feat: define first HTTPS service-exposure lane#195
Conversation
Add the HTTPS service-exposure validation lane under the access/TLS epic (projectbluefin#53). This defines what certificate, hostname/routing, and reachability evidence the lane must capture for representative homelab service endpoints. Changes: - Add §6 to homelab-contracts.md defining the HTTPS exposure lane with minimum evidence requirements, fixture description, and explicit call-outs for deferred auth/firewall/cert-lifecycle work - Add test_https_exposure.py with six checks: DNS resolution, TLS handshake, certificate subject match, TLS version enforcement, HTTPS reachability, and wrong-host rejection - Wire the new test suite into the homelab-access-probe WorkflowTemplate as a parallel DAG task alongside the existing access probe tests - Update workload matrix table to include the HTTPS exposure class Signed-off-by: Andy Anderson <andy@clubanderson.com> Signed-off-by: unknown <unknown@users.noreply.github.com>
hanthor
left a comment
hanthor
left a comment
There was a problem hiding this comment.
LGTM — well-structured test/infra addition, clean code.
hanthor
left a comment
hanthor
left a comment
There was a problem hiding this comment.
Approved via org-wide review.
hanthor
left a comment
hanthor
left a comment
There was a problem hiding this comment.
Approved via org-wide review.
hanthor
left a comment
hanthor
left a comment
There was a problem hiding this comment.
Review: Approved ✅
Part of the structured service-catalog project build-up. Conventional Commits format, referenced issues, consistent with related PRs in the series.
castrojo
added
needs-triage
This PR is approved for merge but is currently blocked by conflicts in Action required: Please rebase onto |
4 participants
Summary
Defines the first HTTPS service-exposure validation lane under the access/TLS epic (#53), closing #58.
docs/homelab-contracts.mdspecifying the representative endpoint (homelab-accessfixture), minimum evidence artifacts (DNS, TLS handshake, cert subject, TLS version, HTTPS reachability, wrong-host rejection), and explicit call-outs for deferred work (auth-gating feat: define auth-gating lane for exposed homelab service UIs #61, firewall/NetworkPolicy, cert lifecycle, external exposure)tests/homelab_access/test_https_exposure.pywith six pytest checks that produce the required evidence artifactshomelab-access-probeWorkflowTemplate as a parallel DAG task (run-https-exposure-tests) alongside existing access probe testsFollow-up work called out explicitly
Closes #58
Test plan
just run-homelab-accessruns the updated workflow with bothrun-access-testsandrun-https-exposure-teststasks/tmp/results/