log in to registries over TLS on remote HTTPS environments

tests/docker-tls-env.test.ts

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'bun:test';
+import { dockerTlsEnv } from '../src/lib/server/docker-tls-env';
+
+describe('dockerTlsEnv (#1557 - login/compose speak TLS to an HTTPS daemon)', () => {
+	it('enables TLS and points at the cert dir', () => {
+		const env = dockerTlsEnv('/data/tmp/tls-x');
+		expect(env.DOCKER_TLS).toBe('1');
+		expect(env.DOCKER_CERT_PATH).toBe('/data/tmp/tls-x');
+	});
+
+	it('verifies the server cert by default (skipVerify unset -> DOCKER_TLS_VERIFY=1)', () => {
+		expect(dockerTlsEnv('/d').DOCKER_TLS_VERIFY).toBe('1');
+		expect(dockerTlsEnv('/d', false).DOCKER_TLS_VERIFY).toBe('1');
+	});
+
+	it('skips verification when asked (skipVerify=true -> DOCKER_TLS_VERIFY=0)', () => {
+		expect(dockerTlsEnv('/d', true).DOCKER_TLS_VERIFY).toBe('0');
+	});
+});

tests/redeploy-force-recreate.test.ts

@@ -47,4 +47,22 @@ describe('restore redeploy force-recreates', () => {
 		// Whitespace-tolerant: `forceRecreate: true` in the options object.
 		expect(body).toMatch(/forceRecreate\s*:\s*true/);
 	});
+
+	// A restore loads raw DB secrets; if this path skips the provider-resolution choke
+	// point, a secret-marked op://... reaches the container as the literal reference
+	// string. Guard the wiring at the source level (a real behavioral test needs a
+	// local dev server + a fake provider CLI, which the CI shard can't host): the
+	// resolver must be CALLED, its result ASSIGNED BACK to the vars, and it must run
+	// BEFORE the deploy - so a refactor that drops the result or reorders the call fails.
+	test('redeployStackFromDir resolves provider references and uses the result before deploying', () => {
+		const call = body.indexOf('resolveProviderEnvVars(');
+		const deploy = body.indexOf('executeComposeCommand(');
+		expect(call).toBeGreaterThan(-1);
+		expect(deploy).toBeGreaterThan(-1);
+		// resolution happens before the compose command runs
+		expect(call).toBeLessThan(deploy);
+		// the resolved maps are assigned back (result not discarded)
+		expect(body).toMatch(/=\s*resolved\.dbNonSecretVars/);
+		expect(body).toMatch(/=\s*resolved\.secretVars/);
+	});
 });