Skip to content

Commit b84764f

Browse files
guzman-raphaelguzman-raphael
committed
Add secure S3 connection test.
1 parent 60aa093 commit b84764f

File tree

6 files changed

+229
-1
lines changed

6 files changed

+229
-1
lines changed

‎LNX-docker-compose.yml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ services:
1818
- DJ_TEST_HOST=db
1919
- DJ_TEST_USER=datajoint
2020
- DJ_TEST_PASSWORD=datajoint
21-
- S3_ENDPOINT=minio:9000
21+
- S3_ENDPOINT=fakeminio.datajoint.io:9000
2222
- S3_ACCESS_KEY=datajoint
2323
- S3_SECRET_KEY=datajoint
2424
- S3_BUCKET=datajoint-test
@@ -70,5 +70,26 @@ services:
7070
timeout: 5s
7171
retries: 60
7272
interval: 1s
73+
fakeminio.datajoint.io:
74+
<<: *net
75+
image: nginx:alpine
76+
environment:
77+
- URL=datajoint.io
78+
- SUBDOMAINS=fakeminio
79+
- MINIO_SERVER=http://minio:9000
80+
entrypoint: /entrypoint.sh
81+
healthcheck:
82+
test: wget --quiet --tries=1 --spider https://fakeminio.datajoint.io:443/minio/health/live || exit 1
83+
timeout: 5s
84+
retries: 300
85+
interval: 1s
86+
# ports:
87+
# - "9000:9000"
88+
# - "443:443"
89+
volumes:
90+
- ./tests/nginx/base.conf:/base.conf
91+
- ./tests/nginx/entrypoint.sh:/entrypoint.sh
92+
- ./tests/nginx/fullchain.pem:/certs/fullchain.pem
93+
- ./tests/nginx/privkey.pem:/certs/privkey.pem
7394
networks:
7495
main:

‎tests/nginx/base.conf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
server {
2+
listen 9000;
3+
server_name {{SUBDOMAINS}}.{{URL}};
4+
client_max_body_size 0;
5+
proxy_buffering off;
6+
ignore_invalid_headers off;
7+
8+
location / {
9+
access_log off;
10+
proxy_http_version 1.1;
11+
proxy_set_header Host $http_host;
12+
proxy_pass {{MINIO_SERVER}};
13+
}
14+
}
15+
16+
server {
17+
listen 443 ssl;
18+
server_name {{SUBDOMAINS}}.{{URL}};
19+
client_max_body_size 0;
20+
proxy_buffering off;
21+
ignore_invalid_headers off;
22+
23+
ssl_certificate /certs/fullchain.pem;
24+
ssl_certificate_key /certs/privkey.pem;
25+
26+
# session settings
27+
ssl_session_timeout 1d;
28+
ssl_session_cache shared:SSL:50m;
29+
ssl_session_tickets off;
30+
31+
# protocols
32+
ssl_protocols TLSv1.2 TLSv1.3;
33+
ssl_prefer_server_ciphers on;
34+
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
35+
36+
# OCSP Stapling
37+
ssl_stapling on;
38+
ssl_stapling_verify on;
39+
resolver 127.0.0.11 valid=30s; # Docker DNS Server
40+
41+
location / {
42+
access_log off;
43+
proxy_http_version 1.1;
44+
proxy_set_header Host $http_host;
45+
proxy_pass {{MINIO_SERVER}};
46+
}
47+
}

‎tests/nginx/entrypoint.sh‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#! /bin/sh
2+
3+
sed "s|{{SUBDOMAINS}}|${SUBDOMAINS}|g" /base.conf | tee /etc/nginx/conf.d/base.conf
4+
sed -i "s|{{URL}}|${URL}|g" /etc/nginx/conf.d/base.conf
5+
sed -i "s|{{MINIO_SERVER}}|${MINIO_SERVER}|g" /etc/nginx/conf.d/base.conf
6+
# tail -f /dev/null
7+
8+
nginx -g "daemon off;"
9+
# nginx
10+
11+
# echo "Waiting for initial certs"
12+
# while [ ! -d /etc/letsencrypt/archive/${SUBDOMAINS}.${URL} ]; do
13+
# sleep 5
14+
# done
15+
16+
# echo "Enabling SSL feature"
17+
# mv /ssl.conf /etc/nginx/conf.d/ssl.conf
18+
# nginx -s reload
19+
20+
# inotifywait -m /etc/letsencrypt/archive/${SUBDOMAINS}.${URL} |
21+
# while read path action file; do
22+
# if [ "$(echo $action | grep MODIFY)" ] || [ "$(echo $action | grep CREATE)" ] || [ "$(echo $action | grep MOVE)" ]; then
23+
# echo "Renewal: Reloading NGINX since $file issue $action event"
24+
# nginx -s reload
25+
# fi
26+
# done

‎tests/nginx/fullchain.pem‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIGZDCCBUygAwIBAgISA10k5JmyN2nyzqvMRyO2LntJMA0GCSqGSIb3DQEBCwUA
3+
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
4+
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xOTEwMjEyMTAwMjFaFw0y
5+
MDAxMTkyMTAwMjFaMCExHzAdBgNVBAMTFmZha2VtaW5pby5kYXRham9pbnQuaW8w
6+
ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDYwRR1YoZ1pJgZO+oU6zla
7+
47UiTnMO2KwYaS3VAPa1ks9nmQBInH7nA3i3wIzCiX+CeKCsiaKsjA5xlQmtmeM4
8+
FrL5U1ZBUyhroowRSluVyni9g3uJO/NG29BiWU+NBcwtsApbVUXRp4v9BQ2KgRZS
9+
KhK74XLXu1/6NRl3sjzye6MkfTo1rkzmm+pnFvBDkPEdI8/R7mBTQFXTSXzrqo+5
10+
ZNBY3sYWpGVrLOi+LRvFJR6kNs1z1cxOYGXQRMBFNMyu4xZAYDaowR+HVQ0OsQYw
11+
90PeuakMyB5qeIPe1zelfqP+/HO6L9MTZdLKBNm5YkJYrVm2YD5BcVCDJeUkAact
12+
DKW/AX2FL983D0WepM4mPm1MuRqpYVSEne3eeA4/Gm8TVpmqQyuW10HJbCsgZR9g
13+
X/gokz54uguHu7SZHvLuadoWzxMADFSvbOoM52rFgCsKeZecNDi9H54yAHlhjIj7
14+
Fs9zVRkELil5U2Fnolw8gOyfV/2ghqor8Y4950fcuy9DldcKeCmpjjGoemff/REL
15+
p4tgib+XAX/3bVmfgW4aTW1RoQ+duThfPovzumPXxffXNrRlstX7IaR/Asz0bhSJ
16+
C91vmemedgyExcUSuyqX2qzJrgdx5TCBpP+J47b5oHdjS9uWeg5BX7JpofiR/klP
17+
5OADP/F2a68aWgox7Z+CRQIDAQABo4ICazCCAmcwDgYDVR0PAQH/BAQDAgWgMB0G
18+
A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1Ud
19+
DgQWBBSZJjFCP4IjST+FfsC54OKupBDWYTAfBgNVHSMEGDAWgBSoSmpjBH3duubR
20+
ObemRWXv86jsoTBvBggrBgEFBQcBAQRjMGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9v
21+
Y3NwLmludC14My5sZXRzZW5jcnlwdC5vcmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9j
22+
ZXJ0LmludC14My5sZXRzZW5jcnlwdC5vcmcvMCEGA1UdEQQaMBiCFmZha2VtaW5p
23+
by5kYXRham9pbnQuaW8wTAYDVR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC3xMB
24+
AQEwKDAmBggrBgEFBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwggEE
25+
BgorBgEEAdZ5AgQCBIH1BIHyAPAAdwCyHgXMi6LNiiBOh2b5K7mKJSBna9r6cOey
26+
SVMt74uQXgAAAW3wVdvZAAAEAwBIMEYCIQDeOafRS+nnooUWcFQlH82sK2lTrR3N
27+
uJqKJLIeoJdJVwIhAI+tVJJ103wbH6bC/ZwuRDlB/Omya0QwwO4m4Af4u/SEAHUA
28+
8JWkWfIA0YJAEC0vk4iOrUv+HUfjmeHQNKawqKqOsnMAAAFt8FXd3gAABAMARjBE
29+
AiAD8IITk6e1Ms01r2SUBUwaIwAA5z6NqYK8YBudhHRU6gIgBAzTx3OLwKo7aOjY
30+
8rf03Mcttz72VDI1dIDPt9vXxEcwDQYJKoZIhvcNAQELBQADggEBAFeAxIE70OgD
31+
1hx34hdJzfSOPUm3bjReUdfif6LTNYhEK1KjEKDwNK7r978t3wcOuxuJAwBdClzE
32+
dE/7EfuZilXWjVJ2La4J0DdQcrjt+O4bvFghNTWsOoYl5X0LzgKZLbl/9hvK8cE3
33+
/d3Pjf0zHflT0pJYjLP89ntwKJdFsAjFQc1+kX85SehYIj9c7t/W5/9MDhtebtvj
34+
Os1inUb4l15jbGTO3po8tPmmHLAvfTM6d/KIGueLHAn63EzCg1tmnQUjhhM1Zyzl
35+
Djdshrw0nr6BFOJvw/h/DYo6MqtLuTlrVjfdULjkqH5wq2wh7gqnGcQbqcI8Eixd
36+
SQbaP7xJreA=
37+
-----END CERTIFICATE-----
38+
-----BEGIN CERTIFICATE-----
39+
MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/
40+
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
41+
DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow
42+
SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT
43+
GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC
44+
AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF
45+
q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8
46+
SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0
47+
Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA
48+
a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj
49+
/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T
50+
AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG
51+
CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv
52+
bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k
53+
c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw
54+
VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC
55+
ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz
56+
MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu
57+
Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF
58+
AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo
59+
uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/
60+
wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu
61+
X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG
62+
PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6
63+
KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
64+
-----END CERTIFICATE-----

‎tests/nginx/privkey.pem‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDYwRR1YoZ1pJgZ
3+
O+oU6zla47UiTnMO2KwYaS3VAPa1ks9nmQBInH7nA3i3wIzCiX+CeKCsiaKsjA5x
4+
lQmtmeM4FrL5U1ZBUyhroowRSluVyni9g3uJO/NG29BiWU+NBcwtsApbVUXRp4v9
5+
BQ2KgRZSKhK74XLXu1/6NRl3sjzye6MkfTo1rkzmm+pnFvBDkPEdI8/R7mBTQFXT
6+
SXzrqo+5ZNBY3sYWpGVrLOi+LRvFJR6kNs1z1cxOYGXQRMBFNMyu4xZAYDaowR+H
7+
VQ0OsQYw90PeuakMyB5qeIPe1zelfqP+/HO6L9MTZdLKBNm5YkJYrVm2YD5BcVCD
8+
JeUkAactDKW/AX2FL983D0WepM4mPm1MuRqpYVSEne3eeA4/Gm8TVpmqQyuW10HJ
9+
bCsgZR9gX/gokz54uguHu7SZHvLuadoWzxMADFSvbOoM52rFgCsKeZecNDi9H54y
10+
AHlhjIj7Fs9zVRkELil5U2Fnolw8gOyfV/2ghqor8Y4950fcuy9DldcKeCmpjjGo
11+
emff/RELp4tgib+XAX/3bVmfgW4aTW1RoQ+duThfPovzumPXxffXNrRlstX7IaR/
12+
Asz0bhSJC91vmemedgyExcUSuyqX2qzJrgdx5TCBpP+J47b5oHdjS9uWeg5BX7Jp
13+
ofiR/klP5OADP/F2a68aWgox7Z+CRQIDAQABAoICAQCUADqE8HJZL7r/N+7cu8Sc
14+
7/CFbUWY9I+F14OI9rB+SLE/zrPn4JuyB6fM6Df0uUgMgWtMhGpEIRnXqmlCVVpV
15+
uQIZxjKWRj7KR+IWCEzC2c5ZsMaQbRPu5TbDgLIV28iPxa08sdwLjLjEWkfls8DW
16+
9411JjpxXarqQImUNmrxM0SxLKSrdMljiUCjhYEm0XghaouDj53MGpi/vWUD0aFz
17+
eIfetrZRTY1GghKlkE1u7qqefCELIAfx2FaMv/T9DFFadQqDiG6qCbwKfyN8TZmp
18+
o5x/Hwx0Aszp7EI2zYNciD1YZW5ryi35B8THVkqID7S3sh4Yrlyz+Lh95EkyrcJE
19+
eavIuVLqEemApmXQTd04k8OI7o6ilY4WPUlfp2SNW0lLCTG24ynvQZVMUszNU2kN
20+
iRJVMhuL15H3CcmYrjYPSTW69DpmJH9YXfIRjeTm1uhCfxRNlSxVTcxBryBfXpzR
21+
XXK0vnZ6c9gnbGfESVUpoywiNNg2aqWkhVy+fYsFtfKZW3OvkXBeruXfQ+uyHAQn
22+
DPVcIqfolqqQ/iShMtqXC0TY3zhFsBUOJJANakSU4iYHWvcOgNiaPqQ4zFkv8ya5
23+
gUxEPmRXY9CWw3fyYNOIeNJtlAbHofh0ozjVS51usBriPoa+DTzKAZgTiPNB4b/l
24+
sdxMjZWp5Myyc75Pz4a7XQKCAQEA72+OcYlZwnX1EedlVf9MtSHxGxqEd3IOs95f
25+
Z1E6JRIf0JYAivApQVBQGwJx9lnbxuNLxv7sH/fjAeZ+2cTRHnTMmOXTSGB8MyNm
26+
c9cBCnshbwiPzuxZBldqY4vIKSxEMakBSjcg5R80+SazjN4ah+WQ3cY0jE3wWWDc
27+
GxaUss6Dm40ObTJTszkoGjOEsz27d8Op80gjQL271Q19X/XEZz+gL4GqDzqgTKKC
28+
/lAE5BNAmAlezwciAfRFWghT0WmumRhbRd91ubTqLbEZ9iBSi2K0K0QWSLGAjhym
29+
J88N14WTOHsOBYmGdnHw+IvN4g+WEdlH+kOP2tsBbL3WtFA+zwKCAQEA57/UcI9j
30+
yijAp4w3DkHaOQ89YGPZ5sNP4VsOlxE2uvYinrrGGHOGGKv48o2okVKwvqIxevUJ
31+
PvZyXfWzBbn9prd33SRD9UmLMs44v+m2ZiqCq90SEt+luKStnBqf7szBoyMx6VEy
32+
qNfEmpTb+XmzAp9mNLqyCSGMQfacqENRTmp3wg8cl+1OXYQiPzluRwDrRt9llMda
33+
