Harden NordVPN reconciliation and WebGUI testing

This commit is contained in:
ms2k 2026-08-07 02:30:26 +09:00
commit b4a30ca190

View file

@ -10,24 +10,52 @@ umask 077
script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
runtime_dir="$script_dir/.runtime"
ui_port=${OPNSENSE_UI_PORT:-18443}
credentials_file="$runtime_dir/credentials.env"
launcher_file="$runtime_dir/launcher.pid"
test -r "$NORDVPN_PACKAGE_PATH"
test -r "$OPNSENSE_VM_IMAGE"
test -r "$OPNSENSE_TRANSFER_IMAGE"
mkdir -p "$runtime_dir"
if [ -r "$launcher_file" ]; then
read -r previous_launcher < "$launcher_file"
case "$previous_launcher" in
*[!0-9]* | '') ;;
*)
if kill -0 "$previous_launcher" 2>/dev/null; then
echo "An OPNsense UI fixture is already running." >&2
exit 1
fi
;;
esac
fi
rm -f "$runtime_dir/opnsense.qcow2" "$runtime_dir/serial.in" "$runtime_dir/serial.out" \
"$runtime_dir/serial.log" "$runtime_dir/transfer.img"
"$runtime_dir/serial.log" "$runtime_dir/transfer.img" "$runtime_dir/ready" \
"$credentials_file" "$runtime_dir/ui-password"
password=$(openssl rand -hex 32)
printf '%s\n' "$password" > "$runtime_dir/ui-password"
printf '%s\n' "OPNSENSE_UI_BASE_URL=https://127.0.0.1:$ui_port" > "$credentials_file"
printf '%s\n' 'OPNSENSE_UI_USERNAME=root' >> "$credentials_file"
printf '%s\n' "OPNSENSE_UI_PASSWORD=$password" >> "$credentials_file"
printf '%s\n' 'OPNSENSE_UI_TEST_ALLOW_MUTATION=1' >> "$credentials_file"
chmod 600 "$credentials_file" "$runtime_dir/ui-password"
printf '%s\n' "$$" > "$launcher_file"
mkfifo "$runtime_dir/serial.in" "$runtime_dir/serial.out"
qemu-img create -q -f qcow2 -F qcow2 -b "$OPNSENSE_VM_IMAGE" "$runtime_dir/opnsense.qcow2"
cp "$OPNSENSE_TRANSFER_IMAGE" "$runtime_dir/transfer.img"
mcopy -o -i "$runtime_dir/transfer.img" "$NORDVPN_PACKAGE_PATH" ::os-nordvpn.pkg
mcopy -o -i "$runtime_dir/transfer.img" "$script_dir/guest-setup.php" ::guest-setup.php
mcopy -o -i "$runtime_dir/transfer.img" "$runtime_dir/ui-password" ::ui-password
cleanup()
{
set +e
[ -n "${qemu_pid:-}" ] && kill "$qemu_pid" 2>/dev/null
[ -n "${serial_log_pid:-}" ] && kill "$serial_log_pid" 2>/dev/null
rm -f "$runtime_dir/credentials.env" "$runtime_dir/ui-password" "$runtime_dir/ready" \
"$runtime_dir/transfer.img" "$runtime_dir/opnsense.qcow2" "$launcher_file" \
"$runtime_dir/serial.in" "$runtime_dir/serial.out" "$runtime_dir/serial.log"
}
trap cleanup EXIT INT TERM
@ -46,6 +74,7 @@ qemu-system-x86_64 \
qemu_pid=$!
cat "$runtime_dir/serial.out" >> "$runtime_dir/serial.log" &
serial_log_pid=$!
wait_for()
{
@ -77,7 +106,8 @@ send "mount -uw /\n"
sleep 2
send "sh /etc/rc\n"
wait_for 'root@OPNsense:/ #' 300
send "mount -o ro -t msdosfs /dev/vtbd1 /mnt && pkg add -f /mnt/os-nordvpn.pkg && php /mnt/guest-setup.php && umount /mnt && pfctl -d && echo UI_VM_READY\n"
send "mount -o ro -t msdosfs /dev/vtbd1 /mnt && pkg add -f /mnt/os-nordvpn.pkg && php /mnt/guest-setup.php && umount /mnt && (pfctl -d >/dev/null 2>&1 || true) && echo UI_VM_READY\n"
wait_for 'UI_VM_READY' 120
printf '%s\n' "OPNSENSE_UI_BASE_URL=https://127.0.0.1:$ui_port"
touch "$runtime_dir/ready"
printf '%s\n' "OPNSENSE_UI_CREDENTIALS_FILE=$credentials_file"
wait "$qemu_pid"