azure-pipelines.yml

# Azure Pipeline for Lab 08: Docker Network Security
# Tests all 5 scenarios to ensure they work correctly

trigger:
  branches:
    include:
      - main
      - develop
  paths:
    include:
      - labs/08-network-security/**

pr:
  branches:
    include:
      - main
      - develop
  paths:
    include:
      - labs/08-network-security/**

pool:
  vmImage: 'ubuntu-latest'

variables:
  LAB_DIR: 'labs/08-network-security'

stages:
  - stage: ValidateScripts
    displayName: 'Validate Scripts'
    jobs:
      - job: ShellCheck
        displayName: 'Run ShellCheck on Demo Scripts'
        steps:
          - script: |
              sudo apt-get update
              sudo apt-get install -y shellcheck
            displayName: 'Install ShellCheck'

          - script: |
              cd $(LAB_DIR)
              shellcheck demo-*.sh cleanup.sh run-all-demos.sh || true
            displayName: 'Analyze Shell Scripts'

  - stage: TestScenarios
    displayName: 'Test Network Security Scenarios'
    dependsOn: ValidateScripts
    jobs:
      - job: Scenario1
        displayName: 'Scenario 1: Network Isolation'
        timeoutInMinutes: 10
        steps:
          - script: |
              cd $(LAB_DIR)
              chmod +x demo-isolation.sh cleanup.sh
              # Run in non-interactive mode (auto-confirm all pauses)
              yes "" | timeout 300 ./demo-isolation.sh || true
              ./cleanup.sh
            displayName: 'Run Scenario 1'

          - script: |
              # Verify no containers left running
              if docker ps -a | grep -E "web-frontend|web-backend|api"; then
                echo "ERROR: Containers not cleaned up"
                exit 1
              fi
            displayName: 'Verify Cleanup'

      - job: Scenario2
        displayName: 'Scenario 2: Multi-Tier Segmentation'
        timeoutInMinutes: 10
        steps:
          - script: |
              cd $(LAB_DIR)
              chmod +x demo-segmentation.sh cleanup.sh
              yes "" | timeout 300 ./demo-segmentation.sh || true
              ./cleanup.sh
            displayName: 'Run Scenario 2'

          - script: |
              if docker ps -a | grep -E "public-net|app-net|database-net"; then
                echo "ERROR: Networks not cleaned up"
                exit 1
              fi
            displayName: 'Verify Cleanup'

      - job: Scenario3
        displayName: 'Scenario 3: Internal Networks'
        timeoutInMinutes: 10
        steps:
          - script: |
              cd $(LAB_DIR)
              chmod +x demo-internal-network.sh cleanup.sh
              yes "" | timeout 300 ./demo-internal-network.sh || true
              ./cleanup.sh
            displayName: 'Run Scenario 3'

      - job: Scenario4
        displayName: 'Scenario 4: TLS Encryption'
        timeoutInMinutes: 10
        steps:
          - script: |
              set -e
              echo "=== Diagnostic Information ==="
              echo "Current directory: $(pwd)"
              echo "LAB_DIR value: $(LAB_DIR)"
              
              # Navigate to lab directory
              cd $(System.DefaultWorkingDirectory)/$(LAB_DIR)
              echo "After cd to LAB_DIR: $(pwd)"
              echo "Directory contents:"
              ls -la
              
              # Check if certs directory exists
              if [ ! -d "certs" ]; then
                echo "ERROR: certs directory does not exist!"
                echo "Creating certs directory..."
                mkdir -p certs
              fi
              
              # Make scripts executable
              chmod +x demo-tls-encryption.sh cleanup.sh
              if [ -f "certs/generate-certs.sh" ]; then
                chmod +x certs/generate-certs.sh
              else
                echo "WARNING: certs/generate-certs.sh not found"
                echo "Contents of certs directory:"
                ls -la certs/ || echo "Cannot list certs directory"
                exit 1
              fi
              
              # Generate certificates
              echo "=== Generating TLS Certificates ==="
              cd certs
              ./generate-certs.sh
              cd ..
              
