[layerindex-web,2/3] tests: add tests for the files dockersetup.py writes

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74405ac..76a4cf9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,3 +20,16 @@  jobs:
 
       - name: Build image and run tests
         run: docker/run-tests.sh
+
+  dockersetup:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+
+      # dockersetup.py runs on the host, not in the image
+      - name: Test dockersetup.py
+        run: |
+          python3 -m venv /tmp/venv
+          /tmp/venv/bin/pip install -q pytest PyYAML
+          /tmp/venv/bin/python -m pytest -rs -p no:cacheprovider tests/test_dockersetup.py
diff --git a/tests/test_dockersetup.py b/tests/test_dockersetup.py
new file mode 100644
index 0000000..3a6d8ff
--- /dev/null
+++ b/tests/test_dockersetup.py
@@ -0,0 +1,158 @@ 
+# layerindex-web - tests for the file editing done by dockersetup.py
+#
+# Licensed under the MIT license, see COPYING.MIT for details
+#
+# SPDX-License-Identifier: MIT
+
+import os
+import shutil
+import stat
+
+import pytest
+import yaml
+
+# The Docker image doesn't contain dockersetup.py or the files it edits, so
+# these tests are skipped by docker/run-tests.sh; CI runs them on the host.
+dockersetup = pytest.importorskip('dockersetup')
+
+basepath = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+
+TRACKED_FILES = [
+    'docker-compose.yml',
+    '.env.dev.app', '.env.dev.celery', '.env.dev.db', '.env.dev.rabbit',
+    'Dockerfile',
+    'docker/git-proxy', 'docker/.gitconfig', 'docker/nginx-ssl.conf',
+]
+
+
+@pytest.fixture
+def workdir(tmp_path, monkeypatch):
+    """A copy of the files dockersetup.py edits, as the current directory."""
+    for name in TRACKED_FILES:
+        dest = tmp_path / name
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy(os.path.join(basepath, name), dest)
+    monkeypatch.chdir(tmp_path)
+    return tmp_path
+
+
+def read_env(path):
+    values = {}
+    for line in path.read_text().splitlines():
+        if line and not line.startswith('#'):
+            key, value = line.split('=', 1)
+            values[key] = value
+    return values
+
+
+def write_env_files(email_host=None, email_tls=False):
+    dockersetup.write_service_env_files('dbpw', 'rootpw', 'sekrit', 'mqpw', email_host, None,
+                                        None, None, False, email_tls)
+
+
+def test_env_files_get_generated_secrets(workdir):
+    write_env_files(email_host='smtp.example.com', email_tls=True)
+
+    app = read_env(workdir / '.env.local.app')
+    assert app['SECRET_KEY'] == 'sekrit'
+    assert app['DATABASE_USER'] == 'layers'
+    assert app['DATABASE_PASSWORD'] == 'dbpw'
+    assert app['RABBITMQ_DEFAULT_USER'] == 'layermq'
+    assert app['RABBITMQ_DEFAULT_PASS'] == 'mqpw'
+    assert app['EMAIL_HOST'] == 'smtp.example.com'
+    assert app['EMAIL_USE_TLS'] == 'True'
+    assert app['DEBUG'] == '0'
+    assert read_env(workdir / '.env.local.celery')['DATABASE_PASSWORD'] == 'dbpw'
+    assert read_env(workdir / '.env.local.db')['MYSQL_ROOT_PASSWORD'] == 'rootpw'
+    assert read_env(workdir / '.env.local.rabbit') == {'RABBITMQ_DEFAULT_USER': 'layermq',
+                                                       'RABBITMQ_DEFAULT_PASS': 'mqpw'}
+
+
+def test_env_files_are_private_and_leave_unset_email_commented(workdir):
+    write_env_files()
+    for service in ('app', 'celery', 'db', 'rabbit'):
+        path = workdir / ('.env.local.' + service)
+        assert stat.S_IMODE(path.stat().st_mode) == 0o600
+        assert 'not secret' not in path.read_text()
+    app = read_env(workdir / '.env.local.app')
+    assert 'EMAIL_HOST' not in app
+    assert 'EMAIL_USE_TLS' not in app
+    # The tracked defaults are left alone
+    assert read_env(workdir / '.env.dev.db')['MYSQL_ROOT_PASSWORD'] == 'testingpw'
