Use platform CI scripts from upgrade_tests branch

8 files changed, 388 insertions, 164 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index c6cbb666..1838b194 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,45 +1,128 @@
+---
+image: 0xacab.org:4567/leap/docker/ruby:latest
+
+# This is for caching the gems not only between the stages, but also
+# persistent on the gitlab-runner so we don't need to install from
+# scratch on every pipeline
+cache:
+  key: "$CI_BUILD_REF_NAME"
+  untracked: true
+  paths:
+    - tests/platform-ci/vendor/
+
 before_script:
-  - echo 'Running global before_script'
   - cd tests/platform-ci
-  - ./setup.sh
+  # Check if running locally ($CI_PROJECT_ID is 0 then) and run setup.sh in
+  # this case
+  - if [ "$CI_PROJECT_ID" = "0" ]; then ./setup.sh; fi
 
 stages:
+  - setup
   - syntax
-  - build
+  - deploy
 
-image: leapcode/ruby
+setup:
+  stage: setup
+  script:
+    - ./setup.sh
 
 lint:
   stage: syntax
   script:
-    - /usr/local/bin/bundle exec rake lint
+    - su -c '/usr/local/bin/bundle exec rake lint' cirunner
 
 syntax:
   stage: syntax
   script:
-    - /usr/local/bin/bundle exec rake syntax
+    - su -c '/usr/local/bin/bundle exec rake syntax' cirunner
 
 validate:
   stage: syntax
   script:
-    - /usr/local/bin/bundle exec rake validate
+    - su -c '/usr/local/bin/bundle exec rake validate' cirunner
 
 templates:
   stage: syntax
   script:
-    - /usr/local/bin/bundle exec rake templates
+    - su -c '/usr/local/bin/bundle exec rake templates' cirunner
 
 catalog:
   stage: syntax
   script:
-    - /usr/local/bin/bundle exec rake catalog
+    - su -c '/usr/local/bin/bundle exec rake catalog' cirunner
 
-#rspec:
+# rspec:
 #  stage: rspec
 #  script:
 #    - /usr/local/bin/bundle exec rake spec
 
-build:
-  stage: build
+# The deploy_test job is run on any merge request. This is used to ensure that
+# the merge request will deploy and test properly. It is not run when the merge
+# request is accepted into master, instead the 'latest' job below is run
+# instead.
+deploy_test:
+  stage: deploy
+  except:
+    - master
+  script:
+    - su -c 'set -o pipefail; stdbuf -oL -eL ./ci-build.sh | ts' cirunner
+
+# However, sometimes it's important to have a way of triggering a deploy
+# from scratch manually even from the master branch, when i.e. new packages
+# got uploaded to the master component of the platform deb repo.
+deploy_test:manual:
+  stage: deploy
+  only:
+    - master
+  when: manual
+  script:
+    - su -c 'set -o pipefail; stdbuf -oL -eL ./ci-build.sh | ts' cirunner
+
+# Test upgrades from the latetest release to latest HEAD
+upgrade_test:
+  stage: deploy
+  when: manual
+  script:
+    # Allow unpriviledged user to checkout last release of leap_platform
+    - chown cirunner:cirunner -R ../..
+    - su -c 'set -o pipefail; stdbuf -oL -eL ./ci-build.sh | ts' cirunner || sleep 9000
+
+# Latest job will only run on the master branch, which means all merge requests
+# that are created from branches don't get to deploy to the latest-ci server.
+# When a merge request is merged, then the latest job will deploy the code to
+# the latest provider, and the deployment will be recorded in an environment
+# named 'latest'
+ci.leap.se:
+  stage: deploy
+  environment:
+    name: staging
+  only:
+    - master@leap/platform
+  script:
+    - >
+      su -c '/usr/bin/unbuffer /bin/bash -o pipefail ./ci-build.sh |
+      /usr/bin/ts' cirunner
+
+demo.bitmask.net:
+  stage: deploy
+  environment:
+    name: production/demo/vpn
+  only:
+    - master
+  when: manual
+  script:
+    - >
+      su -c '/usr/bin/unbuffer /bin/bash -o pipefail ./ci-build.sh |
+      /usr/bin/ts' cirunner
+
+mail.bitmask.net:
+  stage: deploy
+  environment:
+    name: production/demo/mail
+  only:
+    - master
+  when: manual
   script:
-    - /usr/bin/unbuffer ./ci-build.sh | /usr/bin/ts -s
+    - >
+      su -c '/usr/bin/unbuffer /bin/bash -o pipefail ./ci-build.sh |
+      /usr/bin/ts' cirunner
diff --git a/tests/platform-ci/.ruby-version b/tests/platform-ci/.ruby-version
new file mode 100644
index 00000000..8dbb0f26
--- /dev/null
+++ b/tests/platform-ci/.ruby-version
@@ -0,0 +1 @@
+2.1.10
diff --git a/tests/platform-ci/Gemfile b/tests/platform-ci/Gemfile
index 36f556e5..44a8637d 100644
--- a/tests/platform-ci/Gemfile
+++ b/tests/platform-ci/Gemfile
@@ -12,6 +12,8 @@ group :test do
   gem "mocha"
   # Use puppet-catalog-test from git because last released gem 0.4.2 gives a deprecation
   # warning: "[DEPRECATION] `last_comment` is deprecated.  Please use `last_description` instead."
-  gem "puppet-catalog-test", :git => 'https://github.com/invadersmustdie/puppet-catalog-test.git'
-  gem "leap_cli", :git => 'https://leap.se/git/leap_cli.git', :branch => 'develop'
+  gem "puppet-catalog-test", :git => 'https://github.com/invadersmustdie/puppet-catalog-test.git', :ref => 'ac386793c2c456d2071dd0adda716224128f0bb3'
+  # Install fog-aws because the gem dependency of leap_cli is now optional
+  gem "fog-aws"
+  gem "leap_cli", :git => 'https://leap.se/git/leap_cli.git'
 end
diff --git a/tests/platform-ci/ci-build.sh b/tests/platform-ci/ci-build.sh
index 85557b3f..88856511 100755
--- a/tests/platform-ci/ci-build.sh
+++ b/tests/platform-ci/ci-build.sh
@@ -15,76 +15,213 @@
 #   * ssh private key used to login to remove vm
 #     * `SSH_PRIVATE_KEY`
 #
-# Todo:
-#   - Running locally works fine, now use it in gitlab CI ( which ssh-key ? create cloud.json from env vars )
-#   - Speed up vm boot if possible ( right now 3-4mins )
 
