Test upgrade to LDAP from upstream Mail-in-a-Box/sqlite

tests/system-setup/remote-nextcloud-docker.sh

@@ -27,9 +27,9 @@
 
 
 usage() {
-    echo "Usage: $(basename "$0") [\"before-miab-install\"|\"miab-install\"|\"after-miab-install\"]"
-    echo "Install MiaB-LDAP and a remote Nextcloud running under docker exposed as localhost:8000"
-    echo "With no arguments, all three stages are run."
+    echo "Usage: $(basename "$0")"
+    echo "Install MiaB-LDAP and a remote Nextcloud running under docker"
+    echo "Nextcloud is exposed as http://localhost:8000"
     exit 1
 }
 
@@ -40,10 +40,9 @@ if [ ! -d "tests/system-setup" ]; then
 fi
 
 # load helper scripts
-. "tests/system-setup/setup-defaults.sh" \
-    || die "Could not load setup-defaults"
-. "tests/system-setup/setup-funcs.sh" \
-    || die "Could not load setup-funcs"
+. "tests/lib/all.sh" "tests/lib" || die "Could not load lib scripts"
+. "tests/system-setup/setup-defaults.sh" || die "Could not load setup-defaults"
+. "tests/system-setup/setup-funcs.sh" || die "Could not load setup-funcs"
 
 # ensure running as root
 if [ "$EUID" != "0" ]; then
@@ -54,42 +53,15 @@ fi
 
 before_miab_install() {
     H1 "BEFORE MIAB-LDAP INSTALL"
-
-    H2 "Update /etc/hosts"
-    set_system_hostname || die "Could not set hostname"
-
-    # update system time
-    H2 "Set system time"
-    update_system_time || echo "Ignoring error..."
+    system_init
+    miab_testing_init || die "Initialization failed"
     
-    # update package lists before installing anything
-    H2 "apt-get update"
-    wait_for_apt
-    apt-get update -qq || die "apt-get update failed!"
-
-    # upgrade packages - if we don't do this and something like bind
-    # is upgraded through automatic upgrades (because maybe MiaB was
-    # previously installed), it may cause problems with the rest of
-    # the setup, such as with name resolution failures
-    if is_false "$TRAVIS"; then
-        H2 "apt-get upgrade"
-        wait_for_apt
-        apt-get upgrade -qq || die "apt-get upgrade failed!"
-    fi
-    
-    # install prerequisites
-    H2 "QA pre-setup prerequisites"
-    install_pre_setup_qa_prerequisites \
-        || die "Error installing QA prerequisites"
-
     # enable the remote Nextcloud setup mod, which tells MiaB-LDAP to use
     # the remote Nextcloud for calendar and contacts instead of the
     # MiaB-installed one
-    H2 "Create local/remote-nextcloud.sh symbolic link"
-    if [ ! -e "local/remote-nextcloud.sh" ]; then
-        mkdir -p local
-        ln -s "../setup/mods.available/remote-nextcloud.sh" "local/remote-nextcloud.sh" || die "Could not create remote-nextcloud.sh symlink"
-    fi
+    H2 "Enable local mod remote-nextcloud"
+    enable_miab_mod "remote-nextcloud" \
+        || die "Could not enable remote-nextcloud mod"
     
     # install Docker
     H2 "Install Docker"
@@ -101,7 +73,7 @@ miab_install() {
     H1 "MIAB-LDAP INSTALL"
     if ! setup/start.sh; then
         H1 "OUTPUT OF SELECT FILES"
-        dump_log "/var/log/syslog" 100
+        dump_file "/var/log/syslog" 100
         dump_conf_files "$TRAVIS"
         H2; H2 "End"; H2
         die "setup/start.sh failed!"
@@ -119,22 +91,28 @@ after_miab_install() {
     
