coolify/tests/Feature/DevScriptFirewallDelegationTest.php

<?php

it('delegates dev firewall commands to the coolify CLI instead of calling coold APIs directly', function () {
    $script = file_get_contents(base_path('scripts/dev.sh'));

    expect($script)->toContain('coolify_firewall()')
        ->and($script)->toContain('"$(coolify_cli_bin)" firewall "$command"')
        ->and($script)->toContain('--nodes "$nodes"')
        ->and($script)->toContain('--ssh-config "$ssh_config"')
        ->and($script)->not->toContain('/api/v1/firewall/allow')
        ->and($script)->not->toContain('firewall_api_for_each_vm');
});

it('installs the coolify CLI in both application container images', function (string $dockerfile) {
    $contents = file_get_contents(base_path($dockerfile));

    expect($contents)->toContain('ARG COOLIFY_CLI_VERSION=nightly')
        ->and($contents)->toContain('coolify-linux-musl-${COOLIFY_CLI_ARCH}.tar.gz')
        ->and($contents)->toContain('install -m 0755 /tmp/coolify /usr/local/bin/coolify');
})->with([
    'development image' => 'docker/development/Dockerfile',
    'production image' => 'docker/production/Dockerfile',
]);

it('does not require predefined UI node environment variables in the development app container', function () {
    $compose = file_get_contents(base_path('docker-compose.dev.yml'));
    $config = file_get_contents(base_path('config/coold.php'));

    expect($compose)->not->toContain('COOLIFY_CLI_NODES:')
        ->and($compose)->not->toContain('COOLIFY_CLI_SSH_CONFIG:')
        ->and($compose)->not->toContain('COOLIFY_CLI_WG_LISTEN_PORT_OVERRIDES:')
        ->and($compose)->not->toContain('COOLIFY_CLI_WG_ENDPOINT_OVERRIDES:')
        ->and($compose)->not->toContain('COOLIFY_CLI_TIMEOUT:')
        ->and($config)->not->toContain('cli_nodes')
        ->and($config)->not->toContain('COOLIFY_CLI_NODES');
});

it('supports a naked up mode that starts VMs and Spin but skips server bootstrap wiring', function () {
    $script = file_get_contents(base_path('scripts/dev.sh'));

    expect($script)->toContain('local naked=false')
        ->and($script)->toContain('--naked')
        ->and($script)->toContain('if [ "${#spin_args[@]}" -gt 0 ]; then')
        ->and($script)->toContain('spin up -d "${spin_args[@]}"')
        ->and($script)->toContain('spin up -d')
        ->and($script)->toContain('if [ "$naked" = "true" ]; then')
        ->and($script)->toContain('Skipping coolify bootstrap and Flux VM wiring')
        ->and($script)->toContain('coolify_bootstrap_with_retry')
        ->and($script)->toContain('--concurrency "$(coolify_bootstrap_concurrency)"')
        ->and($script)->toContain('--ssh-timeout "$(coolify_bootstrap_ssh_timeout)"')
        ->and($script)->toContain('--debug')
        ->and($script)->toContain('configure_flux_dev_for_vm "$index"')
        ->and($script)->toContain('sync_v5_dev_lima_servers');
});

it('retries dev coolify bootstrap because fresh Lima setup can complete across partial phases', function () {
    $script = file_get_contents(base_path('scripts/dev.sh'));

    expect($script)->toContain('coolify_bootstrap_with_retry()')
        ->and($script)->toContain('local attempts=5')
        ->and($script)->toContain('if coolify_bootstrap; then')
        ->and($script)->toContain('diagnose_coold_bootstrap_failure')
        ->and($script)->toContain('systemctl --failed --no-pager')
        ->and($script)->toContain('systemctl --no-pager --full status wg-quick@wg0 podman.socket corrosion coold')
        ->and($script)->toContain('fresh Lima hosts can finish setup after partial bootstrap phases');
});

it('seeds bootstrapped Lima VMs into v5 development server state', function () {
    $script = file_get_contents(base_path('scripts/dev.sh'));
    $compose = file_get_contents(base_path('docker-compose.dev.yml'));

    expect($script)->toContain('sync_v5_dev_lima_servers()')
        ->and($script)->toContain('COOLIFY_CLI_SSH_USER="$ssh_user"')
        ->and($script)->toContain('COOLIFY_CLI_SSH_USER="$(coolify_ssh_user)" spin up -d')
        ->and($script)->toContain('lima_ssh_port "$index"')
        ->and($script)->toContain('host.docker.internal')
        ->and($script)->toContain('v5:sync-dev-lima-servers')
        ->and($script)->toContain('--server="${instance}|host.docker.internal|${ssh_user}|${ssh_port}"')
        ->and($compose)->toContain('COOLIFY_CLI_SSH_USER: "${COOLIFY_CLI_SSH_USER:-}"')
        ->and($script)->not->toContain('db:seed --class=V5DevLimaSeeder --force')
        ->and($script)->not->toContain('--server "${instance}|${node}|$(coolify_ssh_user)|22"');
});

it('configures predictable Lima SSH local ports for dev VMs', function () {
    $script = file_get_contents(base_path('scripts/dev.sh'));
    $vmScript = file_get_contents(base_path('scripts/coold-vm.sh'));
    $template = file_get_contents(base_path('dev/lima/coold.yaml'));