 # exit if any commands returns non-zero status
 set -e
+# because the ci-build is running in a pipe we need to also set the following
+# so exit codes will be caught correctly.
+set -o pipefail
+
+# Check if scipt is run in debug mode so we can hide secrets
+if [[ "$-" =~ 'x' ]]
+then
+  echo 'Running with xtrace enabled!'
+  xtrace=true
+else
+  echo 'Running with xtrace disabled!'
+  xtrace=false
+fi
 
 # leap_platform/tests/platform-ci
 # shellcheck disable=SC2086
 ROOTDIR=$(readlink -f "$(dirname $0)")
 
-# leap_platform/tests/platform-ci/provider
-PROVIDERDIR="${ROOTDIR}/provider"
-
 # leap_platform
 PLATFORMDIR=$(readlink -f "${ROOTDIR}/../..")
 
-LEAP_CMD="/usr/local/bin/bundle exec leap -v2 --yes"
-
-# create node(s) with unique id so we can run tests in parallel
-NAME="citest${CI_BUILD_ID}"
-# when using gitlab-runner locally, CI_BUILD_ID is always 1 which
-# will conflict with running/terminating AWS instances in subsequent runs
-# therefore we pick a random number in this case
-[ "$CI_BUILD_ID" -eq "1" ] && NAME+="000${RANDOM}"
-
-TAG='single'
-SERVICES='couchdb,soledad,mx,webapp,tor,monitor'
-SEEDS='sources.platform.apt.basic:http://deb.leap.se/experimental-0.9 sources.webapp.revision:master sources.nickserver.revision:master'
-
+# In the gitlab CI pipeline leap is installed in a different
+# stage by bundle. To debug you can run a single CI job locally
+# so we install leap_cli as gem here.
+if /usr/local/bin/bundle exec leap >/dev/null 2>&1
+then
+  LEAP_CMD() {
+    /usr/local/bin/bundle exec leap -v2 --yes "$@"
+  }
+else
+  sudo gem install leap_cli
+  LEAP_CMD() {
+    leap -v2 --yes "$@"
+  }
+fi
+
+fail() {
+  echo "$*"
+  exit 1
+}
+
+deploy() {
+  LEAP_CMD deploy "$TAG"
+}
+
+test() {
+  LEAP_CMD test "$TAG"
+}
+
+build_from_scratch() {
+  # create node(s) with unique id so we can run tests in parallel
+  NAME="citest${CI_BUILD_ID:-0}"
+  # when using gitlab-runner locally, CI_BUILD_ID is always 1 which
+  # will conflict with running/terminating AWS instances in subsequent runs
+  # therefore we pick a random number in this case
+  [ "${CI_BUILD_ID:-0}" -eq "1" ] && NAME+="000${RANDOM}"
+
+  TAG='single'
+  SERVICES='couchdb,soledad,mx,webapp,tor,monitor'
+
+  # leap_platform/tests/platform-ci/provider
+  PROVIDERDIR="${ROOTDIR}/provider"
+  /bin/echo "Provider directory: ${PROVIDERDIR}"
+  cd "$PROVIDERDIR"
+
+  # Create cloud.json needed for `leap vm` commands using AWS credentials
+  which jq || ( apt-get update -y && apt-get install jq -y )
+
+  # Dsiable xtrace
+  set +x
+
+  [ -z "$AWS_ACCESS_KEY" ]  && fail "\$AWS_ACCESS_KEY  is not set - please provide it as env variable."
+  [ -z "$AWS_SECRET_KEY" ]  && fail "\$AWS_SECRET_KEY  is not set - please provide it as env variable."
+  [ -z "$SSH_PRIVATE_KEY" ] && fail "\$SSH_PRIVATE_KEY is not set - please provide it as env variable."
+
+  /usr/bin/jq ".platform_ci.auth |= .+ {\"aws_access_key_id\":\"$AWS_ACCESS_KEY\", \"aws_secret_access_key\":\"$AWS_SECRET_KEY\"}" < cloud.json.template > cloud.json
+  # Enable xtrace again only if it was set at beginning of script
+  [[ $xtrace == true ]] && set -x
+
+  [ -d "./tags" ] || mkdir "./tags"
+  /bin/echo "{\"environment\": \"$TAG\"}" | /usr/bin/json_pp > "${PROVIDERDIR}/tags/${TAG}.json"
+
+  pwd
+
+  # remove old cached nodes
+  echo "Removing old cached nodes..."
+  find nodes -name 'citest*' -exec rm {} \;
+
+  echo "Listing current VM status..."
+  LEAP_CMD vm status "$TAG"
+  # shellcheck disable=SC2086
+  echo "Adding VM $NAME with the services: $SERVICES and the tags: $TAG"
+  LEAP_CMD vm add "$NAME" services:"$SERVICES" tags:"$TAG"
+  echo "Compiling $TAG..."
+  LEAP_CMD compile "$TAG"
+  echo "Listing current VM status for TAG: $TAG..."
+  LEAP_CMD vm status "$TAG"
+
+  echo "Running leap list..."
+  LEAP_CMD list
+
+  echo "Running leap node init on TAG: $TAG"
+  LEAP_CMD node init "$TAG"
+  echo "Running leap info on $TAG"
+  LEAP_CMD info "${TAG}"
+}
+
+run() {
+  echo "Cloning $1 repo: $2"
+    git clone -q --depth 1 "$2"
+    cd "$1"
+    git rev-parse HEAD
+    echo -n "Operating in the $1 directory: "
+    pwd
+    echo "Listing current node information..."
+    LEAP_CMD list
+    echo "Attempting a deploy..."
+    deploy
+    echo "Attempting to run tests..."
+    test
+}
+
+upgrade_test() {
+  # Checkout stable branch containing last release
+  # and deploy this
+  cd "$PLATFORMDIR"
+  git remote add leap https://leap.se/git/leap_platform
+  git fetch leap
+  git checkout -b leap_stable remotes/leap/stable
+  # After checking out a different platform branch
+  # bundle install is needed again
+  cd "$ROOTDIR"
+  /usr/local/bin/bundle install
+
+  cd "$PROVIDERDIR"
+
+  build_from_scratch
+  deploy
+  test
+
+  # Checkout HEAD of current branch and re-deploy
+  cd "$PLATFORMDIR"
+  git checkout "$CI_COMMIT_REF"
+  # After checking out a different platform branch
+  # bundle install is needed again
+  cd "$ROOTDIR"
+  /usr/local/bin/bundle install
+
+  cd "$PROVIDERDIR"
+  deploy
+  test
+
+  cleanup
+
+}
+
+cleanup() {
+  # if everything succeeds, destroy the vm
+  LEAP_CMD vm rm "${TAG}"
+  [ -f "nodes/${NAME}.json" ] && /bin/rm "nodes/${NAME}.json"
+}
 