     # run Nextcloud docker image
     H2 "Start Nextcloud docker container"
-    docker run -d --name NC -p 8000:80 \
-           --env SQLITE_DATABASE=nextclouddb.sqlite \
-           --env NEXTCLOUD_ADMIN_USER="$NC_ADMIN_USER" \
-           --env NEXTCLOUD_ADMIN_PASSWORD="$NC_ADMIN_PASSWORD" \
-           --env NEXTCLOUD_TRUSTED_DOMAINS="127.0.0.1 ::1" \
-           --env NEXTCLOUD_UPDATE=1 \
-           --env SMTP_HOST="$PRIMARY_HOSTNAME" \
-           --env SMTP_SECURE="tls" \
-           --env SMTP_PORT=587 \
-           --env SMTP_AUTHTYPE="LOGIN" \
-           --env SMTP_NAME="$EMAIL_ADDR" \
-           --env SMTP_PASSWORD="$EMAIL_PW" \
-           --env SMTP_FROM_ADDRESS="$(awk -F@ '{print $1}' <<< "$EMAIL_ADDR")" \
-           --env MAIL_DOMAIN="$(awk -F@ '{print $2}' <<< "$EMAIL_ADDR")" \
-           nextcloud:latest \
-        || die "Docker run failed!"
+    local container_started="true"
+    if [ -z "$(docker ps -f NAME=NC -q)" ]; then
+        docker run -d --name NC -p 8000:80 \
+               --env SQLITE_DATABASE=nextclouddb.sqlite \
+               --env NEXTCLOUD_ADMIN_USER="$NC_ADMIN_USER" \
+               --env NEXTCLOUD_ADMIN_PASSWORD="$NC_ADMIN_PASSWORD" \
+               --env NEXTCLOUD_TRUSTED_DOMAINS="127.0.0.1 ::1" \
+               --env NEXTCLOUD_UPDATE=1 \
+               --env SMTP_HOST="$PRIMARY_HOSTNAME" \
+               --env SMTP_SECURE="tls" \
+               --env SMTP_PORT=587 \
+               --env SMTP_AUTHTYPE="LOGIN" \
+               --env SMTP_NAME="$EMAIL_ADDR" \
+               --env SMTP_PASSWORD="$EMAIL_PW" \
+               --env SMTP_FROM_ADDRESS="$(email_localpart "$EMAIL_ADDR")" \
+               --env MAIL_DOMAIN="$(email_domainpart "$EMAIL_ADDR")" \
+               nextcloud:latest \
+            || die "Docker run failed!"
+    else
+        echo "Container already running"
+        container_started="false"
+    fi
 
     H2 "docker: Update /etc/hosts so it can find MiaB-LDAP by name"
     echo "$PRIVATE_IP $PRIMARY_HOSTNAME" | \
@@ -160,32 +138,20 @@ after_miab_install() {
 
     # wait for Nextcloud installation to complete
     H2 "Wait for Nextcloud installation to complete"
-    echo -n "Waiting ..."
-    local count=0
-    while true; do
-        if [ $count -ge 10 ]; then
-            echo "FAILED"
-            die "Giving up"
-        fi
-        sleep 6
-        let count+=1
-        if [ $(docker exec NC php -n -r "include 'config/config.php'; print \$CONFIG['installed']?'true':'false';") == "true" ]; then
-            echo "ok"
-            break
-        fi
-        echo -n "${count}..."
-    done
+    wait_for_docker_nextcloud NC installed || die "Giving up"
     
-    # install and enable Nextcloud and apps
+    # install and enable Nextcloud apps
     H2 "docker: install Nextcloud calendar app"
     docker exec -u www-data NC ./occ app:install calendar \
-        || die "docker: installing calendar app failed"
+        || $container_started \
+            && die "docker: installing calendar app failed ($?)"
     H2 "docker: install Nextcloud contacts app"
     docker exec -u www-data NC ./occ app:install contacts \
-        || die "docker: installing contacts app failed"
+        || $container_started \
+            && die "docker: installing contacts app failed ($?)"
     H2 "docker: enable user_ldap"
     docker exec -u www-data NC ./occ app:enable user_ldap \
-        || die "docker: enabling user_ldap failed"
+        || die "docker: enabling user_ldap failed ($?)"
 
