fixes

Author: terion-name

.github/workflows/cockpit-plugins.yml

@@ -5,11 +5,7 @@ on:
     branches:
       - main
     paths:
-      - ".github/workflows/cockpit-plugins.yml"
-      - "scripts/build-cockpit-plugins-bundle.sh"
       - "ansible/roles/cockpit_plugins/defaults/main.yml"
-    tags:
-      - "*"
   workflow_dispatch:
 permissions:
   contents: write

ansible/roles/cockpit_plugins/defaults/main.yml

@@ -17,7 +17,6 @@ terrarium_cockpit_plugin_build_deps:
 
 terrarium_cockpit_plugin_bundle_enabled: true
 terrarium_cockpit_plugin_bundle_repo: terion-name/terrarium
-terrarium_cockpit_plugin_bundle_main_ref: cockpit-plugins-main
 
 terrarium_cockpit_zfs_repo: https://github.com/45Drives/cockpit-zfs.git
 terrarium_cockpit_zfs_ref: v1.2.21-3

ansible/roles/lxd/tasks/main.yml

@@ -1,7 +1,12 @@
 - name: Install LXD snap
-  ansible.builtin.command: "snap install lxd --channel={{ terrarium_lxd_snap_channel }}"
-  args:
-    creates: /snap/bin/lxd
+  community.general.snap:
+    name: lxd
+    channel: "{{ terrarium_lxd_snap_channel }}"
+    state: present
+  register: terrarium_lxd_snap_install
+  until: terrarium_lxd_snap_install is succeeded
+  retries: 30
+  delay: 10
 
 - name: Enable LXD UI
   ansible.builtin.command: snap set lxd ui.enable=true

ansible/roles/oauth2_proxy/tasks/main.yml

@@ -115,7 +115,7 @@
             (
               terrarium_root_domain
               if terrarium_root_domain | length > 0
-              else (terrarium_public_ip | replace('.', '-') ~ '.traefik.me')
+              else (terrarium_manage_domain | regex_replace('^[^.]+\\.', ''))
             )
           }}
 

scripts/terrarium-zitadel-sync.ts

@@ -12,6 +12,23 @@ const DEFAULT_TOFU_IMAGE = "ghcr.io/opentofu/opentofu:1.10.6";
 const WAIT_INTERVAL_MS = 5000;
 const WAIT_ATTEMPTS = 36;
 
+function isRetriableZitadelApiError(message: string): boolean {
+  const lowered = message.toLowerCase();
+  return [
+    "failed to connect",
+    "connection refused",
+    "empty reply from server",
+    "timed out",
+    "timeout was reached",
+    "bad gateway",
+    "service unavailable",
+    "gateway timeout",
+    "http 502",
+    "http 503",
+    "http 504"
+  ].some((needle) => lowered.includes(needle));
+}
+
 async function dockerRun(args: string[]): Promise<string> {
   return await runText(["docker", ...args], PREFIX);
 }
@@ -166,8 +183,22 @@ async function zitadelApi<T>(
   if (body !== undefined && method !== "GET") {
     cmd.push("-d", JSON.stringify(body));
   }
-  const stdout = await runText(cmd, PREFIX);
-  return JSON.parse(stdout) as T;
+
+  let lastError = "";
+  for (let attempt = 0; attempt < WAIT_ATTEMPTS; attempt += 1) {
+    const result = await runAllowFailure(cmd);
+    if (result.exitCode === 0) {
+      return JSON.parse(result.stdout) as T;
+    }
+
+    lastError = result.stderr.trim() || result.stdout.trim() || `ZITADEL API ${method} ${path} failed`;
+    if (!isRetriableZitadelApiError(lastError)) {
+      throw new Error(lastError);
+    }
+    await Bun.sleep(WAIT_INTERVAL_MS);
+  }
+
+  throw new Error(`timed out waiting for ZITADEL API ${method} ${path}: ${lastError}`);
 }
 
 async function lookupProjectId(authDomain: string, pat: string): Promise<string> {

tests/integration/assertions/browser.ts

@@ -8,26 +8,47 @@ type LoginOptions = {
 };
 
 async function firstVisible(page: Page, selectors: string[]): Promise<string> {
-  for (const selector of selectors) {
-    const locator = page.locator(selector).first();
-    if (await locator.isVisible().catch(() => false)) {
-      return selector;
+  const deadline = Date.now() + 30000;
+
+  while (Date.now() < deadline) {
+    for (const selector of selectors) {
+      const locator = page.locator(selector).first();
+      if (await locator.isVisible().catch(() => false)) {
+        return selector;
+      }
     }
+
+    await page.waitForTimeout(500);
   }
+
   throw new Error(`none of the selectors were visible: ${selectors.join(", ")}`);
 }
 
 async function clickFirst(page: Page, selectors: string[]): Promise<void> {
-  for (const selector of selectors) {
-    const locator = page.locator(selector).first();
-    if (await locator.isVisible().catch(() => false)) {
-      await locator.click();
-      return;
+  const deadline = Date.now() + 30000;
+
+  while (Date.now() < deadline) {
+    for (const selector of selectors) {
+      const locator = page.locator(selector).first();
+      if (await locator.isVisible().catch(() => false)) {
+        await locator.click();
+        return;
+      }
     }
+
+    await page.waitForTimeout(500);
   }
+
   throw new Error(`none of the click selectors were visible: ${selectors.join(", ")}`);
 }
 