 #
 # Main
 #
 
-
 /bin/echo "CI directory: ${ROOTDIR}"
-/bin/echo "Provider directory: ${PROVIDERDIR}"
 /bin/echo "Platform directory: ${PLATFORMDIR}"
-cd "$PROVIDERDIR"
 
 # Ensure we don't output secret stuff to console even when running in verbose mode with -x
 set +x
 
-# Create cloud.json needed for `leap vm` commands using AWS credentials
-which jq || ( apt-get update -y && apt-get install jq -y )
-/usr/bin/jq ".platform_ci.auth |= .+ {\"aws_access_key_id\":\"$AWS_ACCESS_KEY\", \"aws_secret_access_key\":\"$AWS_SECRET_KEY\"}" < cloud.json.template > cloud.json
-
 # Configure ssh keypair
 [ -d ~/.ssh ] || /bin/mkdir ~/.ssh
 /bin/echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
 /bin/chmod 600 ~/.ssh/id_rsa
-/bin/cp users/gitlab-runner/gitlab-runner_ssh.pub ~/.ssh/id_rsa.pub
-
-[ -d "./tags" ] || mkdir "./tags"
-/bin/echo "{\"environment\": \"$TAG\"}" | /usr/bin/json_pp > "${PROVIDERDIR}/tags/${TAG}.json"
-
-$LEAP_CMD vm status "$TAG"
-# shellcheck disable=SC2086
-$LEAP_CMD vm add "$NAME" services:"$SERVICES" tags:"$TAG" $SEEDS
-$LEAP_CMD compile "$TAG"
-$LEAP_CMD vm status "$TAG"
-
-$LEAP_CMD node init "$TAG"
-$LEAP_CMD info "${TAG}"
-
-# Deploy and test
-$LEAP_CMD deploy "$TAG"
-$LEAP_CMD test "$TAG"
-
-# if everything succeeds, destroy the vm
-$LEAP_CMD vm rm "${TAG}"
-[ -f "nodes/${NAME}.json" ] && /bin/rm "nodes/${NAME}.json"
+/bin/cp "${ROOTDIR}/provider/users/gitlab-runner/gitlab-runner_ssh.pub" ~/.ssh/id_rsa.pub
+
+# Enable xtrace again only if it was set at beginning of script
+[[ $xtrace == true ]] && set -x
+
+case "$CI_JOB_NAME" in
+  ci.leap.se)
+    TAG='latest'
+    run ibex ssh://gitolite@leap.se/ibex
+    ;;
+  mail.bitmask.net)
+    TAG='demomail'
+    run bitmask ssh://gitolite@leap.se/bitmask
+    ;;
+  demo.bitmask.net)
+    TAG='demovpn'
+    run bitmask ssh://gitolite@leap.se/bitmask
+    ;;
+  deploy_test*)
+    build_from_scratch
+    deploy
+    test
+    cleanup
+    ;;
+  upgrade_test)
+    upgrade_test
+    ;;
+  *)
+    fail "Don't know what to do for \$CI_JOB_NAME \"$CI_JOB_NAME\"!"
+    ;;
+esac
diff --git a/tests/platform-ci/provider/files/cert/example.org.crt b/tests/platform-ci/provider/files/cert/example.org.crt
index 7de2982d..174cac51 100644
--- a/tests/platform-ci/provider/files/cert/example.org.crt
+++ b/tests/platform-ci/provider/files/cert/example.org.crt
@@ -1,31 +1,31 @@
 -----BEGIN CERTIFICATE-----
-MIIFbDCCA1SgAwIBAgIRAJW2X9xbiBvmbN1kMlRVKtQwDQYJKoZIhvcNAQELBQAw
-SjEQMA4GA1UECgwHRXhhbXBsZTEcMBoGA1UECwwTaHR0cHM6Ly9leGFtcGxlLm9y
-ZzEYMBYGA1UEAwwPRXhhbXBsZSBSb290IENBMB4XDTE2MDYxMTAwMDAwMFoXDTE3
-MDYxMTAwMDAwMFowKDEQMA4GA1UECgwHRXhhbXBsZTEUMBIGA1UEAwwLZXhhbXBs
-ZS5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDFuKIL//hf5cjU
-m18q5fSUyvwtmWREJPaVp+CiWiGJHmxFAiWMGuAFRRChhZ4SYmnEscNda0f6ntPz
-rO+XjhQeA05bIYD9JcFT25Jg4kSX4pQ0+pK2vuHqk4ascZgOOaq4fN8SXD6ZiL3m