+
+
+def load_compose(workdir):
+    return yaml.safe_load((workdir / 'docker-compose.yml').read_text())
+
+
+def test_compose_uses_local_env_files(workdir):
+    dockersetup.edit_dockercompose('layers.example.com', '8080:80,8081:443', False)
+    services = load_compose(workdir)['services']
+    for service, env in (('layersdb', 'db'), ('layersapp', 'app'),
+                         ('layersrabbit', 'rabbit'), ('layerscelery', 'celery')):
+        assert services[service]['env_file'] == ['.env.local.' + env]
+    assert services['layersapp']['hostname'] == 'layers.example.com'
+    assert services['layersweb']['ports'] == ['8080:80', '8081:443']
+    assert 'layerscertbot' not in services
+
+
+def test_compose_enables_certbot_for_letsencrypt(workdir):
+    dockersetup.edit_dockercompose('layers.example.com', '80:80,443:443', True)
+    services = load_compose(workdir)['services']
+    assert 'layerscertbot' in services
+    assert './docker/certs:/etc/letsencrypt' in services['layerscertbot']['volumes']
+    assert './docker/certs:/etc/letsencrypt' in services['layersweb']['volumes']
+
+
+def test_read_db_root_password(workdir):
+    assert dockersetup.read_db_root_password() == 'testingpw'
+    # Installations made before .env.local.db kept it in docker-compose.yml
+    compose = workdir / 'docker-compose.yml'
+    compose.write_text(compose.read_text() + '    environment:\n     - "MYSQL_ROOT_PASSWORD=oldpw"\n')
+    assert dockersetup.read_db_root_password() == 'oldpw'
+    write_env_files()
+    assert dockersetup.read_db_root_password() == 'rootpw'
+
+
+def test_dockerfile_proxy(workdir):
+    dockersetup.edit_dockerfile('http://proxy:3128', 'http://proxy:3128', 'localhost')
+    text = (workdir / 'Dockerfile').read_text()
+    assert 'ENV http_proxy http://proxy:3128\n' in text
+    assert 'ENV no_proxy localhost\n' in text
+    dockersetup.edit_dockerfile('', '', '')
+    lines = (workdir / 'Dockerfile').read_text().splitlines()
+    assert not [line for line in lines if line.startswith(('ENV http_proxy', 'ENV https_proxy', 'ENV no_proxy'))]
+
+
+@pytest.mark.parametrize('no_proxy, expected', [
+    ('localhost,.example.com', 'localhost|*.example.com'),
+    ('10.0.0.0/8,192.168.1.0/24,10.1.2.3/32', '10.*|192.168.1.*|10.1.2.3'),
+    ('172.16.0.0/12', ''),
+])
+def test_convert_no_proxy(no_proxy, expected):
+    assert dockersetup.convert_no_proxy(no_proxy) == expected
+
+
+def test_gitproxy(workdir):
+    dockersetup.edit_gitproxy('socks.example.com', '1080', 'localhost,.example.com')
+    proxy = (workdir / 'docker' / 'git-proxy').read_text()
+    assert 'PROXY=socks.example.com\n' in proxy
+    assert 'PORT=1080\n' in proxy
+    assert '    localhost|*.example.com)\n' in proxy
+    gitconfig = (workdir / 'docker' / '.gitconfig').read_text()
+    assert any('gitproxy' in line and not line.lstrip().startswith('#') for line in gitconfig.splitlines())
+
+    dockersetup.edit_gitproxy('', '', '')
+    gitconfig = (workdir / 'docker' / '.gitconfig').read_text()
+    assert all(line.lstrip().startswith('#') for line in gitconfig.splitlines() if 'gitproxy' in line)
+
+
+def test_nginx_ssl_conf_round_trip(workdir):
+    dockersetup.edit_nginx_ssl_conf('layers.example.com', '8081', '/opt/cert', 'cert.pem', 'key.pem')
+    edited = (workdir / 'docker' / 'nginx-ssl-edited.conf').read_text()
+    assert 'ssl_dhparam /opt/cert/dhparam.pem;' in edited
+    assert 'layers.openembedded.org' not in edited
+    # The template is left alone, so the hostname can be replaced again
+    assert 'layers.openembedded.org' in (workdir / 'docker' / 'nginx-ssl.conf').read_text()
+    assert dockersetup.read_nginx_ssl_conf('/opt/cert') == \
+        ('layers.example.com', '8081', '/opt/cert', 'cert.pem', 'key.pem')