Skip to content

Commit b679369

Browse files
rusherrusher
committed
[misc] Add SSL to CI servers
1 parent 66efcba commit b679369

File tree

2 files changed

+118
-1
lines changed

2 files changed

+118
-1
lines changed

‎.github/workflows/ci.yml

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,13 @@ jobs:
5454
else
5555
echo "127.0.0.1 mariadb.example.com" | sudo tee -a /etc/hosts
5656
fi
57+
58+
- name: Generate self-signed certificates
59+
shell: bash
60+
run: |
61+
chmod +x .github/workflows/generate-certs.sh
62+
./.github/workflows/generate-certs.sh
63+
5764
- uses: actions/setup-node@v4
5865
with:
5966
node-version: ${{ matrix.node }}
@@ -69,7 +76,13 @@ jobs:
6976
registry: ${{ matrix.db-type == 'enterprise' && 'docker.mariadb.com/enterprise-server' || (matrix.db-type == 'dev' && 'quay.io/mariadb-foundation/mariadb-devel' || '') }}
7077
registry-user: ${{ matrix.db-type == 'enterprise' && secrets.ENTERPRISE_USER || '' }}
7178
registry-password: ${{ matrix.db-type == 'enterprise' && secrets.ENTERPRISE_TOKEN || '' }}
72-
additional-conf: ${{ matrix.additional-conf || '' }}
79+
additional-conf: |
80+
${{ matrix.additional-conf || '' }}
81+
${{ matrix.os == 'ubuntu-latest' && '--ssl-ca=/etc/mysql/conf.d/ca.crt' || '' }}
82+
${{ matrix.os == 'ubuntu-latest' && '--ssl-cert=/etc/mysql/conf.d/server.crt' || '' }}
83+
${{ matrix.os == 'ubuntu-latest' && '--ssl-key=/etc/mysql/conf.d/server.key' || '' }}
84+
conf-script-folder: ${{ github.workspace }}/.github/workflows/certs
85+
port: ${{ env.TEST_DB_PORT }}
7386

7487
- name: Setup MySQL
7588
if: matrix.db-type == 'mysql'
@@ -82,11 +95,38 @@ jobs:
8295
- name: Install dependencies
8396
run: npm install
8497

98+
- name: Debug - Check MariaDB connection
99+
shell: bash
100+
run: |
101+
echo "=== Network and Port Information ==="
102+
echo "Checking if MariaDB port is accessible..."
103+
netstat -tuln | grep :3306 || echo "Port 3306 not found in netstat"
104+
echo ""
105+
echo "Testing connection to mariadb.example.com:3306..."
106+
timeout 10 bash -c 'cat < /dev/null > /dev/tcp/mariadb.example.com/3306' && echo "✅ Connection successful" || echo "❌ Connection failed"
107+
echo ""
108+
echo "Testing connection to 127.0.0.1:3306..."
109+
timeout 10 bash -c 'cat < /dev/null > /dev/tcp/127.0.0.1/3306' && echo "✅ Connection successful" || echo "❌ Connection failed"
110+
echo ""
111+
echo "=== Environment Variables ==="
112+
echo "TEST_DB_HOST: $TEST_DB_HOST"
113+
echo "TEST_DB_PORT: $TEST_DB_PORT"
114+
echo "TEST_DB_USER: $TEST_DB_USER"
115+
echo "LOCAL_DB: $LOCAL_DB"
116+
echo "DB_TYPE: $DB_TYPE"
117+
env:
118+
TEST_DB_HOST: ${{ env.TEST_DB_HOST }}
119+
TEST_DB_PORT: ${{ env.TEST_DB_PORT }}
120+
TEST_DB_USER: ${{ env.TEST_DB_USER }}
121+
LOCAL_DB: ${{ steps.mariadb-install.outputs.database-type }}
122+
DB_TYPE: ${{ matrix.db-type }}
123+
85124
- name: Run Tests
86125
run: npm run coverage:test
87126
env:
88127
LOCAL_DB: ${{ steps.mariadb-install.outputs.database-type }}
89128
DB_TYPE: ${{ matrix.db-type }}
129+
TEST_DB_SERVER_CERT: ${{ matrix.db-type == 'container' && './.github/workflows/certs/server.crt' || '' }}
90130

