upstream.
Supersedes #97 (wrong
--remote-allow-originslead).