Add 'fiscal/' from commit '102ba84500dbd9655a0471288c3e278652593ca9'

git-subtree-dir: fiscal
git-subtree-mainline: d95165fc8f
git-subtree-split: 102ba84500

fiscal/tests/test_deploy_scripts.py

@@ -0,0 +1,49 @@
+"""The Hub backup/restore scripts must actually run on the Linux host.
+
+Both failures below were found by running the scripts on the production VM,
+not by reading them.
+"""
+from pathlib import Path
+
+ROOT = Path(__file__).parents[1]
+HUB = ROOT / "deploy" / "hub"
+
+
+def test_shell_scripts_are_forced_to_lf():
+    # With core.autocrlf=true on the Windows release machine, `git archive`
+    # shipped CRLF and `sh` failed on the first line ("set: Illegal option -").
+    rules = [line.split() for line in (ROOT / ".gitattributes").read_text(encoding="utf-8").splitlines() if line.strip() and not line.startswith("#")]
+    assert ["*.sh", "text", "eol=lf"] in rules
+    assert ["*.service", "text", "eol=lf"] in rules
+    for script in [*HUB.glob("*.sh"), *HUB.glob("*.service")]:
+        assert b"\r" not in script.read_bytes(), script.name
+
+
+def test_hub_port_restriction_uses_docker_user_chain():
+    # Docker-published ports bypass UFW/INPUT; only DOCKER-USER filters them.
+    # --ctdir ORIGINAL keeps the container's replies out of the DROP rule.
+    script = (HUB / "restrict_hub_port.sh").read_text(encoding="utf-8")
+    assert "DOCKER-USER" in script and "--ctdir ORIGINAL" in script and "--ctorigdstport" in script
+    unit = (HUB / "gti-fiscal-hub-port.service").read_text(encoding="utf-8")
+    assert "After=docker.service" in unit and "PartOf=docker.service" in unit
+
+
+def test_backup_retention_does_not_delete_on_the_host():
+    # The Postgres dump is written by pg_dump INSIDE the postgres container
+    # into the bind-mounted (root-owned) backup dir, so only that container
+    # can rm it. The release-storage tarball is different: backup.sh writes
+    # it itself via host-side shell redirection (`> "$DIR/..."`), so it's
+    # host-owned and a host-side rm is correct there, not a bug.
+    lines = [line.strip() for line in (HUB / "backup.sh").read_text(encoding="utf-8").splitlines() if not line.strip().startswith("#")]
+    retention = [line for line in lines if "rm -f" in line]
+    assert len(retention) == 2
+    assert retention[0].startswith("$COMPOSE exec -T postgres") and "gti_fiscal_*.dump" in retention[0]
+    assert retention[1].startswith("find \"$DIR\"") and "gti_fiscal_releases_*.tgz" in retention[1]
+
+
+def test_backup_also_covers_release_storage():
+    # Part H: PostgreSQL alone isn't enough — every published Agent package
+    # binary lives only on the release-storage volume (never in Postgres).
+    script = (HUB / "backup.sh").read_text(encoding="utf-8")
+    assert "fiscal-hub" in script and "/app/data" in script and "releases" in script
+    assert "gti_fiscal_releases_" in script