+async function typeInto(page: Page, selector: string, value: string): Promise<void> {
+  const locator = page.locator(selector).first();
+  await locator.click();
+  await locator.clear();
+  await locator.pressSequentially(value, { delay: 30 });
+}
+
 /** Runs a browser flow and preserves screenshots for post-failure inspection. */
 export async function withBrowser<T>(outputDir: string, runFlow: (browser: Browser) => Promise<T>): Promise<T> {
   mkdirSync(outputDir, { recursive: true });
@@ -50,17 +71,19 @@ export async function loginThroughZitadel(url: string, user: OidcTestUser, optio
       'input[type="email"]',
       'input[name="loginName"]',
       'input[name="username"]',
-      'input[autocomplete="username"]'
+      'input[autocomplete="username"]',
+      '[data-testid="username-text-input"]'
     ]);
-    await page.fill(emailSelector, user.email);
+    await typeInto(page, emailSelector, user.email);
     await clickFirst(page, ['button:has-text("Next")', 'button:has-text("Continue")', 'button:has-text("Sign in")']);
 
     const passwordSelector = await firstVisible(page, [
       'input[type="password"]',
       'input[name="password"]',
-      'input[autocomplete="current-password"]'
+      'input[autocomplete="current-password"]',
+      '[data-testid="password-text-input"]'
     ]);
-    await page.fill(passwordSelector, user.password);
+    await typeInto(page, passwordSelector, user.password);
     await clickFirst(page, ['button:has-text("Sign in")', 'button:has-text("Login")', 'button:has-text("Continue")']);
 
     await page.waitForLoadState("networkidle", { timeout: 120000 });

tests/integration/assertions/http.ts

@@ -1,3 +1,5 @@
+import { runAllowFailure } from "../lib/process";
+
 /** Polls an HTTP endpoint until it returns one of the expected status codes. */
 export async function waitForHttpStatus(url: string, expectedStatuses: number[], timeoutMs = 180000): Promise<Response> {
   const deadline = Date.now() + timeoutMs;
@@ -17,6 +19,29 @@ export async function waitForHttpStatus(url: string, expectedStatuses: number[],
   throw new Error(`timed out waiting for ${url} to return one of [${expectedStatuses.join(", ")}], last status: ${lastResponse?.status ?? "none"}`);
 }
 
+/** Polls an HTTPS endpoint with certificate verification disabled until it returns an expected status. */
+export async function waitForHttpStatusInsecure(url: string, expectedStatuses: number[], timeoutMs = 180000): Promise<number> {
+  const deadline = Date.now() + timeoutMs;
+  let lastStatus = "";
+
+  while (Date.now() < deadline) {
+    const result = await runAllowFailure(["curl", "-k", "-sS", "-o", "/dev/null", "-w", "%{http_code}", "--max-time", "20", url]);
+    const status = (result.stdout || "").trim();
+    lastStatus = status || lastStatus;
+
+    if (result.exitCode === 0) {
+      const numericStatus = Number(status);
+      if (expectedStatuses.includes(numericStatus)) {
+        return numericStatus;
+      }
+    }
+
+    await Bun.sleep(5000);
+  }
+
+  throw new Error(`timed out waiting for ${url} to return one of [${expectedStatuses.join(", ")}], last status: ${lastStatus || "none"}`);
+}
+
 /** Fetches an endpoint and throws when the response body does not contain the expected text. */
 export async function expectHttpBodyContains(url: string, needle: string): Promise<void> {
   const response = await fetch(url, { redirect: "follow" });

tests/integration/scenarios/common.ts

@@ -4,7 +4,7 @@ import { randomUUID } from "node:crypto";
 import { IntegrationContext } from "../context";
 import type { DomainBundle, ExternalOidcFixture, ManagedHost, ServerRecord, VolumeRecord } from "../types";
 import { SshHost } from "../remote/ssh";
-import { expectHttpBodyContains, waitForHttpStatus } from "../assertions/http";
+import { expectHttpBodyContains, waitForHttpStatus, waitForHttpStatusInsecure } from "../assertions/http";
 import { expectCockpitLogin, expectProtectedRoute, expectTraefikDashboard } from "../assertions/browser";
 import { expectRemoteContains, expectSystemdActive } from "../assertions/host";
 import { collectHostArtifacts } from "../cleanup";
@@ -202,7 +202,7 @@ export async function readLocalZitadelAdmin(host: SshHost): Promise<{ email: str
 export async function waitForTerrariumPublicEndpoints(host: ManagedHost, includeAuth: boolean): Promise<void> {
   await waitForHttpStatus(`https://${host.domains.manage}`, [302, 303]);
   await waitForHttpStatus(`https://${host.domains.proxy}`, [302, 303]);
-  await waitForHttpStatus(`https://${host.domains.lxd}`, [200, 302]);
+  await waitForHttpStatusInsecure(`https://${host.domains.lxd}`, [200, 302]);
   if (includeAuth) {
     await waitForHttpStatus(`https://${host.domains.auth}/.well-known/openid-configuration`, [200]);
   }