docker-compose.test.yml

# Docker Compose configuration for E2E Testing
# Supports Docker Compose profiles for selective test execution
#
# Usage:
#   docker compose -f docker-compose.test.yml --profile pypi up               # PyPI native client tests
#   docker compose -f docker-compose.test.yml --profile all up                # All native client tests
#
# Profiles:
#   pypi        - PyPI/pip tests (smoke)
#   npm         - NPM tests (smoke)
#   cargo       - Cargo/crates tests (smoke)
#   maven       - Maven tests
#   go          - Go modules tests
#   rpm         - RPM/dnf tests (requires gpg)
#   deb         - Debian/apt tests (requires gpg)
#   helm        - Helm chart tests
#   conda       - Conda package tests
#   docker      - Docker/OCI image tests
#   protobuf    - Protobuf/BSR Connect RPC tests
#   hex         - Hex/Elixir package tests
#   proxy       - Remote proxy + virtual repository tests
#   storage-gc  - Storage garbage collection tests
#   curation    - Curation policy E2E tests (RPM/DEB with mock upstream)
#   smoke       - Smoke tests only (pypi, npm, cargo)
#   all         - All native client tests

services:
  # ==========================================================================
  # INFRASTRUCTURE SERVICES (Always available)
  # ==========================================================================

  postgres:
    image: ghcr.io/artifact-keeper/ci-mirror/postgres:16-alpine
    container_name: e2e-test-db
    environment:
      POSTGRES_USER: registry
      POSTGRES_PASSWORD: registry
      POSTGRES_DB: artifact_registry
    tmpfs:
      - /var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U registry -d artifact_registry"]
      interval: 2s
      timeout: 5s
      retries: 10
    networks:
      - e2e-test-network

  backend:
    image: artifact-keeper-backend:test
    build:
      context: .
      dockerfile: docker/Dockerfile.backend
    container_name: e2e-test-backend
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://registry:registry@postgres:5432/artifact_registry
      STORAGE_PATH: /data/storage
      BACKUP_PATH: /data/backups
      PLUGINS_DIR: /data/plugins
      JWT_SECRET: e2e-test-secret-key-32-bytes-long
      ADMIN_PASSWORD: TestRunner!2026secure
      RUST_LOG: info
      TRIVY_URL: http://trivy:8090
      HOST: 0.0.0.0
      PORT: 8080
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 5s
      timeout: 10s
      start_period: 30s
      retries: 10
    networks:
      - e2e-test-network

  trivy:
    image: ghcr.io/aquasecurity/trivy:0.69.3
    container_name: e2e-test-trivy
    command: ["server", "--listen", "0.0.0.0:8090"]
    volumes:
      - trivy-cache:/root/.cache/trivy
    networks:
      - e2e-test-network

  # Bootstrap: create test repositories after backend is healthy
  setup:
    image: ghcr.io/artifact-keeper/ci-mirror/alpine:3.19
    container_name: e2e-test-setup
    depends_on:
      backend:
        condition: service_healthy
    volumes:
      - ./scripts/e2e-setup.sh:/setup.sh:ro
    command: ["sh", "/setup.sh"]
    environment:
      REGISTRY_URL: http://backend:8080
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
    healthcheck:
      test: ["CMD", "test", "-f", "/tmp/.setup-done"]
      interval: 2s
      timeout: 5s
      retries: 30
    networks:
      - e2e-test-network
    profiles: ["pypi", "npm", "cargo", "maven", "go", "rpm", "deb", "helm", "conda", "docker", "smoke", "all", "proxy", "docker-proxy", "redteam", "tag-replication", "curation"]

  # PKI service: uses pre-generated files from .pki/ if available (CI), otherwise generates them (local)
  pki:
    image: ghcr.io/artifact-keeper/ci-mirror/alpine:3.19
    container_name: e2e-test-pki
    command: >
      sh -c "
        if [ -f /host-pki/ca.crt ] && [ -f /host-pki/server.crt ]; then
          echo 'Using pre-generated PKI files from host';
          cp -r /host-pki/* /pki/ 2>/dev/null || true;
          chmod 644 /pki/*.crt /pki/*.pub 2>/dev/null || true;
          chmod 600 /pki/*.key 2>/dev/null || true;
        else
          echo 'Generating PKI files...';
          apk add --no-cache openssl gnupg bash curl &&
          bash /scripts/pki/generate-certs.sh /pki &&
          bash /scripts/pki/generate-gpg.sh /pki;
        fi &&
        echo 'PKI setup complete' &&
        touch /pki/.ready &&
        tail -f /dev/null
      "
    volumes:
      - ./scripts/pki:/scripts/pki:ro
      - ./.pki:/host-pki:ro
      - pki-data:/pki
    healthcheck:
      test: ["CMD", "test", "-f", "/pki/.ready"]
      interval: 5s
      timeout: 5s
      retries: 20
    networks:
      - e2e-test-network
    profiles: ["pypi", "npm", "cargo", "maven", "go", "rpm", "deb", "helm", "conda", "docker", "smoke", "all", "proxy", "docker-proxy", "redteam", "tag-replication", "curation"]

