Fix provisioning CI reliability

Author: andre487

roles/https_proxy/tasks/main.yml

@@ -137,12 +137,24 @@
 - name: Activate GOST backends before the public SNI router
   ansible.builtin.meta: flush_handlers
 
-- name: Ensure GOST has loaded the current certificate
+- name: Check whether GOST predates the current certificate
+  ansible.builtin.shell:
+    cmd: >-
+      test "{{ megaproxy_certificate_directory }}/fullchain.pem"
+      -nt "/proc/$(systemctl show --property MainPID --value megaproxy-gost)"
+  register: megaproxy_gost_certificate_is_newer
+  changed_when: false
+  failed_when: false
+  when: not ansible_check_mode
+
+- name: Load a newer certificate into GOST
   ansible.builtin.systemd_service:
     name: megaproxy-gost
     state: restarted
     daemon_reload: true
-  when: not ansible_check_mode
+  when:
+    - not ansible_check_mode
+    - megaproxy_gost_certificate_is_newer.rc == 0
 
 - name: Install containerized certificate renewal service
   ansible.builtin.template:

tests/integration/lxd.sh

@@ -33,6 +33,9 @@ launch_host() {
     sleep 2
   done
 
+  # GitHub-hosted runners may block plain HTTP from nested LXD guests.
+  sudo lxc exec "$name" -- sh -c \
+    "sed -i 's|http://|https://|g' /etc/apt/sources.list 2>/dev/null || true; sed -i 's|http://|https://|g' /etc/apt/sources.list.d/*.sources 2>/dev/null || true"
   sudo lxc exec "$name" -- apt-get update
   sudo lxc exec "$name" -- env DEBIAN_FRONTEND=noninteractive apt-get install -y python3 openssh-server sudo curl
   sudo lxc exec "$name" -- install -d -m 0700 /root/.ssh

tests/test_https_proxy_role.py

@@ -3,16 +3,16 @@
 ROOT = Path(__file__).resolve().parents[1]
 
 
-def test_https_role_always_loads_the_current_certificate() -> None:
+def test_https_role_loads_a_certificate_newer_than_the_service() -> None:
     tasks = (ROOT / "roles" / "https_proxy" / "tasks" / "main.yml").read_text(
         encoding="utf-8"
     )
-    reload_task = tasks.split("- name: Ensure GOST has loaded the current certificate", 1)[1].split(
+    reload_task = tasks.split("- name: Load a newer certificate into GOST", 1)[1].split(
         "- name: Install containerized certificate renewal service", 1
     )[0]
 
     assert "state: restarted" in reload_task
-    assert "when: not ansible_check_mode" in reload_task
+    assert "megaproxy_gost_certificate_is_newer.rc == 0" in reload_task
 
 
 def test_domain_certificate_detects_openssl_textual_mismatch() -> None: