From 446996b874e2ac4953fec5b15223dcfeffb6025e Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Sat, 25 Apr 2026 08:02:27 +0200
Subject: [PATCH] Fixed ACME tests

---
 CHANGELOG.md                    |  2 +-
 tests/docker/docker-compose.yml | 19 ++++++++++++++++---
 tests/src/automation/acme.rs    |  7 +++++--
 tests/src/automation/dns.rs     |  2 +-
 4 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f46fd2b..7cacabad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/).
 
-## [0.16.1] - 2026-04-XX
+## [0.16.1] - 2026-04-25
 
 This version includes **multiple breaking changes**. If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
 
diff --git a/tests/docker/docker-compose.yml b/tests/docker/docker-compose.yml
index 71e34181..9a622b3d 100644
--- a/tests/docker/docker-compose.yml
+++ b/tests/docker/docker-compose.yml
@@ -196,12 +196,25 @@ services:
       - "127.0.0.1:8055:8055"
     command: [ "-defaultIPv6", "", "-defaultIPv4", "0.0.0.0" ]
 
+  # Long-running sidecar: keeps pebble-challtestsrv's default-IPv4 set to the
+  # host gateway. Re-applies on every restart of pebble-challtestsrv (the
+  # default in-memory IPv4 reverts to 0.0.0.0 each time the server starts).
+  # Uses the bridge network (not service:pebble-challtestsrv) so it survives
+  # restarts of the target container.
   pebble-challtestsrv-init:
     image: alpine:latest
     depends_on:
       - pebble-challtestsrv
-    network_mode: "service:pebble-challtestsrv"
-    entrypoint: [ "/bin/sh", "-c", "HOSTIP=$$(getent hosts host.docker.internal | awk '{print $$1}') && wget -qO- --post-data='{\"ip\":\"'$$HOSTIP'\"}' http://localhost:8055/set-default-ipv4" ]
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    restart: unless-stopped
+    healthcheck:
+      test: [ "CMD-SHELL", "test -f /tmp/ready" ]
+      interval: 2s
+      timeout: 1s
+      retries: 30
+      start_period: 3s
+    entrypoint: [ "/bin/sh", "-c", "rm -f /tmp/ready; while true; do HOSTIP=$$(getent hosts host.docker.internal | awk '{print $$1}'); if [ -n \"$$HOSTIP\" ] && wget -qO- --post-data='{\"ip\":\"'$$HOSTIP'\"}' http://pebble-challtestsrv:8055/set-default-ipv4 >/dev/null 2>&1; then touch /tmp/ready; else rm -f /tmp/ready; fi; sleep 10; done" ]
 
   # ---------------------------------------------------------------------------
   # Pebble (ACME server)  –  ports 14000 (directory) + 15000 (management)
@@ -210,7 +223,7 @@ services:
     image: ghcr.io/letsencrypt/pebble:latest
     depends_on:
       pebble-challtestsrv-init:
-        condition: service_completed_successfully
+        condition: service_healthy
     environment:
       PEBBLE_VA_NOSLEEP: "1"
       PEBBLE_WFE_NONCEREJECT: "0"
diff --git a/tests/src/automation/acme.rs b/tests/src/automation/acme.rs
index 7bd06959..b1c007dc 100644
--- a/tests/src/automation/acme.rs
+++ b/tests/src/automation/acme.rs
@@ -371,7 +371,7 @@ pub async fn test(test: &TestServer) {
         .1;
     let mut sans = certificate.subject_alternative_names.into_inner();
     sans.sort();
-    assert_eq!(sans, vec!["*.dns.org".to_string()]);
+    assert_eq!(sans, vec!["*.dns.org".to_string(), "dns.org".to_string()]);
     account.registry_destroy_all(ObjectType::Certificate).await;
     account.registry_destroy_all(ObjectType::Task).await;
 
@@ -412,7 +412,10 @@ pub async fn test(test: &TestServer) {
         .1;
     let mut sans = certificate.subject_alternative_names.into_inner();
     sans.sort();
-    assert_eq!(sans, vec!["*.persist.org".to_string()]);
+    assert_eq!(
+        sans,
+        vec!["*.persist.org".to_string(), "persist.org".to_string()]
+    );
 
     // Cleanup
     account
diff --git a/tests/src/automation/dns.rs b/tests/src/automation/dns.rs
index 5e60b746..22056549 100644
--- a/tests/src/automation/dns.rs
+++ b/tests/src/automation/dns.rs
@@ -58,7 +58,7 @@ _995._tcp.pop3.example.org. IN TLSA 2 1 1
 _dmarc.example.org. IN TXT "v=DMARC1; p=reject; rua=mailto:postmaster@example.org"
 _mta-sts.example.org. IN TXT "v=STSv1; id=12942536112359691423"
 _smtp._tls.example.org. IN TXT "v=TLSRPTv1; rua=mailto:postmaster@example.org"
-_ua-auto-config.example.org. IN TXT "v=UAAC1; a=sha256; d=JJ/h5yIbCwPiASVbENZzCyyzeV/AiFCoBbiH2iTISWs="
+_ua-auto-config.example.org. IN TXT "v=UAAC1; a=sha256; d=9X2mMgWAc10oSPuRKZSFBwPXEQpnxkS7SXPO8PC7euM="
 _validation-persist.example.org. IN TXT "pebble.letsencrypt.org; accounturi=REDACTED"
 dummy-v1-ed25519._domainkey.example.org. IN TXT "v=DKIM1; k=ed25519; h=sha256; p=REDACTED"
 dummy-v1-rsa._domainkey.example.org. IN TXT "v=DKIM1; k=rsa; h=sha256; p=REDACTED"