  # ==========================================================================
  # SMOKE TEST SERVICES (pypi, npm, cargo)
  # ==========================================================================

  pypi-test:
    image: ghcr.io/artifact-keeper/ci-mirror/python:3.12-slim
    container_name: e2e-test-pypi
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
      CA_CERT: /pki/ca.crt
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
    command: ["bash", "/scripts/test-pypi.sh"]
    networks:
      - e2e-test-network
    profiles: ["pypi", "smoke", "all"]

  npm-test:
    image: ghcr.io/artifact-keeper/ci-mirror/node:20-slim
    container_name: e2e-test-npm
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
      CA_CERT: /pki/ca.crt
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
    command: ["bash", "/scripts/test-npm.sh"]
    networks:
      - e2e-test-network
    profiles: ["npm", "smoke", "all"]

  cargo-test:
    image: ghcr.io/artifact-keeper/ci-mirror/rust:1.75-slim
    container_name: e2e-test-cargo
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
      CA_CERT: /pki/ca.crt
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
    command: ["bash", "/scripts/test-cargo.sh"]
    networks:
      - e2e-test-network
    profiles: ["cargo", "smoke", "all"]

  # ==========================================================================
  # EXTENDED TEST SERVICES (Require specific profiles)
  # ==========================================================================

  maven-test:
    image: maven:3.9-eclipse-temurin-21
    container_name: e2e-test-maven
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      CA_CERT: /pki/ca.crt
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
      - maven-cache:/root/.m2
    command: ["bash", "/scripts/test-maven.sh"]
    networks:
      - e2e-test-network
    profiles: ["maven", "all"]

  go-test:
    image: golang:1.22-alpine
    container_name: e2e-test-go
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      GOPROXY: http://backend:8080/go/test-go
      CA_CERT: /pki/ca.crt
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
      - go-cache:/go/pkg
    command: ["sh", "-c", "apk add --no-cache bash curl >/dev/null 2>&1 && bash /scripts/test-go.sh"]
    networks:
      - e2e-test-network
    profiles: ["go", "all"]

  rpm-test:
    image: rockylinux/rockylinux:9-ubi-init
    container_name: e2e-test-rpm
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      CA_CERT: /pki/ca.crt
      GPG_KEY: /pki/gpg-signing.pub
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
    command: ["bash", "/scripts/test-rpm.sh"]
    networks:
      - e2e-test-network
    profiles: ["rpm", "all"]

  deb-test:
    image: debian:bookworm-slim
    container_name: e2e-test-deb
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      CA_CERT: /pki/ca.crt
      GPG_KEY: /pki/gpg-signing.pub
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
    command: ["bash", "/scripts/test-deb.sh"]
    networks:
      - e2e-test-network
    profiles: ["deb", "all"]

  helm-test:
    image: alpine/helm:3.16
    container_name: e2e-test-helm
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      CA_CERT: /pki/ca.crt
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
    command: ["sh", "-c", "apk add --no-cache bash curl >/dev/null 2>&1 && bash /scripts/test-helm.sh"]
    networks:
      - e2e-test-network
    profiles: ["helm", "all"]

  conda-test:
    image: continuumio/miniconda3:latest
    container_name: e2e-test-conda
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      CA_CERT: /pki/ca.crt
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
    command: ["bash", "/scripts/test-conda.sh"]
    networks:
      - e2e-test-network
    profiles: ["conda", "all"]

  docker-test:
    image: docker:24-cli
    container_name: e2e-test-docker
    depends_on:
      setup:
        condition: service_healthy
      pki:
        condition: service_healthy
    environment:
      REGISTRY_URL: backend:8080
      CA_CERT: /pki/ca.crt
    volumes:
      - ./scripts/native-tests:/scripts:ro
      - ./.assets:/assets:ro
      - pki-data:/pki:ro
      - /var/run/docker.sock:/var/run/docker.sock
    command: ["sh", "-c", "apk add --no-cache bash curl jq >/dev/null 2>&1 && bash /scripts/test-docker.sh"]
    networks:
      - e2e-test-network
    profiles: ["docker", "all"]

  # ==========================================================================
  # PROTOBUF / BSR TESTS
  # ==========================================================================

  protobuf-test:
    image: docker.io/alpine:3.19
    container_name: e2e-test-protobuf
    depends_on:
      setup:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
    volumes:
      - ./scripts/native-tests:/scripts:ro
    command: ["sh", "-c", "apk add --no-cache bash curl jq coreutils >/dev/null 2>&1 && bash /scripts/test-protobuf.sh"]
    networks:
      - e2e-test-network
    profiles: ["protobuf", "all"]

  hex-test:
    image: docker.io/alpine:3.19
    container_name: e2e-test-hex
    depends_on:
      setup:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      HEX_REPO_KEY: test-hex
    volumes:
      - ./scripts/native-tests:/scripts:ro
    command: ["sh", "-c", "apk add --no-cache bash curl tar jq coreutils >/dev/null 2>&1 && bash /scripts/test-hex.sh"]
    networks:
      - e2e-test-network
    profiles: ["hex", "all"]

