# Testing

All project validation should run through Docker-based commands.

## Canonical test command

The canonical project validation command is:

```bash
docker compose config
```

## Smoke test

After replacing the example backend addresses and starting the stack, verify TCP connectivity from a client:

```bash
openssl s_client -connect LOAD_BALANCER_HOST:443 -servername EXPECTED_DNS_NAME
```

The certificate shown by `openssl` should be the backend certificate, not a certificate stored by Traefik.

For the included SNI example:

```bash
openssl s_client -connect LOAD_BALANCER_HOST:443 -servername lab.younerd.org
openssl s_client -connect LOAD_BALANCER_HOST:443 -servername azionelab.org
openssl s_client -connect LOAD_BALANCER_HOST:443 -servername www.azionelab.org
```

## Test categories

- Docker/Compose validation: `docker compose config`.
- Runtime health: `docker compose ps`.
- TLS passthrough smoke test: `openssl s_client`.