nordisk/holger

holger-recipe/tests/downstream_medium.rs

//! **A downstream's own medium** (lane OX-WGDS3, 2026-10-28): an on-prem `holger-downstream`
//! (+ `downstream-wg`, `paired`) laid as its own korp appliance, the box a site enrols at
//! its upstream estate `via: Front` or `via: Wireguard` (lane HOL-WGDS). The ONE-box gate
//! (`gate holger` in private-monetize-ops) lays two of them beside the laid estate.
//!
//! Held by name, as a forge resolves them: the payload row and the medium's pointer.

use nornir_build_thing::params::Landing;
use nornir_build_thing::variant::ArtifactKind;

const MEDIUM: &str = "holger-downstream-installer";
// The FETCHING appliance (lane HOL-CDS-5: `downstream-musl` is the one-way one, `oneway_appliance.rs`).
const PAYLOAD: &str = "downstream-fetch-musl";

#[test]
fn the_downstream_payload_is_holger_downstream_static_with_its_wireguard_way_in() {
    let set = holger_recipe::declared();
    let v = set
        .get(PAYLOAD)
        .unwrap_or_else(|| panic!("no `{PAYLOAD}` row"));
    assert_eq!(
        (v.package.as_deref(), v.bin.as_deref()),
        (Some("holger-downstream"), Some("holger-downstream-fetch")),
        "the product crate's fetching bin, built for the medium"
    );
    assert_eq!(
        v.target.as_deref(),
        Some("x86_64-unknown-linux-musl"),
        "an OS-less medium needs the static binary"
    );
    assert_eq!(v.kind, ArtifactKind::Exe, "it ships inside the medium");
    for f in ["fetch", "downstream-wg", "paired"] {
        assert!(
            v.features.iter().any(|x| x == f),
            "{PAYLOAD} carries `{f}`: {:?}",
            v.features
        );
    }
    assert!(
        !v.no_default_features,
        "the gateway is the product crate's own (its `holger` dependency's `downstream`)"
    );
    for never in [
        "metered",
        "wasm-plugins",
        "supply-chain",
        "online",
        "full",
        "mvp-server",
    ] {
        assert!(
            !v.features.iter().any(|x| x == never),
            "{PAYLOAD} must not carry `{never}`: {:?}",
            v.features
        );
    }
    // The product row stays what `cargo install holger-downstream` is.
    let open = set.get("holger-downstream").expect("the product row");
    assert!(open.features.is_empty());
    assert_eq!(open.target, None);
}

#[test]
fn the_downstream_medium_lays_the_payload_with_its_declaration_and_its_fronts_ca() {
    let set = holger_recipe::declared();
    let m = set
        .installers
        .iter()
        .find(|i| i.name == MEDIUM)
        .unwrap_or_else(|| panic!("no [[build.installer]] `{MEDIUM}`"));
    assert_eq!(m.variant, PAYLOAD);
    assert_eq!(
        set.get(MEDIUM).expect("its pointer variant").kind,
        ArtifactKind::Installer
    );
    assert!(
        m.boot_params
            .iter()
            .any(|b| b == "korp.entry=holger-downstream-fetch"),
        "{:?}",
        m.boot_params
    );
    assert_eq!(m.cmd, ["start", "--config", "/data/holger.ron"]);
    assert_eq!(
        m.env.get("HOLGER_NET").map(String::as_str),
        Some("eth0:dhcp"),
        "ONE NIC: an on-prem box has no utility net"
    );
    assert_eq!(
        m.env.get("HOLGER_DATA").map(String::as_str),
        Some("/data/holger")
    );
    let p = |n: &str| m.params.iter().find(|p| p.name == n);
    let ron = p("holger_ron").expect("its declaration");
    assert!(ron.required);
    assert_eq!(ron.lands, Landing::Release);
    let ca = p("downstream_ca").expect("the CA of its upstream's front");
    assert_eq!(ca.lands, Landing::Release);
    assert_eq!(ca.staged_file, "downstream-ca.pem");
    for gone in ["pairing_seed", "hub_conf", "underlay"] {
        assert!(p(gone).is_none(), "a downstream carries no `{gone}`");
    }
    assert_eq!(m.payload_entries, holger_recipe::packaging::fetch_payload_entries(), "a downstream scans nothing, yet verifies its bundles in jobs: the job sandbox rides its medium, and the fetching one its fetch worker (lane cds4)");
    let others: Vec<&str> = set
        .installers
        .iter()
        .filter(|i| i.name != MEDIUM)
        .map(|i| i.volume_id.as_str())
        .collect();
    assert!(
        !others.contains(&m.volume_id.as_str()),
        "{MEDIUM} is resolved by its own volume id"
    );
}