     # integrate Nextcloud with MiaB-LDAP
     H2 "docker: integrate Nextcloud with MiaB-LDAP"
@@ -201,28 +167,26 @@ after_miab_install() {
 }
 
 
-
 #
-# process command line
+# Main
 #
-
-case "$1" in
-    before-miab-install )
+case "${1:-all}" in
+    before-install )
         before_miab_install
         ;;
-    after-miab-install )
-        after_miab_install
-        ;;
-    miab-install )
+    install )
         miab_install
         ;;
-    "" )
+    after-install )
+        after_miab_install
+        ;;
+    all )
         before_miab_install
         miab_install
         after_miab_install
         ;;
     * )
-        
         usage
         ;;
 esac
+

tests/system-setup/setup-defaults.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Used by MiaB-LDAP setup/start.sh
+# Used by setup/start.sh
 export NONINTERACTIVE=${NONINTERACTIVE:-1}
 export SKIP_NETWORK_CHECKS=${SKIP_NETWORK_CHECKS:-1}
 export STORAGE_USER="${STORAGE_USER:-user-data}"
@@ -15,7 +15,6 @@ elif [ -z "$PRIMARY_HOSTNAME" ]; then
     export PRIMARY_HOSTNAME=${PRIMARY_HOSTNAME:-$(hostname --fqdn || hostname)}
 fi
 
-
 # Placing this var in STORAGE_ROOT/ldap/miab_ldap.conf before running
 # setup/start.sh will avoid a random password from being used for the
 # Nextcloud LDAP service account
@@ -28,6 +27,9 @@ export NC_HOST=${NC_HOST:-127.0.0.1}
 export NC_PORT=${NC_PORT:-8000}
 export NC_PREFIX=${NC_PREFIX:-/}
 
-# For setup scripts that are installing a remote Nextcloud
+# For setup scripts that may be installing a remote Nextcloud
 export NC_ADMIN_USER="${NC_ADMIN_USER:-admin}"
 export NC_ADMIN_PASSWORD="${NC_ADMIN_PASSWORD:-Test_1234}"
+
+# For setup scripts that install upstream versions
+export MIAB_UPSTREAM_GIT="https://github.com/mail-in-a-box/mailinabox.git"

tests/system-setup/setup-funcs.sh

@@ -1,4 +1,9 @@
 
+#
+# requires:
+#
+#   test scripts: [ lib/misc.sh, lib/system.sh ]
+#
 
 die() {
     local msg="$1"
@@ -25,64 +30,28 @@ H2() {
     fi
 }
 
-dump_log() {
-    local log_file="$1"
-    local lines="$2"
-    local title="DUMP OF $log_file"
-    echo ""
-    echo "--------"
-    echo -n "-------- $log_file"
-    if [ ! -z "$lines" ]; then
-        echo " (last $line lines)"
-    else
-        echo ""
-    fi
-    echo "--------"
-      
-    if [ ! -z "$lines" ]; then
-        tail -$lines "$log_file"
-    else
-        cat "$log_file"
-    fi
-}
 
-is_true() {
-    # empty string is not true
-    if [ "$1" == "true" \
-              -o "$1" == "TRUE" \
-              -o "$1" == "True" \
-              -o "$1" == "yes" \
-              -o "$1" == "YES" \
-              -o "$1" == "Yes" \
-              -o "$1" == "1" ]
-    then
-        return 0
-    else
-        return 1
-    fi
-}
-
-is_false() {
-    if is_true $@; then return 1; fi
+wait_for_docker_nextcloud() {
+    local container="$1"
+    local config_key="$2"
+    echo -n "Waiting ..."
+    local count=0
+    while true; do
+        if [ $count -ge 10 ]; then
+            echo "FAILED"
+            return 1
+        fi
+        sleep 6
+        let count+=1
+        if [ $(docker exec "$container" php -n -r "include 'config/config.php'; print \$CONFIG['$config_key']?'true':'false';") == "true" ]; then
+            echo "ok"
+            break
+        fi
+        echo -n "${count}..."
+    done
     return 0
 }
 