aBLzEXu0nV9QOBzFLJnUJt85YMHHOEmUy84wRN8/2ME7bEC8XWKcesjz0HASKvMW
34+
oOTY2mmOR0BwdDZFRuAxUCsw6sguk58jqaGiQWampk63+tqxHsbbr4UoZD46BGL3
35+
hnb6ftkhbXUSqwKCAQAHd7c9m0cNZZhrIohqkjfWPmTCr6UKBKiou3rGQiZKGbKc
36+
UtFZg/wFaXfWH9FmGY9dOKGYZ0L+DEEsQgAa0qSjComHC0P3seqtvaDoZABIT2bP
37+
i7jQf1aXeAp9aFKp1hOaaOb9ZZLFEqAYVTisYBD7xBEsmY3yAkxIvVigD6g7m21H
38+
YLLefP9XS6UQjCLLZFWAer3GNK3EyyYckvsiDww9HCLm2GhxaSauvTLQs7YzVtZg
39+
54npcxOAdBnloPTcRyuG4teV6k5FqHrVSfzBTGjGqCFuaAU55y9XP1V/UFniKuxY
40+
ip35Vjy3XP5jAhk9v7ayf9Ba4diOvt3ggls77HTJAoIBAGuFPsTyYfP7MFcL4MdG
41+
mj566Zj8+q3r0/XUT1Kbc+8OH0XRlfLmNkLgFuJCAwFZghMQITDQ2vdRVAJv6h0w
42+
C5T77iq1lqoI8wIhV4cCodOIyZN/P9Ft3e9qx/lzCNy8NuK/g3qiZ4SahubJRb3b
43+
TshauAqiy9Mcs3wvNMOEaAafsuxgIn4CZadRlKoMtTNQI9h/8Rsz2qgKkqd743JY
44+
NFm0T26/+AQI8RAJF6rvyI8+HHr3sSGZlT5GUp5pD/yPmz8LoAI5QjhntIyxCIfa
45+
R9JDE6UsgvSU9V8YfTOUU/FxwlvhilQCla1XJXIIBQjMGM9ZZ4V9fSXvsYyEpNOp
46+
y30CggEAXXV+cfN34HLs9S/aDtAXm/EhzOmyu0mNG9lhHPkDd+8BjB81TyBc1xqm
47+
K9k4nk2MUeU/c76+faApBgUHdXz4uSTOS5bpWFZSIQE5mZIyu8PmJbVUvVb78fVa
48+
NecgVDyHBPf1PnkqNiEZCc+Xr6zETQAaXQ+up1ZtKMoD3HLOG0vTveUhWVuXUWJP
49+
J3bNJ5+mJJFqzmmBJBtwVUSnCx0R6huazS72MwGalD37k8r8hisSkNEUK+71shTu
50+
jaWJfTxTUxpbVIthSRKvNTaItViI2L1lj3QK3DV73Im14V95lFf0Mcwofh8yZYCh
51+
SpXBFze8WyIAus/apQ1sZX/fKnkNNg==
52+
-----END PRIVATE KEY-----

‎tests/test_s3.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,21 @@ def test_connection():
2424
http_client=http_client)
2525

2626
buckets = minio_client.list_buckets()
27+
28+
@staticmethod
29+
def test_connection_secure():
30+
31+
# Initialize httpClient with relevant timeout.
32+
http_client = urllib3.PoolManager(
33+
timeout=30, cert_reqs='CERT_REQUIRED', ca_certs=certifi.where(),
34+
retries=urllib3.Retry(total=3, backoff_factor=0.2, status_forcelist=[500, 502, 503, 504]))
35+
36+
# Initialize minioClient with an endpoint and access/secret keys.
37+
minio_client = Minio(
38+
S3_CONN_INFO['endpoint'].split(':')[0] + ':443',
39+
access_key=S3_CONN_INFO['access_key'],
40+
secret_key=S3_CONN_INFO['secret_key'],
41+
secure=True,
42+
http_client=http_client)
43+
44+
buckets = minio_client.list_buckets()

0 commit comments

Comments
 (0)