91131
- name: Download Codecov uploader
92132
shell: bash

‎.github/workflows/generate-certs.sh

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
#!/bin/bash
2+
3+
# // SPDX-License-Identifier: LGPL-2.1-or-later
4+
# // Copyright (c) 2015-2025 MariaDB Corporation Ab
5+
6+
# Script to generate self-signed certificates for testing
7+
# CN: mariadb.example.com
8+
9+
set -e
10+
11+
echo "Generating self-signed certificates for mariadb.example.com..."
12+
13+
# Create directory for certificates
14+
mkdir -p .github/workflows/certs
15+
16+
echo "Generate CA private key"
17+
openssl genrsa 2048 > .github/workflows/certs/ca.key
18+
19+
echo "[ req ]" > .github/workflows/certs/ca.conf
20+
echo "prompt = no" >> .github/workflows/certs/ca.conf
21+
echo "distinguished_name = req_distinguished_name" >> .github/workflows/certs/ca.conf
22+
echo "" >> .github/workflows/certs/ca.conf
23+
echo "[ req_distinguished_name ]" >> .github/workflows/certs/ca.conf
24+
echo "countryName = FR" >> .github/workflows/certs/ca.conf
25+
echo "stateOrProvinceName = Loire-atlantique" >> .github/workflows/certs/ca.conf
26+
echo "localityName = Nantes" >> .github/workflows/certs/ca.conf
27+
echo "organizationName = Home" >> .github/workflows/certs/ca.conf
28+
echo "organizationalUnitName = Lab" >> .github/workflows/certs/ca.conf
29+
echo "commonName = mariadb.example.com" >> .github/workflows/certs/ca.conf
30+
echo "emailAddress = [email protected]" >> .github/workflows/certs/ca.conf
31+
32+
echo "Generate CA certificate (self-signed)"
33+
openssl req -days 365 -new -x509 -nodes -key .github/workflows/certs/ca.key -out .github/workflows/certs/ca.crt --config .github/workflows/certs/ca.conf
34+
35+
36+
37+
echo "[ req ]" > .github/workflows/certs/server.conf
38+
echo "prompt = no" >> .github/workflows/certs/server.conf
39+
echo "distinguished_name = req_distinguished_name" >> .github/workflows/certs/server.conf
40+
echo "req_extensions = req_ext" >> .github/workflows/certs/server.conf
41+
echo "" >> .github/workflows/certs/server.conf
42+
echo "[ req_distinguished_name ]" >> .github/workflows/certs/server.conf
43+
echo "countryName = FR" >> .github/workflows/certs/server.conf
44+
echo "stateOrProvinceName = Loire-atlantique" >> .github/workflows/certs/server.conf
45+
echo "localityName = Nantes" >> .github/workflows/certs/server.conf
46+
echo "organizationName = Home" >> .github/workflows/certs/server.conf
47+
echo "organizationalUnitName = Lab" >> .github/workflows/certs/server.conf
48+
echo "commonName = mariadb.example.com" >> .github/workflows/certs/server.conf
49+
echo "emailAddress = [email protected]" >> .github/workflows/certs/server.conf
50+
echo "" >> .github/workflows/certs/server.conf
51+
echo "[ req_ext ]" >> .github/workflows/certs/server.conf
52+
echo "subjectAltName = DNS: mariadb.example.com, IP: 127.0.0.1" >> .github/workflows/certs/server.conf
53+
54+
55+
echo "Generating private key..."
56+
openssl genrsa -out .github/workflows/certs/server.key 2048
57+
58+
echo "Generating certificate signing request..."
59+
openssl req -new -key .github/workflows/certs/server.key -out .github/workflows/certs/server.csr --config .github/workflows/certs/server.conf
60+
61+
62+
echo "Generate the certificate for the server:"
63+
openssl x509 -req -days 365 -in .github/workflows/certs/server.csr -out .github/workflows/certs/server.crt -CA .github/workflows/certs/ca.crt -CAkey .github/workflows/certs/ca.key -extensions req_ext -extfile .github/workflows/certs/server.conf
64+
65+
# Set appropriate permissions
66+
chmod 600 .github/workflows/certs/ca.key
67+
chmod 644 .github/workflows/certs/server.crt .github/workflows/certs/ca.crt .github/workflows/certs/server.key
68+
69+
# List generated certificates
70+
echo "Generated certificates:"
71+
ls -la .github/workflows/certs/
72+
73+
# Verify certificate
74+
echo "Certificate details:"
75+
openssl x509 -in .github/workflows/certs/server.crt -text -noout | grep -E "(Subject|CN)"
76+
77+
echo "Certificate generation completed successfully!"

0 commit comments

Comments
 (0)