# Testing

All project validation should run through Docker-based commands.

## Canonical test command

The canonical project validation command is:

```bash
docker compose config
```

## Smoke test

After replacing the example backend addresses and starting the stack, verify HTTP-01 routing:

```bash
curl -H 'Host: lab.younerd.org' http://LOAD_BALANCER_HOST/.well-known/acme-challenge/test-token
curl -H 'Host: azionelab.org' http://LOAD_BALANCER_HOST/.well-known/acme-challenge/test-token
curl -H 'Host: www.azionelab.org' http://LOAD_BALANCER_HOST/.well-known/acme-challenge/test-token
```

Then verify TCP TLS connectivity:

```bash
openssl s_client -connect LOAD_BALANCER_HOST:443 -servername EXPECTED_DNS_NAME
```

The certificate shown by `openssl` should be the backend certificate, not a certificate stored by Traefik.

For the included SNI example:

```bash
openssl s_client -connect LOAD_BALANCER_HOST:443 -servername lab.younerd.org
openssl s_client -connect LOAD_BALANCER_HOST:443 -servername azionelab.org
openssl s_client -connect LOAD_BALANCER_HOST:443 -servername www.azionelab.org
```

## Test categories

- Docker/Compose validation: `docker compose config`.
- Runtime health: `docker compose ps`.
- HTTP-01 route smoke test: `curl`.
- TLS passthrough smoke test: `openssl s_client`.