-wait_for_apt() {
-    local count=0
-    while fuser /var/lib/dpkg/lock >/dev/null 2>&1 || fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do
-        sleep 6
-        let count+=1
-        if [ $count -eq 1 ]; then
-            echo -n "Waiting for other package manager to finish..."
-        elif [ $count -gt 100 ]; then
-            echo -n "FAILED"
-            return 1
-        else
-            echo -n "${count}.."
-        fi
-    done
-    [ $count -ge 1 ] && echo ""
-}
 
 dump_conf_files() {
     local skip
@@ -98,99 +67,58 @@ dump_conf_files() {
         done
     fi
     if [ "$skip" == "false" ]; then
-        dump_log "/etc/mailinabox.conf"
-        dump_log "/etc/hosts"
-        dump_log "/etc/nsswitch.conf"
-        dump_log "/etc/resolv.conf"
-        dump_log "/etc/nsd/nsd.conf"
-        dump_log "/etc/postfix/main.cf"
+        dump_file "/etc/mailinabox.conf"
+        dump_file_if_exists "/etc/mailinabox_mods.conf"
+        dump_file "/etc/hosts"
+        dump_file "/etc/nsswitch.conf"
+        dump_file "/etc/resolv.conf"
+        dump_file "/etc/nsd/nsd.conf"
+        #dump_file "/etc/postfix/main.cf"
     fi
 }
 
 
-update_system_time() {
-    if [ ! -x /usr/sbin/ntpdate ]; then
+
+#
+# Initialize the test system
+#   hostname, time, apt update/upgrade, etc
+#
+system_init() {
+    H2 "Update /etc/hosts"
+    set_system_hostname || die "Could not set hostname"
+
+    # update system time
+    H2 "Set system time"
+    update_system_time || echo "Ignoring error..."
+    
+    # update package lists before installing anything
+    H2 "apt-get update"
+    wait_for_apt
+    apt-get update -qq || die "apt-get update failed!"
+
+    # upgrade packages - if we don't do this and something like bind
+    # is upgraded through automatic upgrades (because maybe MiaB was
+    # previously installed), it may cause problems with the rest of
+    # the setup, such as with name resolution failures
+    if is_false "$TRAVIS"; then
+        H2 "apt-get upgrade"
         wait_for_apt
-        apt-get install -y -qq ntpdate || return 1
+        apt-get upgrade -qq || die "apt-get upgrade failed!"
     fi
-    ntpdate -s ntp.ubuntu.com && echo "System time updated"
-}
-
-update_hosts() {
-    local host="$1"
-    shift
-    local ip
-    for ip; do
-        if [ ! -z "$ip" ]; then
-            local line="$ip $host"
-            if ! grep -F "$line" /etc/hosts 1>/dev/null; then
-                echo "$line" >>/etc/hosts
-            fi
-        fi
-    done
-}
-
-update_hosts_for_private_ip() {
-    # create /etc/hosts entry for PRIVATE_IP and PRIVATE_IPV6
-    # PRIMARY_HOSTNAME must already be set
-    local ip4=$(source setup/functions.sh; get_default_privateip 4)
-    local ip6=$(source setup/functions.sh; get_default_privateip 6)
-    [ -z "$ip4" -a -z "$ip6" ] && return 1
-    [ -z "$ip6" ] && ip6="::1"
-    update_hosts "$PRIMARY_HOSTNAME" "$ip4" "$ip6" || return 1
-}
-
-set_system_hostname() {
-    # set the system hostname to the FQDN specified or
-    # PRIMARY_HOSTNAME if no FQDN was given
-    local fqdn="${1:-$PRIMARY_HOSTNAME}"
-    local host="$(awk -F. '{print $1}' <<< "$fqdn")"
-    sed -i 's/^127\.0\.1\.1[ \t].*/127.0.1.1 '"$fqdn $host ip4-loopback/" /etc/hosts || return 1
-    #hostname "$host" || return 1
-    #echo "$host" > /etc/hostname
-    return 0
 }
 
 
-install_docker() {
-    if [ -x /usr/bin/docker ]; then
-        echo "Docker already installed"
-        return 0
-    fi
-    
-    wait_for_apt
-    apt-get install -y -qq \
-            apt-transport-https \
-            ca-certificates \
-            curl \
-            gnupg-agent \
-            software-properties-common \
-        || return 1
-       
-    wait_for_apt
-    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
-        || return 2
-    
-    wait_for_apt
-    apt-key fingerprint 0EBFCD88 || return 3
-    
-    wait_for_apt
-    add-apt-repository -y --update "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" || return 4
-    
-    wait_for_apt
-    apt-get install -y -qq \
-            docker-ce \
-            docker-ce-cli \
-            containerd.io \
-        || return 5
-}
-
-
-install_pre_setup_qa_prerequisites() {
+#
+# Initialize the test system with QA prerequisites
+# Anything needed to use the test runner, speed up the installation,
+# etc
+#
+miab_testing_init() {
     [ -z "$STORAGE_ROOT" ] \
         && echo "Error: STORAGE_ROOT not set" 1>&2 \
         && return 1
 
