feat(oci): add Scanopy and force the stop of a container that ignores it

oci/tests/test_scanopy_recipe.py

@@ -0,0 +1,54 @@
+"""Scanopy keeps its three services as native OCI LXCs, without host networking."""
+
+import json
+from pathlib import Path
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class ScanopyRecipeTests(unittest.TestCase):
+    def setUp(self):
+        self.curated = json.loads((ROOT / "catalog/curated/scanopy.json").read_text(encoding="utf-8"))
+        self.generated = json.loads((ROOT / "catalog/apps/scanopy.json").read_text(encoding="utf-8"))
+        self.services = {service["name"]: service for service in self.curated["compose_stack"]["services"]}
+
+    def test_generated_catalog_copy_matches_curated_profile(self):
+        self.assertEqual(self.curated, self.generated)
+
+    def test_the_server_is_the_main_service(self):
+        self.assertEqual(set(self.services), {"daemon", "postgres", "server"})
+        self.assertEqual(self.curated["compose_stack"]["main_service"], "server")
+        self.assertEqual(self.services["server"]["depends_on"], ["daemon", "postgres"])
+
+    def test_only_postgres_stays_off_the_lan(self):
+        self.assertTrue(self.services["daemon"]["frontend_network"])
+        self.assertTrue(self.services["server"]["frontend_network"])
+        self.assertFalse(self.services["postgres"]["frontend_network"])
+
+    def test_the_daemon_needs_no_docker_only_settings(self):
+        compose = self.services["daemon"]["compose"]
+        self.assertNotIn("network_mode", compose)
+        self.assertNotIn("privileged", compose)
+        self.assertNotIn("docker.sock", json.dumps(compose))
+
+    def test_the_daemon_stops_with_the_signal_it_handles(self):
+        self.assertEqual(self.services["daemon"]["compose"]["stop_signal"], "SIGINT")
+
+    def test_the_daemon_is_checked_where_it_answers(self):
+        self.assertIn("/api/health", json.dumps(self.services["daemon"]["compose"]["healthcheck"]))
+
+    def test_the_database_password_is_generated_and_shared(self):
+        password = "${GENERATED_DB_PASSWORD}"
+        self.assertEqual(self.services["postgres"]["compose"]["environment"]["POSTGRES_PASSWORD"], password)
+        self.assertIn(password, self.services["server"]["compose"]["environment"]["SCANOPY_DATABASE_URL"])
+        secrets = self.curated["compose_stack"]["installer_inputs"]["generated_secrets"]
+        self.assertEqual(len(secrets), 1)
+        self.assertEqual({binding["service"] for binding in secrets[0]["bindings"]}, {"postgres", "server"})
+
+    def test_no_password_of_the_test_install_remains(self):
+        self.assertNotIn("pmxLab", json.dumps(self.curated))
+
+
+if __name__ == "__main__":
+    unittest.main()

oci/tests/test_vlan_tag.py

@@ -64,6 +64,23 @@ class TagSetInProxmox(unittest.TestCase):
                          {"bridge": "vmbr1", "vlan_tag": 4})
 
 
+class Stopping(unittest.TestCase):
+    def test_a_container_that_ignores_the_shutdown_is_stopped(self):
+        calls, states = [], [b"status: running", b"status: stopped"]
+
+        def run(*args):
+            calls.append(args[:2])
+            if args[1] == "status":
+                return states.pop(0)
+            if args[1] == "shutdown":
+                raise RuntimeError("container did not stop")
+            return b""
+
+        with patch.object(transaction, "run", run):
+            transaction.stop(108)
+        self.assertIn(("pct", "stop"), calls)
+
+
 class Kept(unittest.TestCase):
     def test_the_update_names_the_tag_it_keeps(self):
         import oci_update_current as update