-CONDRzbnZVR2LqsdCbEqIuHlo7VK7MO8/9A+rF7wKLVatBtk25uSWMQPt0Q41gw6
-YTV447SltFH3fgUZnNR6p7Oxpsi3qEWlt2vZMIa5xdq4ge2dx1GgC8oSBx1XT/Yd
-qu//GECAH5XsZsAaPXDuor1iTbWELzHyGrQ7V80e67lE2lxoaHxRCOE/NDUU6UXm
-CqXwhdBHarHehOCGSDXvHEwAH5zpV77XOm2bIoZmCjM1fRk5p2S3GmXteCdvCxBP
-+2wECnRXuwN2aICrBk7sZ9FieRsYao8GZN/A7ZY24pf7CMEBsgjYktTjAwUb21m6
-vmmzt93dEVJgkd8LASFmoXn+YAIGF0/fD5ZutlsAsBfodoCH9JKBi25nVVTEQW8g
-TzUegTC3PUqnathWv4gZIYDG1ZUDxjk30beNmXV2XudASmP7NG4uSlQwGAEWn+cc
-dzOnRxR0BQpkMMNEV/HmJVuSV5Ak4DkruSXGjLpzi30BjJ8obx85YAusIrhWRUrR
-2oz6gqDUnwq3Nkr3Nk45iOEDC0cZnwIDAQABo28wbTAdBgNVHQ4EFgQUS7rm3WfC
-psxoh4i7q0YbTbMZWuIwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMB
-MAkGA1UdEwQCMAAwHwYDVR0jBBgwFoAUlhC2wfrVFzGrtuzcA0mkO+yn9bgwDQYJ
-KoZIhvcNAQELBQADggIBAKxeVSMEpUOdBO1zmwd5NtugOlYV3/Gu9GqmUQdlB4FF
-Wt6sKJmYYByNquKT79oJLb9dgUPw8qQiHCB+MAsjB4PpHvMRlpgrcDGsI8+esnfG
-dJny+82aRIFZ2KnNbH8FchcCh4bviaY+DE9kyJNHILk0ujICXabR0G6ArVISTbyB
-C+6BdFyKTT5zj9mtkiTgvZchlKCmOmvh/HeCONu6MGYbqcqp41RA3g1eEjFoROKO
-wmf65VvfOBeb9VydOTICh/bJWRSmAMJqWxbOiV8+Ldufi0vXMcOhEfsyo316xxRq
-1GMb5xVihtCxj/+qBKNoun4k9LTmUvComuPakbtEPT2QbxiTvqCbXsWHPoRwCKEj
-RcFPsxWAnUslzqSl1b0oLaE1zNjBmB/Zd82i2MC4PncLC2hLHtAU1imRZKP6rnHx
-cb1NyFLS0FmIPqZUz9qcY2Tj3GbjqYqRi/sXNKrR2axAUx+jGI/Ie7Zsqa4VZA0A
-ZsiF0BGN3RTCYHuoJbXfEVFQ3o97JGNC3t07u9XhVuC0fjCiQu5PBbMRHSSvtBdN
-+LSrhR5j4aiCmppgQSeTtoKSIS3EiOzDtawdewxhffK+co0pGnO3nox+iINvSIQ5
-IevAREmZ2ytjFDU/kVFFlINesFsLRouO37DUf2Kjxaa0RgkCBHpOnTAAD7bXiSaJ
+MIIFazCCA1OgAwIBAgIQbk9ZqiquHG3E0IiLALe2pjANBgkqhkiG9w0BAQsFADBK
+MRAwDgYDVQQKDAdFeGFtcGxlMRwwGgYDVQQLDBNodHRwczovL2V4YW1wbGUub3Jn
+MRgwFgYDVQQDDA9FeGFtcGxlIFJvb3QgQ0EwHhcNMTcwNjE3MDAwMDAwWhcNMTgw
+NjE3MDAwMDAwWjAoMRAwDgYDVQQKDAdFeGFtcGxlMRQwEgYDVQQDDAtleGFtcGxl
+Lm9yZzCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL3GmkcYpqzivoha
+Fc1G2DgRpm658t27ELp6qk4iwjZ8IZMnQl3N9ZMmbU+jFWg+ZvNETZoi91bOgnPh
+PtXnGEP71Cgt47+rJ5WvwcvlAvizlvMf7mqrDhFzAqKX7kLdP+akFfC/Wjf9wh3M
+FvTxZOb3uhNHUesPMe/OORU0i2r3QzHwCTXc99c8FR0xYRdX9Cr6ig4irdbgmwbd
+BKRE3q23dVJXUTqNzHc46a3j9KlfE9k1hJy0k0gpuDOliZslicIG/BljbeJqH2tW
+GeJrovnO6THOft7SaUV1hJQtIxAj0YY2a0MMUbKitvmRZ+oPZusGQFl+RA7b0vxe
+UK3hTO6oSGGVqBhSe4T52EBJ74c0FOJdG1Hp65t6DN/HS0rO8cQRA7EVFxwMnnvo
+tf9E1O7Zv6URY+lU8Pr3aBIzYVE1XIvmZIj60Bst87mRz1tGsWf99hDxWyFaesVq
+g5EI5G9rKf1CZyQyTTwhfLbr4wsJo+S3Y4zSP0xyOypaTiZwydWVb/4J5MBlaNs7
+ZMU3gugp9hEn4BzYzk8lxcqChKMl3rFdjWPkSl2/tP39WvVo/T088vKS6v/1Rq4n
+0Iz33d3FbayBNlHMZjHPmwgbvL5YKjnEtkQyi+6isBt8g/4KLxZZbN5udyrCJW7n
+3xGj3DYokhOZVt7rpiMAgqHAEB0VAgMBAAGjbzBtMB0GA1UdDgQWBBSvA0QXoIqX
+2Pf+Gb+va4aEdTxTsTALBgNVHQ8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
+CQYDVR0TBAIwADAfBgNVHSMEGDAWgBSWELbB+tUXMau27NwDSaQ77Kf1uDANBgkq
+hkiG9w0BAQsFAAOCAgEAAfI9WvIw+HdtcNtnmpIqNP9o2S+QfVd75jEnslV/NDIS
+chZOeS2OnGLsV2oxh4EypRnAAIUTRF49k9gE6i9g+E4YGEOCmLzwHHm8VAiz1UNP
+Gubn1vNUfwk5Ct4lZWgb4QxrJQ+7AjIX+742D9fvfb3aP8sEWxmq4kfTZDxbjtGz