+    H2 "QA prerequisites"
     local rc=0
     
     # python3-dnspython: is used by the python scripts in 'tests' and is
@@ -221,22 +149,20 @@ install_pre_setup_qa_prerequisites() {
 }
 
 
-travis_fix_nsd() {
-    if [ "$TRAVIS" != "true" ]; then
-        return 0
+enable_miab_mod() {
+    local name="${1}.sh"
+    if [ ! -e "local/$name" ]; then
+        mkdir -p local
+        ln -s "../setup/mods.available/$name" "local/$name"
     fi
-    
-    # nsd won't start on Travis-CI without the changes below: ip6 off and
-    # control-enable set to no. Even though the nsd docs say the
-    # default value for control-enable is no, running "nsd-checkconf -o
-    # control-enable /etc/nsd/nsd.conf" returns "yes", so we explicitly
-    # set it here.
-    #
-    # we're assuming that the "ip-address" line is the last line in the
-    # "server" section of nsd.conf. if this generated file output
-    # changes, the sed command below may need to be adjusted.
-    sed -i 's/ip-address\(.\)\(.*\)/ip-address\1\2\n  do-ip4\1 yes\n  do-ip6\1 no\n  verbosity\1 3\nremote-control\1\n  control-enable\1 no/' /etc/nsd/nsd.conf || return 1
-    cat /etc/nsd/nsd.conf
-    systemctl reset-failed nsd.service || return 2
-    systemctl restart nsd.service || return 3
 }
+
+tag_from_readme() {
+    # extract the recommended TAG from README.md
+    # sets a global "TAG"
+    local readme="${1:-README.md}"
+    TAG="$(grep -F 'git checkout' "$readme" | sed 's/.*\(v[0123456789]*\.[0123456789]*\).*/\1/')"
+    [ $? -ne 0 -o -z "$TAG" ] && return 1
+    return 0
+}
+

tests/system-setup/upgrade-from-upstream.sh

@@ -0,0 +1,289 @@
+#!/bin/bash
+
+# setup MiaB-LDAP by:
+#    1. installing upstream MiaB
+#    2. adding some data (users/aliases/etc)
+#    3. upgrading to MiaB-LDAP
+#
+# See setup-defaults.sh for usernames and passwords.
+#
+
+
+usage() {
+    echo "Usage: $(basename "$0")"
+    echo "Install MiaB-LDAP after installing upstream MiaB"
+    exit 1
+}
+
+# ensure working directory
+if [ ! -d "tests/system-setup" ]; then
+    echo "This script must be run from the MiaB root directory"
+    exit 1
+fi
+
+# load helper scripts
+. "tests/lib/all.sh" "tests/lib" || die "Could not load lib scripts"
+. "tests/system-setup/setup-defaults.sh" || die "Could not load setup-defaults"
+. "tests/system-setup/setup-funcs.sh" || die "Could not load setup-funcs"
+
+# ensure running as root
+if [ "$EUID" != "0" ]; then
+    die "This script must be run as root (sudo)"
+fi
+
+
+before_install() {
+    H1 "INIT"
+    system_init
+    miab_testing_init || die "Initialization failed"
+}
+
+upstream_install() {
+    local upstream_dir="$HOME/mailinabox-upstream"
+    H1 "INSTALL UPSTREAM"
+    [ ! -x /usr/bin/git ] && apt-get install -y -qq git
+    
+    if [ ! -d "$upstream_dir" ] || [ -z "$(ls -A "$upstream_dir")" ] ; then
+        H2 "Cloning $MIAB_UPSTREAM_GIT"
+        rm -rf "$upstream_dir"
+        git clone "$MIAB_UPSTREAM_GIT" "$upstream_dir"
+        if [ $? -ne 0 ]; then
+            rm -rf "$upstream_dir"
+            die "git clone upstream failed!"
+        fi
+        if [ -z "$TAG" ]; then
+            tag_from_readme "$upstream_dir/README.md"
+            if [ $? -ne 0 ]; then
+                rm -rf "$upstream_dir"
+                die "Failed to extract TAG from $upstream_dir/README.md"
+            fi
+        fi
+    fi
+
+    pushd "$upstream_dir" >/dev/null
+    if [ ! -z "$TAG" ]; then
+        H2 "Checkout $TAG"
+        git checkout "$TAG" || die "git checkout $TAG failed"
+    fi
+    
+    H2 "Run upstream setup"
+    setup/start.sh || die "Upstream setup failed!"
+    popd >/dev/null
+    
+    H2 "Upstream info"
+    echo "Code version: $(git describe)"
+    echo "Migration version: $(cat "$STORAGE_ROOT/mailinabox.version")"
+}
+
+
+add_data() {
+    H1 "Add some Mail-in-a-Box data"
+    local users=()
+    users+="betsy@$(email_domainpart "$EMAIL_ADDR")"
+
+    local alises=()
+    aliases+="goalias@testdom.com > ${users[0]}"
+    aliases+="nested@testdom.com > goalias@testdom.com"
+
+    local pw="$(generate_qa_password)"
+
+
+    #
+    # get the existing users and aliases
+    #
+    local current_users=() current_aliases=()
+    local user alias
+    if ! rest_urlencoded GET /admin/mail/users "$EMAIL_ADDR" "$EMAIL_PW" --insecure 2>/dev/null; then
+        die "Unable to enumerate users: rc=$? err=$REST_ERROR"
+    fi
+    for user in $REST_OUTPUT; do
+        current_users+=("$user")
+    done
+
+    if ! rest_urlencoded GET /admin/mail/aliases "$EMAIL_ADDR" "$EMAIL_PW" --insecure 2>/dev/null; then
+        die "Unable to enumerate aliases: rc=$? err=$REST_ERROR"
+    fi
+    for alias in $REST_OUTPUT; do
+        current_aliases+=("$alias")
+    done
+
+    
+    #
+    # add users
+    #
+    for user in "${users[@]}"; do
+        if array_contains "$user" "${current_users[@]}"; then
+            echo "Not adding user $user: already exists"
+
+        elif ! rest_urlencoded POST /admin/mail/users/add "$EMAIL_ADDR" "$EMAIL_PW" --insecure -- "email=$user" "password=$pw" 2>/dev/null
+        then
+            die "Unable to add user $user: rc=$? err=$REST_ERROR"
+        fi
+    done
+
+    #
+    # add aliases
+    #
+    local aliasdef
+    for aliasdef in "${aliases[@]}"; do
+        alias="$(awk -F'[> ]' '{print $1}' <<<"$aliasdef")"
+        local forwards_to="$(sed 's/.*> *\(.*\)/\1/' <<<"$aliasdef")"
+        if array_contains "$alias" "${current_aliases[@]}"; then
+            echo "Not adding alias $alias: already exists"
+            
+        elif ! rest_urlencoded POST /admin/mail/aliases/add "$EMAIL_ADDR" "$EMAIL_PW" --insecure -- "address=$alias" "forwards_to=$forwards_to" 2>/dev/null