    expect($script)->toContain('coold_vm_ssh_port()')
        ->and($script)->toContain('COOLIFY_COOLD_VM_SSH_PORT_')
        ->and($script)->toContain('6000${index}')
        ->and($script)->toContain('COOLIFY_COOLD_VM_SSH_PORT="$(coold_vm_ssh_port "$index")"')
        ->and($vmScript)->toContain('SSH_PORT="$(read_coolify_env COOLIFY_COOLD_VM_SSH_PORT 60002)"')
        ->and($vmScript)->toContain('{{COOLIFY_COOLD_VM_SSH_PORT}}')
        ->and($template)->toContain('ssh:')
        ->and($template)->toContain('localPort: {{COOLIFY_COOLD_VM_SSH_PORT}}');
});

it('authorizes the seeded testing host key in dev Lima VMs', function () {
    $template = file_get_contents(base_path('dev/lima/coold.yaml'));

    expect($template)->toContain('coolify_test_public_key=')
        ->and($template)->toContain('ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFuGmoeGq/pojrsyP1pszcNVuZx9iFkCELtxrh31QJ68')
        ->and($template)->toContain('authorized_keys')
        ->and($template)->toContain('grep -qxF "$coolify_test_public_key"')
        ->and($template)->toContain('install -d -m 700 /root/.ssh')
        ->and($template)->toContain('/root/.ssh/authorized_keys')
        ->and($template)->toContain('target_home="$(getent passwd 501 | cut -d: -f6 || true)"')
        ->and($template)->toContain('owner="$(stat -c \'%u:%g\' "$target_home")"')
        ->and($template)->not->toContain('mode: user')
        ->and($template)->not->toContain('user="$(basename "$home")"');
});

it('hardcodes the naked Lima VM ssh port for bootstrap testing', function () {
    $template = file_get_contents(base_path('.dev/lima/coolify-naked-test.yaml'));

    expect($template)->toContain('ssh:')
        ->and($template)->toContain('localPort: 60003');
});

it('supports down cleanup as the preferred VM cleanup command', function () {
    $script = file_get_contents(base_path('scripts/dev.sh'));

    expect($script)->toContain('local cleanup=false')
        ->and($script)->toContain('--cleanup')
        ->and($script)->toContain('if [ "$cleanup" = "true" ]; then')
        ->and($script)->toContain('clean_vms')
        ->and($script)->toContain('down --cleanup')
        ->and($script)->toContain('clean-vms Delete the coold Lima VMs and all VM-local runtime state (alias for down --cleanup)');
});

it('scripts a full fresh dev reset with bounded Lima startup retries', function () {
    $script = file_get_contents(base_path('scripts/dev.sh'));
    $vmScript = file_get_contents(base_path('scripts/coold-vm.sh'));

    expect($script)->toContain('fresh()')
        ->and($script)->toContain('down --cleanup')
        ->and($script)->toContain('COOLIFY_DEV_FOLLOW_LOGS=false up')
        ->and($script)->toContain('php artisan migrate:fresh --seed --force')
        ->and($script)->toContain('sync_v5_dev_lima_servers')
        ->and($script)->toContain('recreate_naked_lima_vm')
        ->and($script)->toContain('COOLIFY_NAKED_VM_START_TIMEOUT')
        ->and($script)->toContain('limactl start --tty=false --name="$instance" "$config"')
        ->and($script)->toContain('cleanup_lima_instance_processes "$instance"')
        ->and($script)->toContain('did not become ready after ${attempts} attempts')
        ->and($script)->toContain('refresh_test_host_key')
        ->and($script)->toContain('coold_vm_up_with_retry()')
        ->and($script)->toContain('COOLIFY_COOLD_BOOTSTRAP_CONCURRENCY 1')
        ->and($script)->toContain('COOLIFY_COOLD_BOOTSTRAP_SSH_TIMEOUT 90s')
        ->and($script)->toContain('local attempts=2')
        ->and($script)->toContain('deleting and retrying with a fresh Lima instance')
        ->and($script)->toContain('cleanup_lima_instance_processes()')
        ->and($script)->toContain('kill_matching_processes()')
        ->and($script)->toContain('kill -9 $pids')
        ->and($script)->toContain('limactl hostagent .*${instance}')
        ->and($script)->toContain('ssh: .*/.lima/${instance}/ssh.sock')
        ->and($vmScript)->toContain('COOLIFY_COOLD_VM_START_TIMEOUT')
        ->and($vmScript)->toContain('lima_shell_timeout()')
        ->and($vmScript)->toContain('cleanup_lima_probe_processes()')
        ->and($vmScript)->toContain('cleanup_lima_hostagent_processes()')
        ->and($vmScript)->toContain('kill_matching_processes()')
        ->and($vmScript)->toContain('pkill -P "$pid"')
        ->and($vmScript)->toContain('lima_shell_timeout 5 true')
        ->and($vmScript)->toContain('Lima start timed out after ${START_TIMEOUT}s')
        ->and($vmScript)->toContain('Guest SSH timed out after ${START_TIMEOUT}s')
        ->and($vmScript)->toContain('Guest provisioning timed out after ${START_TIMEOUT}s');
});