+mIUQ9Dtd5Ck00LU/eJv4dcsTf6vSjkc/QL+aan3o2J/6wUXWLH00kOHnXex4eofd
+DJok7rL9E5HbFlCup2bmUgeQEx8keegG2TEQgt61JMrwQjh9EsuA69AMLiDSlfhv
+WOreUjPZCHRDtLhZJD54AvMuDWo7p8lcKyVBo4jkwx80qkfnZgh81lWIuYxIOB+y
+VfyEy0+jSCc9Jub/57HADMj29hxkpT6FYPzMPk+tInxL8Z5iwb0UQ/fVNX2mgXwp
+U5E+M4OYaNi9xo2992xd6rok8Lnkaq27tUVV0ZiMLfe8Njv1UQLV2hTiPzSntwsK
+SYHtN8mavrl6tdqU5F5V+GydAXfcmEKQnV3AxOYTFsfjotSbipBRGfAoRksmRGiH
+8dT5jWpi/Nvta+azn55029ej1AVuD7nWMhT+7mYvfmiSqzItorI28+g0P2jSBOTf
+t4MfXLecy4mnqIWM4ciHAVF6UMWJbnTSc0DwEQAgpdw21CoPp6/BERLI9frvU7o=
 -----END CERTIFICATE-----
diff --git a/tests/platform-ci/provider/files/cert/example.org.csr b/tests/platform-ci/provider/files/cert/example.org.csr
index 95e8b65d..5d1dfc77 100644
--- a/tests/platform-ci/provider/files/cert/example.org.csr
+++ b/tests/platform-ci/provider/files/cert/example.org.csr
@@ -1,27 +1,27 @@
 -----BEGIN CERTIFICATE REQUEST-----
 MIIEqzCCApMCAQAwKDEQMA4GA1UECgwHRXhhbXBsZTEUMBIGA1UEAwwLZXhhbXBs
-ZS5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDFuKIL//hf5cjU
-m18q5fSUyvwtmWREJPaVp+CiWiGJHmxFAiWMGuAFRRChhZ4SYmnEscNda0f6ntPz
-rO+XjhQeA05bIYD9JcFT25Jg4kSX4pQ0+pK2vuHqk4ascZgOOaq4fN8SXD6ZiL3m
-CONDRzbnZVR2LqsdCbEqIuHlo7VK7MO8/9A+rF7wKLVatBtk25uSWMQPt0Q41gw6
-YTV447SltFH3fgUZnNR6p7Oxpsi3qEWlt2vZMIa5xdq4ge2dx1GgC8oSBx1XT/Yd
-qu//GECAH5XsZsAaPXDuor1iTbWELzHyGrQ7V80e67lE2lxoaHxRCOE/NDUU6UXm
-CqXwhdBHarHehOCGSDXvHEwAH5zpV77XOm2bIoZmCjM1fRk5p2S3GmXteCdvCxBP
-+2wECnRXuwN2aICrBk7sZ9FieRsYao8GZN/A7ZY24pf7CMEBsgjYktTjAwUb21m6
-vmmzt93dEVJgkd8LASFmoXn+YAIGF0/fD5ZutlsAsBfodoCH9JKBi25nVVTEQW8g
-TzUegTC3PUqnathWv4gZIYDG1ZUDxjk30beNmXV2XudASmP7NG4uSlQwGAEWn+cc
-dzOnRxR0BQpkMMNEV/HmJVuSV5Ak4DkruSXGjLpzi30BjJ8obx85YAusIrhWRUrR
-2oz6gqDUnwq3Nkr3Nk45iOEDC0cZnwIDAQABoD4wPAYJKoZIhvcNAQkOMS8wLTAJ
+ZS5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC9xppHGKas4r6I
+WhXNRtg4EaZuufLduxC6eqpOIsI2fCGTJ0JdzfWTJm1PoxVoPmbzRE2aIvdWzoJz
+4T7V5xhD+9QoLeO/qyeVr8HL5QL4s5bzH+5qqw4RcwKil+5C3T/mpBXwv1o3/cId
+zBb08WTm97oTR1HrDzHvzjkVNItq90Mx8Ak13PfXPBUdMWEXV/Qq+ooOIq3W4JsG
+3QSkRN6tt3VSV1E6jcx3OOmt4/SpXxPZNYSctJNIKbgzpYmbJYnCBvwZY23iah9r
+Vhnia6L5zukxzn7e0mlFdYSULSMQI9GGNmtDDFGyorb5kWfqD2brBkBZfkQO29L8
+XlCt4UzuqEhhlagYUnuE+dhASe+HNBTiXRtR6eubegzfx0tKzvHEEQOxFRccDJ57
+6LX/RNTu2b+lEWPpVPD692gSM2FRNVyL5mSI+tAbLfO5kc9bRrFn/fYQ8VshWnrF
+aoORCORvayn9QmckMk08IXy26+MLCaPkt2OM0j9McjsqWk4mcMnVlW/+CeTAZWjb
+O2TFN4LoKfYRJ+Ac2M5PJcXKgoSjJd6xXY1j5Epdv7T9/Vr1aP09PPLykur/9Uau
+J9CM993dxW2sgTZRzGYxz5sIG7y+WCo5xLZEMovuorAbfIP+Ci8WWWzebncqwiVu
+598Ro9w2KJITmVbe66YjAIKhwBAdFQIDAQABoD4wPAYJKoZIhvcNAQkOMS8wLTAJ
 BgNVHRMEAjAAMAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkq
-hkiG9w0BAQsFAAOCAgEAG0IpXLHZpgXtBZHEnGBghrucWnAuhRf0sXauboBVWnwA
-5noESIIX/hNq9DdaBba684u1Qga+lZcFsO1Zh/K1Guu74FTNxV2jCLKcX1T+Ymx4
-uRJ1jcdCc+YB/f+ce+pAhFJei/6sKP//MtYIBHlbe8aGQx1yVPJ5oSb4yS9Hloe4
