Implement supported ingress and TLS profiles

.gitea/workflows/runtime-distribution.yml

@@ -27,6 +27,10 @@ on:
         description: Digest-pinned HAProxy image
         required: true
         type: string
+      managed_ingress_image:
+        description: Digest-pinned Caddy image
+        required: true
+        type: string
       garage_image:
         description: Digest-pinned Garage image
         required: true
@@ -169,6 +173,7 @@ jobs:
           POSTGRES_IMAGE: ${{ inputs.postgres_image }}
           REDIS_IMAGE: ${{ inputs.redis_image }}
           LOAD_BALANCER_IMAGE: ${{ inputs.load_balancer_image }}
+          MANAGED_INGRESS_IMAGE: ${{ inputs.managed_ingress_image }}
           GARAGE_IMAGE: ${{ inputs.garage_image }}
           TEST_MAIL_IMAGE: ${{ inputs.test_mail_image }}
         run: |
@@ -192,6 +197,7 @@ jobs:
             --dependency "postgres=$POSTGRES_IMAGE" \
             --dependency "redis=$REDIS_IMAGE" \
             --dependency "load_balancer=$LOAD_BALANCER_IMAGE" \
+            --dependency "managed_ingress=$MANAGED_INGRESS_IMAGE" \
             --dependency "garage=$GARAGE_IMAGE" \
             --dependency "test_mail=$TEST_MAIL_IMAGE" \
             --output-directory runtime-output/evidence \
@@ -221,6 +227,15 @@ jobs:
             --manifest-sha256 "$MANIFEST_SHA256" \
             --trusted-keyring runtime-output/distribution-keyring.json \
             --adopt
+      - name: Exercise the managed ingress boundary
+        working-directory: govoplan
+        env:
+          MANAGED_INGRESS_IMAGE: ${{ inputs.managed_ingress_image }}
+          LOAD_BALANCER_IMAGE: ${{ inputs.load_balancer_image }}
+        run: >-
+          python tools/checks/managed-ingress-drill.py
+          --caddy-image "$MANAGED_INGRESS_IMAGE"
+          --load-balancer-image "$LOAD_BALANCER_IMAGE"
       - name: Publish immutable Gitea release assets
         working-directory: govoplan
         env: