Joseph Doherty
51 lines
2.9 KiB
YAML
51 lines
2.9 KiB
YAML
# opc-plc behind a port NAT — the #806/#813 fixture for NatPublishedEndpointBrowseTests
|
|
# (tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests, Fixture=opc-plc-nat).
|
|
#
|
|
# The point of this stack is what the server ADVERTISES, not what it simulates. opc-plc builds its
|
|
# GetEndpoints EndpointUrl from its PLC hostname (--ph; default = the container's short hostname) + its
|
|
# listen port, so with
|
|
# * a private hostname that cannot resolve from any client (named explicitly via --ph: `.invalid` is
|
|
# reserved by RFC 6761 and guaranteed never to resolve, so no resolver search domain or wildcard can make
|
|
# the premise pass; the container `hostname:` alone would advertise the bare short name), and
|
|
# * a published host port (50010) different from the internal listen port (50000),
|
|
# every advertised endpoint is opc.tcp://otopcua-opc-plc-nat-private.invalid:50000/ — unreachable on BOTH host
|
|
# and port. A client that follows the advertised URL fails DNS; one that keeps the operator-configured
|
|
# host:port (OpcUaEndpointUrlRewriter) reaches the server. The tests assert that premise first.
|
|
#
|
|
# A SEPARATE stack from ../docker-compose.yml (deployed to /opt/otopcua-opcuaclient-nat, not
|
|
# /opt/otopcua-opcuaclient) so bringing it up/down never touches the plain otopcua-opc-plc fixture.
|
|
#
|
|
# rsync -av tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/Docker/nat/ \
|
|
# dohertj2@10.100.0.35:/opt/otopcua-opcuaclient-nat/
|
|
# ssh dohertj2@10.100.0.35 'cd /opt/otopcua-opcuaclient-nat && docker compose up -d'
|
|
# OPCUA_NAT_ENDPOINT=opc.tcp://10.100.0.35:50010 dotnet test \
|
|
# tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests --filter Fixture=opc-plc-nat
|
|
services:
|
|
opc-plc-nat:
|
|
image: mcr.microsoft.com/iotedge/opc-plc:2.14.10
|
|
container_name: otopcua-opc-plc-nat
|
|
hostname: otopcua-opc-plc-nat-private
|
|
restart: unless-stopped
|
|
labels:
|
|
project: lmxopcua
|
|
ports:
|
|
# published 50010 -> internal 50000: the port half of the NAT. Do NOT make these equal.
|
|
- "50010:50000"
|
|
command:
|
|
- "--pn=50000"
|
|
# --ph: the host part of every advertised EndpointUrl (and the server cert's DNS name).
|
|
- "--ph=otopcua-opc-plc-nat-private.invalid"
|
|
# --ut: also advertise SecurityPolicy=None (the secure policies stay advertised; the secure test uses them).
|
|
- "--ut"
|
|
# --aa: accept the browser's self-signed client cert. Trust in the OTHER direction (the browser trusting
|
|
# this server's cert) is deliberately not automatic — that is what the secure test pins.
|
|
- "--aa"
|
|
healthcheck:
|
|
# The image ships no netstat (the sibling ../docker-compose.yml healthcheck is permanently "unhealthy" for that
|
|
# reason); bash's /dev/tcp is there.
|
|
test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/50000"]
|
|
interval: 5s
|
|
timeout: 2s
|
|
retries: 10
|
|
start_period: 10s
|