+        then 
+            die "Unable to add alias $alias: rc=$? err=$REST_ERROR"
+        fi
+    done
+}
+
+capture_state() {
+    # users and aliases lists
+    # dns zone files
+    # tls certificates: expected CN's
+
+    local state_dir="$1"
+    local infojson="$state_dir/info.json"
+
+    H1 "Capture server state to $state_dir"
+    
+    # nuke saved state, if any
+    rm -rf "$state_dir"
+    mkdir -p "$state_dir"
+
+    # create info.json
+    H2 "create info.json"
+    echo "VERSION='$(git describe --abbrev=0)'" >"$infojson"
+    echo "MIGRATION_VERSION=$(cat "$STORAGE_ROOT/mailinabox.version")" >>"$infojson"
+
+    # record users
+    H2 "record users"
+    rest_urlencoded GET "/admin/mail/users?format=json" "$EMAIL_ADDR" "$EMAIL_PW" --insecure 2>/dev/null \
+        || die "Unable to get users: rc=$? err=$REST_ERROR"
+    echo "$REST_OUTPUT" > "$state_dir/users.json"
+
+    # record aliases
+    H2 "record aliases"
+    rest_urlencoded GET "/admin/mail/aliases?format=json" "$EMAIL_ADDR" "$EMAIL_PW" --insecure 2>/dev/null \
+        || die "Unable to get aliases: rc=$? err=$REST_ERROR"
+    echo "$REST_OUTPUT" > "$state_dir/aliases.json"
+
+    # record dns config
+    H2 "record dns details"
+    local file
+    mkdir -p "$state_dir/zones"
+    for file in ls /etc/nsd/zones/*.signed; do
+        cp "$file" "$state_dir/zones"
+    done
+    
+}
+
+miab_ldap_install() {
+    # ensure we're in a MiaB-LDAP working directory
+    if [ ! -e setup/ldap.sh ]; then
+        die "The working directory is not MiaB-LDAP!"
+    fi
+    setup/start.sh -v || die "Upgrade to MiaB-LDAP failed !!!!!!"
+}
+
+compare_state() {
+    local s1="$1"
+    local s2="$2"
+    
+    local output
+    local changed="false"
+
+    H1 "COMPARE STATES $(basename "$s1") TO $(basename "$2")"
+    H2 "Users"
+    # users
+    output="$(diff "$s1/users.json" "$s2/users.json" 2>&1)"
+    if [ $? -ne 0 ]; then
+        changed="true"
+        echo "USERS ARE DIFFERENT!"
+        echo "$output"
+    else
+        echo "OK"
+    fi
+
+    H2 "Aliases"
+    output="$(diff "$s1/aliases.json" "$s2/aliases.json" 2>&1)"
+    if [ $? -ne 0 ]; then
+        change="true"
+        echo "ALIASES ARE DIFFERENT!"
+        echo "$output"
+    else
+        echo "OK"
+    fi
+
+    H2 "DNS - zones missing"
+    local zone
+    for zone in $(cd "$s1/zones"; ls *.signed); do
+        if [ ! -e "$s2/zones/$zone" ]; then
+            echo "MISSING zone: $zone"
+            changed="true"
+        fi
+    done
+
+    H2 "DNS - zones added"
+    for zone in $(cd "$s2/zones"; ls *.signed); do
+        if [ ! -e "$s2/zones/$zone" ]; then
+            echo "ADDED zone: $zone"
+            changed="true"
+        fi
+    done
+
+    H2 "DNS - zones changed"
+    for zone in $(cd "$s1/zones"; ls *.signed); do
+        if [ -e "$s2/zones/$zone" ]; then
+            output="$(diff "$s1/zones/$zone" "$s2/zones/$zone" 2>&1)"
+            if [ $? -ne 0 ]; then
+                echo "CHANGED zone: $zone"
+                echo "$output"
+                changed="true"
+            fi
+        fi
+    done
+
+    if $changed; then
+        return 1
+    else
+        return 0
+    fi
+}
+
+
+if [ "$1" == "c" ]; then
+    capture_state "tests/system-setup/state/miab-ldap"
+    exit $?
+fi
+
+
+# install basic stuff, set the hostname, time, etc
+before_install
+
+# if MiaB-LDAP is already migrated, do not run upstream setup
+if [ -e "$STORAGE_ROOT/mailinabox.version" ] &&
+       [ $(cat "$STORAGE_ROOT/mailinabox.version") -ge 13 ]
+then
+    echo "Warning: MiaB-LDAP is already installed! Skipping installation of upstream"
+else
+    # install upstream
+    upstream_install
+    add_data
+    capture_state "tests/system-setup/state/upstream"
+fi
+
+# install miab-ldap
+miab_ldap_install
+capture_state "tests/system-setup/state/miab-ldap"
+
+# compare states
+if ! compare_state "tests/system-setup/state/upstream" "tests/system-setup/state/miab-ldap"; then
+    die "Upstream and upgraded states are different !"
+fi
+
+#
+# actual verification that mail sends/receives properly is done via
+# the test runner ...
+#