-DuM0bp6ZXhXFv4YxxxDbaTMs9D46AKnqXV0rLe8WwHH1Mbdxl0bi7roZ3/1NPYsg
-diUMWQlnrR1d1xxUG7x+PJRpPcN3GmZQ0WyZoNrIQA7OLEg6nM8T4sQX5OZFdQrQ
-KQJyX8+Cc8j/UtPrPIPgch6iYX32e+1wTAP82npw1KMELxRsxjX6ERl65apkADFa
-w6LrCFtUQApWY/vZPz88udzSxVytJL4ZrHJxuZEG1WFE3kPY2Ak5LYw/IVxCDFsL
-GVfhb92zkn5iUkULXbwjcTytK3IqXZHl05PW+etGtqbkdh99m8eH1HxolKEgtehm
-l7FMD/JrC0GJWhI4Dl0CpvhAsV61pa8f1KmfGFTt+zpS4epSIItWTuSd4tzaXwNq
-3K1zJaKHs16VWBFuhH5kle4QGRIuDRPHchBQQg0wgy/sfHuzqbcVNotGZ7qzvnRL
-x5eXmWm1HaVKl1NpxbntMY4o9u0WgyzmU0VVsv+oWJj6J88T97rqTNg1Q1Uj8ic=
+hkiG9w0BAQsFAAOCAgEAif8FifpW2oup62+Wq/bYozwotreb7UOkaCMo+6ZsTyY3
+XcLoUa/7lM4dX7ZDPujOB3MyvF8mw2fsl7DJO605bjERbjzwyKXKPn4TFpHopPKm
+qMJzZT7KHqIdkVUnitsOKysLoIHYV7fTdjspnt4UlyYoJji6lCtAmsVt4mxO3jmf
+6EVVyR5fr+cz0n6qwmhjRXGNDHA3CkAV77rLtiK3oYQ7fQ4VY2/3uZpu62nP4u77
+HAuEj4mBsPq5I0+oxFPoM6Yx5dyVrHlPsfl8SzrFbXBCrSQkvEEbbsE3MAuQ+SJS
+MVwngXxnpViNHYYl97Lmxc4c2ZxG9eyusFIamDN62adGUkkZqvg0ZQzyVzMnIVYC
+jc8h8MxxeQNHSrcPu8wziavA8xRMj0c51Q09gvlVBQmDNxZqib9MSH6U464zilZZ
+E/1tEAoNWqmDq0mzzdgY8ShRBOcVfaU+S/K0nRJWKLF/g84d7n5j+P2eJXE7aDkw
+6dzqPVjbZk/0BrkTuh895BgjzqjAVvKONdFpZ4ugcYMZX75IqE7ta4DskXD2Fd6v
+OQdDqRFhHLS/xVPiLRr981qT3NZMDaezLU/VfJFAsTf8wmgGqtBQqM/N1JWrUU/N
+b0ouLa3CohZoM7dY44a137r5/rDTpsv33gES2BVumY8XZzaN+RLJ45I7BqMpLOo=
 -----END CERTIFICATE REQUEST-----
diff --git a/tests/platform-ci/provider/files/cert/example.org.key b/tests/platform-ci/provider/files/cert/example.org.key
index 7ca1c512..13adeb7c 100644
--- a/tests/platform-ci/provider/files/cert/example.org.key
+++ b/tests/platform-ci/provider/files/cert/example.org.key
@@ -1,51 +1,51 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIIJKQIBAAKCAgEAxbiiC//4X+XI1JtfKuX0lMr8LZlkRCT2lafgolohiR5sRQIl
-jBrgBUUQoYWeEmJpxLHDXWtH+p7T86zvl44UHgNOWyGA/SXBU9uSYOJEl+KUNPqS
-tr7h6pOGrHGYDjmquHzfElw+mYi95gjjQ0c252VUdi6rHQmxKiLh5aO1SuzDvP/Q
-Pqxe8Ci1WrQbZNubkljED7dEONYMOmE1eOO0pbRR934FGZzUeqezsabIt6hFpbdr
-2TCGucXauIHtncdRoAvKEgcdV0/2Harv/xhAgB+V7GbAGj1w7qK9Yk21hC8x8hq0
-O1fNHuu5RNpcaGh8UQjhPzQ1FOlF5gql8IXQR2qx3oTghkg17xxMAB+c6Ve+1zpt
-myKGZgozNX0ZOadktxpl7XgnbwsQT/tsBAp0V7sDdmiAqwZO7GfRYnkbGGqPBmTf
-wO2WNuKX+wjBAbII2JLU4wMFG9tZur5ps7fd3RFSYJHfCwEhZqF5/mACBhdP3w+W
-brZbALAX6HaAh/SSgYtuZ1VUxEFvIE81HoEwtz1Kp2rYVr+IGSGAxtWVA8Y5N9G3
-jZl1dl7nQEpj+zRuLkpUMBgBFp/nHHczp0cUdAUKZDDDRFfx5iVbkleQJOA5K7kl
-xoy6c4t9AYyfKG8fOWALrCK4VkVK0dqM+oKg1J8KtzZK9zZOOYjhAwtHGZ8CAwEA
-AQKCAgAht6KquTP55o2g8/3+qshSt2rZu9bFaChEzSQZi5U8dNuxyPPuOIcLXwO/
-B7I1IGM5D7dpLupPatZqL4uMJMZ5d8bc85GzmcSmMEN+EhfwbssnXbO3RkXwYsgM
-kDKF+n+KhoDj+KcUN6VqnQlkZ7iNLVKB9ONpSEXWEazEJG6+IDIhAN7aUTq/abHD
-jgM959VX15tXssEHkDj1m64qt2oO9/kiY3MrMvtpD0Atg2unJiL6Z5UUrJnNBFiQ
-Llf/GAZrbJdBC8WNJi2qUYQr1E7rindeoQcRcnjXuRjisq3JpOK3jqY9mHN6Wmh1
-vWcUxvysNP90b8q9jipFWHuD0M37kq+BLn5Bub0ypiIkId0CUnAB9MBYcBJlYhai
-ZwI1fe0uGFD7XlJbHexTgnLreDAo3FR9CIUDo2HUWqmUNWadAl/rPNRe6+QDDvmP
-5v4HiFmSuCjZJOu9x2z/ly1JzM+iCUp+q6BxYYYW/5tDLYAw7sl1uaiLTzZuhrrM
