fix clean deployment nginx configuration

tests/test-deployment-scripts.sh

@@ -18,6 +18,26 @@ cp -R \
 	"${TEST_ROOT}/deploy" \
 	"$deployment/"
 
+mv "${deployment}/deploy/nginx/templates/http.conf.template" \
+	"${deployment}/deploy/nginx/templates/http.conf.template.saved"
+mkdir "${deployment}/deploy/nginx/templates/http.conf.template"
+if (
+	cd "$deployment"
+	printf '%s\n' \
+		'broker.test' \
+		'git.test' \
+		'8780' \
+		'8743' \
+		'' |
+		./install.sh >/dev/null 2>&1
+); then
+	printf 'FAIL: installer accepted a template path that was a directory\n' >&2
+	exit 1
+fi
+rmdir "${deployment}/deploy/nginx/templates/http.conf.template"
+mv "${deployment}/deploy/nginx/templates/http.conf.template.saved" \
+	"${deployment}/deploy/nginx/templates/http.conf.template"
+
 cat >"${mock_bin}/docker" <<'MOCK'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >>"$MOCK_DOCKER_LOG"
@@ -32,6 +52,12 @@ chmod +x "${mock_bin}/docker"
 export MOCK_DOCKER_LOG="${test_dir}/docker.log"
 export PATH="${mock_bin}:${PATH}"
 
+if grep -R '^[[:space:]]*keepalive_timeout[[:space:]]' \
+	"${TEST_ROOT}/deploy/nginx/templates/"*.template >/dev/null; then
+	printf 'FAIL: conf.d template duplicates nginx.conf keepalive_timeout\n' >&2
+	exit 1
+fi
+
 printf '%s\n' \
 	'broker.test' \
 	'git.test' \
@@ -82,4 +108,13 @@ assert_env 'GITEA_PUBLIC_URL=https://git.test/'
 assert_env 'SSL_MODE=none'
 assert_env 'TAPM_PUBLIC_URL=http://broker.test:8780'
 
+"${deployment}/manage.sh" rotate-cookie-secret >/dev/null
+rotated_secret="$(
+	sed -n 's/^TAPM_COOKIE_SECRET=//p' "${deployment}/.env"
+)"
+(( ${#rotated_secret} >= 32 )) || {
+	printf 'FAIL: cookie secret rotation produced a short value\n' >&2
+	exit 1
+}
+
 printf 'PASS: guided HTTP deployment and TLS transition\n'