0ed892a412
Fixes three Bitcoin/wallet failures observed across the fleet on v1.7.90-alpha
(all nodes were already on the latest build — these were live bugs, not stale
builds), plus the missing ElectrumX tile, and adds automated coverage so each
can't regress silently.
Receive address (".116 receive fails", ".228 false 'wallet is locked'"):
- LND publishes its REST API on a host port that can drift from the manifest
(a container created when the mapping was 8080 kept publishing 8080 after the
manifest moved to 18080). The in-process client connects to the manifest port,
gets connection-refused, and wallet init fails forever while the container
looks "Up". Add published-port drift detection to the reconciler
(container_ports_drifted / host_port_bindings_drifted) that recreates a
drifted backend even for restart-sensitive apps — a drifted container is
already broken, so leaving it "untouched" only perpetuates the failure.
- Receive errors now carry a stable [CODE] token (REST_UNREACHABLE, WALLET_LOCKED,
WALLET_UNINITIALIZED, SYNCING) and always start with "Bitcoin address" so they
survive the RPC error sanitizer instead of collapsing to the generic
"Operation failed". The UI maps the code instead of guessing wallet state from
substrings — so an unreachable REST endpoint is no longer mislabelled "locked".
Bitcoin install (".198 bitcoin gone / reinstall just stops"):
- bitcoin-knots requires the secret bitcoin-rpc-txrelay-rpcauth, which was only
generated by the tx-relay flow. Nodes that never used tx-relay lacked it, so
secret resolution hard-failed and the whole Bitcoin stack cascaded. Generate
it idempotently before bitcoin starts (ensure_app_secrets, reusing
ensure_txrelay_credentials), and name the missing secret in the error so a
genuine gap is actionable instead of a bare "IO error".
ElectrumX app tile missing on every node with it installed:
- The catalog generator dropped electrumx because the manifest had no
interfaces.main block, so the tile had no launch URL and was hidden. Declare
the companion UI port (50002) in the manifest, regenerate the catalog, and let
an app with a known launch URL stay launchable while its backend is still
"starting" (ElectrumX indexes for 10m+).
Test harness:
- New lifecycle bats suites: bitcoin-receive, port-drift, secret-completeness
(validated live; port-drift catches the real .116 drift).
- Rust unit tests for drift detection, the receive reason-code classifier, and
the named-missing-secret error; vitest for the UI code mapping.
- create-release.sh now runs tests/release/run.sh and aborts the release on
failure — previously it ran no tests at all.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
74 lines
2.5 KiB
Bash
74 lines
2.5 KiB
Bash
#!/usr/bin/env bats
|
|
# tests/lifecycle/bats/secret-completeness.bats
|
|
#
|
|
# Regression guard for the .198 failure class: a manifest references a
|
|
# `secret_env.secret_file` that was never generated on the node, so secret
|
|
# resolution hard-fails and the container won't start — cascading the whole
|
|
# Bitcoin stack. (bitcoin-knots gained `bitcoin-rpc-txrelay-rpcauth`, which old
|
|
# nodes lacked, so bitcoind never came up and reinstall "just stopped".)
|
|
#
|
|
# For every installed backend, assert every secret_file it references exists in
|
|
# the secrets dir. Runs on the archy host.
|
|
#
|
|
# Tiers: read-only.
|
|
|
|
SECRETS_DIR="${ARCHY_SECRETS_DIR:-/var/lib/archipelago/secrets}"
|
|
|
|
_apps_dir() {
|
|
local d
|
|
for d in "${ARCHIPELAGO_APPS_DIR:-}" /opt/archipelago/apps \
|
|
"$BATS_TEST_DIRNAME/../../../apps"; do
|
|
[[ -n "$d" && -d "$d" ]] && { echo "$d"; return 0; }
|
|
done
|
|
return 1
|
|
}
|
|
|
|
_manifest_for() {
|
|
local app="$1" dir mf
|
|
dir=$(_apps_dir) || return 1
|
|
for mf in "$dir/$app/manifest.yml" "$dir/$app/manifest.yaml"; do
|
|
[[ -r "$mf" ]] && { echo "$mf"; return 0; }
|
|
done
|
|
return 1
|
|
}
|
|
|
|
_secret_files_in() {
|
|
# Emit each `secret_file:` value referenced by the manifest.
|
|
grep -E '^[[:space:]]*secret_file:' "$1" 2>/dev/null | awk '{print $2}'
|
|
}
|
|
|
|
_secret_exists() {
|
|
local f="$SECRETS_DIR/$1"
|
|
[[ -e "$f" ]] && return 0
|
|
sudo -n test -f "$f" 2>/dev/null
|
|
}
|
|
|
|
@test "every installed backend's referenced secrets exist on disk" {
|
|
command -v podman >/dev/null 2>&1 || skip "podman not available"
|
|
[[ -d "$SECRETS_DIR" ]] || sudo -n test -d "$SECRETS_DIR" 2>/dev/null || skip "secrets dir not present"
|
|
|
|
local checked=0 missing="" app cname mf sf
|
|
# container-name : manifest-app-id (the bitcoin stack that cascades)
|
|
for pair in \
|
|
"bitcoin-knots:bitcoin-knots" "lnd:lnd" "electrumx:electrumx" \
|
|
"mempool-api:mempool-api" "btcpay-server:btcpay-server" \
|
|
"archy-nbxplorer:archy-nbxplorer" "fedimint:fedimint" \
|
|
"fedimint-gateway:fedimint-gateway"; do
|
|
cname="${pair%%:*}"; app="${pair##*:}"
|
|
podman container exists "$cname" 2>/dev/null || continue
|
|
mf=$(_manifest_for "$app") || continue
|
|
while read -r sf; do
|
|
[[ -n "$sf" ]] || continue
|
|
checked=$((checked + 1))
|
|
_secret_exists "$sf" || missing+="${app} -> ${sf}\n"
|
|
done < <(_secret_files_in "$mf")
|
|
done
|
|
|
|
[[ "$checked" -gt 0 ]] || skip "no installed backends with secret references to check"
|
|
if [[ -n "$missing" ]]; then
|
|
echo "installed apps reference missing secrets:" >&2
|
|
echo -e "$missing" >&2
|
|
return 1
|
|
fi
|
|
}
|