-PlO6DNLAQhMn29jeszPHt7iXHdHAHAuYSeHpfeqnAV1qB+6x7UFVZjbDxXkt/Sn0
-+LvCzJUQOwQNlnnzIwVdn8phS3r9TN2rI3dtlvPMWJqgBiheJ9qn2tHjjoPETt9I
-hfvw949Gi65D+AFSzowjNUFwDXzphOwETv5tpKCRROhdBRBdwQKCAQEA+L9RsVqT
-F+7HyGza+F53mgED5SQoS52vRA2OiAbCgiNjY7JH7bqIpuO4RlgqKo+GKoboCP6D
-1CmVGUm/Z8wYspzQs15O/jUO1bZ8KFREt8TquxFtikwyvIXQhUdJhZYUnhfMzV3O
-sH1blWhJnSX21rxJWlrkN0I8Zdkl6mjvFa97Kr9UA/pdZd0qgIw5Vi7MFLPC7j2Q
-YmTPhNsb0oZMJHGvwENUmuCQDhGiRhQV06R963mTMvxY7LWqUVf6dr7xg89Qt5Yo
-AdSHllOxHOMTAa+kZNF1N8UM9S2iJSn6ZeUEOXOJEuosghpE/QIuvo81Txm63G7e
-BjU3H7cFqDetfQKCAQEAy3xy2cQ/+GlSIbwXrzBr483Z0jXnvknlCJMh+NCTXObk
-idOhhnIuZu+JoAovv2AfKNPvYXotmb1xxmws5RSrlZDGiQQzEwvJPeLN2DnUGqzc
-ZPenu64Je6v9L35iRMF8vyx3xf27FC4zmR6nLuZbgfEfQdModqCbTpzh23Cl3mkM
-IZFYPhhfnh/pcwccuqfOn0Adt+1X3jvp3QzCh1jkEjhaRB5qjt58nlmxA2EKYv1w
-OzSTH9owqsCMmdrqzR7iKh59LrfOfggJbhHCyrORZ/S8h5lwqIk3+zLMrwGSvkXL
-tuKLXtkX/Xy98cbHwk5M/bf3hH6I5njlsssFsS8+SwKCAQEAxCzu2raaJ1fUDAd9
-sj+eh8ChN8gKV4hmv38Jl9Hs+QG70ta5z407VJNns2K47pP+te9rdBx2D48z3ZvB
-7rSSDduK5MtN9UIXDwk6Zfv/rgcJMLuP7nAl23SVfWc5Xrd8TypqBNUkuyBCaFS1
-KdDVGYmpOC9SqRn91D0rn/FeDXY15wK52eFMY5fHe1YbqhKCNRmIdKftBQyIdTjw
-elocFunqN/Fh+jt8oPvbRPV2OVITVPCu3JkT8KtdRYXjLF9uzgtkl0U/DCJ3RGGA
-301eogfJ2REwJumrTHnO1QyERHQXns+1nUs+CuV43ykngHYlDts1+b8eLzss3EBV
-n9M5aQKCAQEArqKmmtg/on0ZPNSFaxfecEq5lxwmQHyAsMQ9UqIG5qNOHi9fn9gc
-lMEdVxmG8vKWq16AQiMuQZSBsa4jNZNw0tLGYM8W2lCyLIea6+htbVtPZuPYs0zg
-3J+1ke4gfiukWRnbzTM+PEqOg+n3x1txy2pZzg9f2bdqsqQXflIGOIPlImXv2pLm
-dPmkS9Edyd+8h5XqK3DpiVPYGJsb1Dbove5ZIb8M6oJtZyVIssK0vFIP4O/1GFAU
-lmbcBCsKenH33ff+rXqYIDfbh/h8OaS0tQgoSSPZuPrS7aYiXku2Wc/izplMzWD5
-otZM2dQkmlDC6LjbF33VFh9J2xE8WF1YUwKCAQAeJYro7nBxM0eOmof1ty24UPfg
-jx72sH/FpgKIyvZ4yQoreNUc4TVsy5QMIVd0G966CRgvzaE0vcBHm//7YCXHtIa9
-ihqmYDo7SoaF7nZNjxJIxyQVPY0+Kntkwz0XAX0IbJ0nMx+3x6d5UhbQbxFVKe7X
-5WmOMb0ro9NLaCvh5IUxSHsG/a8hYRqoX3tZbPRvTJMZMTMxWslsscWINNu/80KS
-ggpD9Uu9hdVwT7yavl6JKC3ypRdBzmpKZfiLt5CTFex+XGIgKLHVqbHxXu487YsL
-AlexBvk1/RKMTHIgUl7uMmaJsUSD+ME4SWuU9cW115kwp+JBMXES4ZfWnRHZ
+MIIJKAIBAAKCAgEAvcaaRximrOK+iFoVzUbYOBGmbrny3bsQunqqTiLCNnwhkydC
+Xc31kyZtT6MVaD5m80RNmiL3Vs6Cc+E+1ecYQ/vUKC3jv6snla/By+UC+LOW8x/u
+aqsOEXMCopfuQt0/5qQV8L9aN/3CHcwW9PFk5ve6E0dR6w8x7845FTSLavdDMfAJ
+Ndz31zwVHTFhF1f0KvqKDiKt1uCbBt0EpETerbd1UldROo3MdzjpreP0qV8T2TWE
+nLSTSCm4M6WJmyWJwgb8GWNt4mofa1YZ4mui+c7pMc5+3tJpRXWElC0jECPRhjZr
+QwxRsqK2+ZFn6g9m6wZAWX5EDtvS/F5QreFM7qhIYZWoGFJ7hPnYQEnvhzQU4l0b
+Uenrm3oM38dLSs7xxBEDsRUXHAyee+i1/0TU7tm/pRFj6VTw+vdoEjNhUTVci+Zk
+iPrQGy3zuZHPW0axZ/32EPFbIVp6xWqDkQjkb2sp/UJnJDJNPCF8tuvjCwmj5Ldj
+jNI/THI7KlpOJnDJ1ZVv/gnkwGVo2ztkxTeC6Cn2ESfgHNjOTyXFyoKEoyXesV2N
+Y+RKXb+0/f1a9Wj9PTzy8pLq//VGrifQjPfd3cVtrIE2UcxmMc+bCBu8vlgqOcS2
+RDKL7qKwG3yD/govFlls3m53KsIlbuffEaPcNiiSE5lW3uumIwCCocAQHRUCAwEA
+AQKCAgAq/Vhpjp4DQAIlZTLXI5tLaEQphRoNPJkXhT4bISiZqxj3+sa/9S4SPXw5
+tBnfWXN83BYwOoeJNJK8qWPQlN8cV2nCCFM1UhJPiFcAV0qLCDPDs5IQu9sd/M22