              # Verify certificates exist
              echo "=== Verifying Certificate Files ==="
              if [ ! -f "certs/server-cert.pem" ] || [ ! -f "certs/server-key.pem" ]; then
                echo "ERROR: Certificate generation failed"
                echo "Contents of certs directory:"
                ls -la certs/
                exit 1
              fi
              
              echo "SUCCESS: Certificates generated"
              ls -lh certs/*.pem
            displayName: 'Generate and Verify Certificates'

          - script: |
              cd $(System.DefaultWorkingDirectory)/$(LAB_DIR)
              yes "" | timeout 300 ./demo-tls-encryption.sh || true
            displayName: 'Run Scenario 4'
            
          - script: |
              cd $(System.DefaultWorkingDirectory)/$(LAB_DIR)
              ./cleanup.sh
            displayName: 'Cleanup'

      - job: Scenario5
        displayName: 'Scenario 5: Common Misconfigurations'
        timeoutInMinutes: 10
        steps:
          - script: |
              cd $(LAB_DIR)
              chmod +x demo-misconfigurations.sh cleanup.sh
              yes "" | timeout 300 ./demo-misconfigurations.sh || true
              ./cleanup.sh
            displayName: 'Run Scenario 5'

  - stage: TestDockerCompose
    displayName: 'Test Docker Compose'
    dependsOn: TestScenarios
    jobs:
      - job: SecureCompose
        displayName: 'Test Secure Compose'
        steps:
          - script: |
              cd $(System.DefaultWorkingDirectory)/$(LAB_DIR)
              docker compose -f docker-compose.yml up -d
              sleep 10
              docker compose -f docker-compose.yml ps
              docker compose -f docker-compose.yml down -v
            displayName: 'Test Secure Docker Compose'

      - job: ValidateInsecureCompose
        displayName: 'Validate Insecure Compose (Educational)'
        steps:
          - script: |
              cd $(System.DefaultWorkingDirectory)/$(LAB_DIR)
              # Just validate syntax, don't run (it's intentionally insecure)
              docker compose -f docker-compose.insecure.yml config > /dev/null
              echo "Insecure compose file syntax is valid"
            displayName: 'Validate Insecure Compose Syntax'

  - stage: IntegrationTest
    displayName: 'Integration Test - Run All'
    dependsOn: TestDockerCompose
    condition: succeededOrFailed()
    jobs:
      - job: RunAllScenarios
        displayName: 'Run Master Script'
        timeoutInMinutes: 30
        steps:
          - script: |
              cd $(LAB_DIR)
              chmod +x run-all-demos.sh cleanup.sh
              # Run master script in non-interactive mode
              yes "" | timeout 1800 ./run-all-demos.sh || true
              ./cleanup.sh
            displayName: 'Run All Scenarios'

          - script: |
              # Final verification - no resources left
              echo "Checking for leftover containers..."
              docker ps -a
              echo "Checking for leftover networks..."
              docker network ls
              
              # Cleanup any remaining test resources
              docker rm -f $(docker ps -aq) 2>/dev/null || true
              docker network prune -f
            displayName: 'Final Cleanup and Verification'

  - stage: Documentation
    displayName: 'Validate Documentation'
    dependsOn: []
    jobs:
      - job: CheckREADME
        displayName: 'Validate README'
        steps:
          - script: |
              cd $(LAB_DIR)
              if [ ! -f "README.md" ]; then
                echo "ERROR: README.md not found"
                exit 1
              fi
              
              # Check README has minimum content
              if [ $(wc -l < README.md) -lt 100 ]; then
                echo "WARNING: README seems incomplete"
              fi
              
              echo "README.md validated"
            displayName: 'Check README Exists'

      - job: CheckScripts
        displayName: 'Verify All Scripts Present'
        steps:
          - script: |
              cd $(LAB_DIR)
              
              REQUIRED_SCRIPTS=(
                "demo-isolation.sh"
                "demo-segmentation.sh"
                "demo-internal-network.sh"
                "demo-tls-encryption.sh"
                "demo-misconfigurations.sh"
                "cleanup.sh"
                "run-all-demos.sh"
              )
              
              MISSING=0
              for script in "${REQUIRED_SCRIPTS[@]}"; do
                if [ ! -f "$script" ]; then
                  echo "ERROR: Missing script: $script"
                  MISSING=1
                fi
              done
              
              if [ $MISSING -eq 1 ]; then
                exit 1
              fi
              
              echo "All required scripts present"
            displayName: 'Verify Scripts Exist'

# Pipeline success criteria:
# - All shell scripts pass shellcheck (warnings allowed)
# - All 5 scenarios run without errors
# - Docker Compose files are valid
# - All resources cleaned up after tests
# - Documentation is present