pretecno/crowdsec-bouncer-traefik-plugin

mirror of https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git synced 2026-07-21 11:38:59 +02:00

Files

T

mhxandClaude Opus 4.8 b201143844 ✨ tests: add binary e2e suite (Traefik binary + Go mock LAPI), run it in CI

Add a second e2e suite that runs Traefik as a downloaded binary with the
plugin loaded from source, and replaces Crowdsec with a small stdlib-only Go
LAPI mock driven via /admin endpoints. No Docker, no real Crowdsec.

The mock lives in its own nested Go module (tests/e2e/mock/mocklapi) so it
stays out of the plugin module's build, lint, test and vendor.

This suite validates the plugin's own behaviour (live/none/stream modes,
caching, trusted-IP bypass, ban/captcha rendering). Crowdsec and AppSec
correctness are out of scope on purpose — they are validated upstream by the
maintainer — so the AppSec scenario is intentionally absent and the README
says so to avoid misfiled issues.

CI now runs this suite only (`make e2e_mock`), since it needs neither Docker
nor a real Crowdsec. The Docker suite (tests/e2e/scenarios) is kept for local
debugging (`make e2e`).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-06 12:03:19 +02:00

lib

✨ tests: end-to-end suite scaffold + stream-mode scenario

2026-06-06 12:03:19 +02:00

mock

✨ tests: add binary e2e suite (Traefik binary + Go mock LAPI), run it in CI

2026-06-06 12:03:19 +02:00

scenarios

🐛 tests: appsec scenario uses OWASP CRS inband collection

2026-06-06 12:03:19 +02:00

README.md

✨ tests: add binary e2e suite (Traefik binary + Go mock LAPI), run it in CI

2026-06-06 12:03:19 +02:00

README.md

End-to-end test suite

There are two suites:

scenarios/ (this one) — real Traefik + Crowdsec Docker containers. High fidelity, kept for local debugging. Run with make e2e.
mock/ — Traefik binary + a mock LAPI, no Docker. This is what CI runs (make e2e_mock). It validates the plugin's own behaviour; Crowdsec / AppSec correctness is out of scope there (that is the upstream maintainer's responsibility).

The rest of this document covers the Docker suite.

These tests spin up real Traefik + Crowdsec containers and exercise the plugin in the same conditions Traefik uses in production: loaded from a local path, no module download, no mocking.

Each scenario lives in its own directory under scenarios/ and owns:

docker-compose.yml — the stack to spin up
run.sh — orchestration + assertions
optional fixtures (acquis.yaml, ban.html, ...)

Running locally

Prerequisites: docker, docker compose, curl, bash.

Run a single scenario:

./tests/e2e/scenarios/stream-mode/run.sh
# or
make e2e_stream-mode

Run everything:

make e2e

Scenarios run sequentially on a single host: they share the canonical crowdsec container name (so cscli commands work uniformly) and the same 8000:80 port. Each scenario uses its own Docker Compose project (-p e2e-<scenario>) and tears its stack down on exit, so the next one starts clean. make e2e runs them one after another; Docker reuses the images pulled by the first scenario, so the Traefik / Crowdsec / whoami images are downloaded only once for the whole suite.

Writing a new scenario

Copy scenarios/stream-mode/ as a template.
Rename container_names (keep crowdsec for the LAPI container).
Edit run.sh to express the behavior under test.
Add the scenario name to E2E_SCENARIOS in the Makefile.

CI

This Docker suite is not run in CI — it is meant for local debugging. .github/workflows/e2e.yml runs the mock/ suite (make -k e2e_mock) instead, which needs neither Docker nor a real Crowdsec. Run this suite locally with make e2e (or make e2e_<scenario>).