+A3DH2NLm7njB5rcLRAK7OUZiCmTvJWMThu55ryGCz1aDBTon6wdfwp5zgzDpowSt
+bkguP5BiRAsOFLEIoiy8K0kn5SoEdDCxjHIsL38H6u6Uo7UCwTT/2W3HCejrSfge
+SvuXF7PTLj3hinKT/bJMYF7Quc1bhZGx5LM8yrFqOKrl3iu5NkP6gU1fDOVc8Bs/
+Ab9meEK6LtpY64+DRizPWpYwLX99lMlGS1v8GsLuAPCbQ4RGJLRl2nUsrowk8xI1
+BSVEv+QcYB0Tp5CeOa+ejsI23HczmSBW6j4sqx1/vTu5tKxtvxppKOjkV4rrbAnv
+mK6NPpUo3bVtUJIejVALE2PlXLM6XlZJinLPKFfOGRQ9VTdgVsQS6oHfoxknzxCy
+MHtzxNt/ZLCzWa0uszta6kjta0qburn/q9DAGwC65W/BeSzc79qaEOf2bdNSHxeD
+1ENnKGN3G3PUGCH9/Fs6bEX6/bX0WihfOq2XTxBNs0jcjCycHXvOGTp7jRFjbaIs
+a87b6whFLL52oKEqpq6o7JqXa8I/Pn0eBp07Soos5WWfHtLsgQKCAQEA56U80Jjt
+iAZMoxLDRNY0WsYavvLlarZISbHy51eYl54c1YNvnmPheSddRoRW+AWQQ1iQ710z
+p/KMm7D81PArUplIe8GutbqqvmezsIQqvCUbWC672KiA7xH6zGKlnRmqryefare6
+nvR48sEcsfwywoW7v6yg2ZzY9uz6FcHuN27pHk+b2oMd1qGeSSVuhqZ1XUPFqAF2
+IcxVMd4upsFLCVz94kqOcyYHAUNHZ8ANaT6EATF4bRbccmGzjo8PiS0mhUCL8nVh
+2tcB6fsT1i0sJ19e1cPBgmxy2pOc25D8aldt6Bds0lQl0Zhfl63/R1o00S0z4Mgt
+9/LycTKuL0fTZQKCAQEA0bpwQHNLF7nwtfsLNZifXApHNNmiiyBvK/SQqqn2wdA3
+l8Ol6hcborYfuwvL+5dTi79DIROF9RqpWoRwlMq0XIAldW4H46KUWuZrtfDD0T2B
+VFB4nlihMCZT2lOsDrNMcykZGLAb49u0GKeyNE1z2RiLR/zTQvD2mVXSt7UVNsgA
+xnInCF3wN1oMZOu2N5paXAfiw7L91ZVpacV8LtZhGaby6Y0hjy9Oh1/DjjQb+aFH
+r2A7AIMFtUtKIpy4ymBBcJWH952fVdImAZWcYUTMILj/eOML9KIc/iAdaLZzgPA+
+cged1qGIEDjq1pjyhgB83NHPjQwN9+qnuJ6KD5d/8QKCAQBCKQGLmoINHa95y/wV
+hxCA9J/i9cDsj49p7Pcxd+VPOIuHt/iDRoe5cLLFVzr3r68abQtIMlh0mWPre8ta
+jhXxi3IWVqUtpljp9Phva/BAuGBs+TwRj17z6TC2e15N1mzXhfuUIVGd4LlCrEEj
+3KIqyMNs5UMzpAabz+dFm5QMJRNT4uziphw5lwN8ZMKClrxinN6xM2moEZIroge0
+/PQPgo3Iuf6hiLTreWnFiibKbl6JcLWygpsH2DvOdbG8PjcIS/0sjLYcKNiVGW76
+9v/rZuPRLg3w0ESlhQ+B7pEJVls/tKESGZKLoHd8/OcyW+NF8yEkDEiEztDL3+u7
++Um5AoIBAEQZZZmH1jo+BgsRGPKuPBCGxdhDUqQaQ/7hypef2J/WHDcLMDRyjGao
+/GSfz/xBhr85u3JiBH0xywu5NVUa/LWMZp1avPUNNV7OsurA4tRuRDA8cO35mV0p
+FNEvmg6r6Yb7MUry5Bt4m2HmEdcpzxQPBCq7zV1PIMNpOqKsCddf2eCV8FanKfjP
+JHcgkmo7lFuNs/QXipRvj2ro1QngUmch7n4ndV4o3jbWwYjLIspLtBseBAqGgLP9
+XnUermIIHzePVjbw12vmcLDTA5QR4rY9W7bFAnzMpt1dUC9QDvEvERe1oWqvyJ57
+3MURpK4eOmz5M4t4/pAhgZRQ5kNpzgECggEBANT1KAU4EvXxYXpYaq9O9YTQnSbH
+8HBxsN2TeKEb29EyFHRhd5TxdV1/wDcRY4uqopIN8/xsLFqoOWyPLn/23bwpAuU9
+YskLKnQspN4w2Eyn0b9K4cF3SigwmlEEqDk8sxTtZ5iv7olE5GaeoZiQQ8yS3oZc
+QWVe6gierK0XdwnuPvE4Yio3gMFxuy1PrMPJj9JyKjWIvT6ODF7nWYRdnwPTfqKA
+cxXoPKajyk2LVAXt9qQao/o6/AWeyZhgPhFiT9NUEFiBcmnUTq8xblOXpbZev6eC
+nUKF5Oy9r4aI9eafeLWhVqTmXLUtExLjfL6rmLu+HlOdd9SYpYEIdCzMIe8=
 -----END RSA PRIVATE KEY-----
diff --git a/tests/platform-ci/setup.sh b/tests/platform-ci/setup.sh
index 39ef3130..e92dddc7 100755
--- a/tests/platform-ci/setup.sh
+++ b/tests/platform-ci/setup.sh
@@ -1,4 +1,5 @@
 #!/bin/sh
 
 which bundle || /usr/bin/apt install bundle
-/usr/local/bin/bundle install --binstubs --path=/var/cache/gitlab-runner/ --with=test --jobs "$(nproc)"
+/usr/local/bin/bundle install --binstubs --path=vendor --with=test --jobs "$(nproc)"
+/usr/local/bin/bundle exec leap -v2 --yes help