  # ==========================================================================
  # PROXY + VIRTUAL REPOSITORY TESTS
  # ==========================================================================

  proxy-virtual-test:
    image: ghcr.io/artifact-keeper/ci-mirror/node:20-slim
    container_name: e2e-test-proxy-virtual
    depends_on:
      setup:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
    volumes:
      - ./scripts/native-tests:/scripts:ro
    command: ["bash", "-c", "apt-get update -qq && apt-get install -y -qq curl jq python3 python3-pip >/dev/null 2>&1 && bash /scripts/test-proxy-virtual.sh"]
    networks:
      - e2e-test-network
    profiles: ["proxy", "smoke", "all"]

  docker-proxy-test:
    image: ghcr.io/artifact-keeper/ci-mirror/alpine:3.19
    container_name: e2e-test-docker-proxy
    depends_on:
      setup:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
    volumes:
      - ./scripts/native-tests:/scripts:ro
    command: ["sh", "-c", "apk add --no-cache curl jq bash >/dev/null 2>&1 && bash /scripts/test-docker-proxy.sh"]
    networks:
      - e2e-test-network
    profiles: ["docker-proxy", "proxy", "all"]

  # ==========================================================================
  # TAG-FILTERED REPLICATION TESTS
  # ==========================================================================

  tag-replication-test:
    image: python:3.12-slim
    container_name: e2e-test-tag-replication
    depends_on:
      setup:
        condition: service_healthy
    environment:
      API_URL: http://backend:8080
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
    volumes:
      - ./scripts/native-tests:/scripts:ro
    command: ["bash", "/scripts/test-tag-replication.sh"]
    networks:
      - e2e-test-network
    profiles: ["tag-replication", "all"]

  # ==========================================================================
  # STORAGE GARBAGE COLLECTION TESTS
  # ==========================================================================

  storage-gc-test:
    image: alpine:3.19
    container_name: e2e-test-storage-gc
    depends_on:
      backend:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
    volumes:
      - ./scripts/native-tests:/scripts:ro
    command: ["sh", "-c", "apk add --no-cache bash curl jq >/dev/null 2>&1 && bash /scripts/test-storage-gc.sh"]
    networks:
      - e2e-test-network
    profiles: ["storage-gc", "all"]

  # ==========================================================================
  # RED TEAM SECURITY TESTING
  # ==========================================================================

  redteam:
    build:
      context: .
      dockerfile: docker/Dockerfile.redteam
    container_name: e2e-test-redteam
    depends_on:
      setup:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      GRPC_URL: backend:9090
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
      DB_HOST: postgres
      DB_PORT: 5432
      DB_USER: registry
      DB_PASS: registry
      DB_NAME: artifact_registry
      RESULTS_DIR: /results
    volumes:
      - ./scripts/redteam:/scripts:ro
      - redteam-results:/results
    command: ["bash", "/scripts/run-all.sh"]
    cap_add:
      - NET_RAW
    networks:
      - e2e-test-network
    profiles: ["redteam"]

  # ==========================================================================
  # CURATION POLICY TESTS
  # ==========================================================================

  mock-upstream:
    image: nginx:alpine
    container_name: e2e-test-mock-upstream
    profiles: ["curation"]
    volumes:
      - ./scripts/native-tests/fixtures/curation/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./scripts/native-tests/fixtures/curation/rpm:/usr/share/nginx/html/rpm:ro
      - ./scripts/native-tests/fixtures/curation/deb:/usr/share/nginx/html/deb:ro
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost/rpm/repodata/repomd.xml"]
      interval: 3s
      timeout: 3s
      retries: 10
    networks:
      - e2e-test-network

  curation-test:
    image: alpine:3.19
    container_name: e2e-test-curation
    profiles: ["curation"]
    depends_on:
      setup:
        condition: service_healthy
      mock-upstream:
        condition: service_healthy
    environment:
      REGISTRY_URL: http://backend:8080
      ADMIN_USER: admin
      ADMIN_PASS: TestRunner!2026secure
      MOCK_UPSTREAM_URL: http://mock-upstream
      PGHOST: postgres
      PGPORT: "5432"
      PGDATABASE: artifact_registry
      PGUSER: registry
      PGPASSWORD: registry
    volumes:
      - ./scripts/native-tests:/scripts:ro
    entrypoint: ["sh", "-c", "apk add --no-cache curl jq postgresql-client bash > /dev/null 2>&1 && bash /scripts/test-curation.sh"]
    networks:
      - e2e-test-network

networks:
  e2e-test-network:
    name: e2e-test-network
    driver: bridge

volumes:
  pki-data:
  maven-cache:
  go-cache:
  trivy-cache:
  redteam-results: