Proves apps are viewable, not just that a pod is Running. Verifies real ingress + TLS + rendered UI through WebKit — Safari's engine (hard constraint).

Layout

playwright.config.ts — WebKit-only project, video + trace + screenshot always on.
targets.ts — the app list (NAME-APP.<BASE_DOMAIN>) + per-app "ready" selector. Edit to match your ingress hosts.
tests/reachability.spec.ts — every non-auth app: 2xx/3xx + own-UI rendered (not nginx default backend).
tests/portainer.spec.ts — login page renders.
tests/authentik.spec.ts — full admin sign-in (needs AK_ADMIN_PASSWORD).
tests/oauth.spec.ts — OIDC/OAuth federation flow per app: app → Authentik → back, authenticated. Driven by OAUTH_TARGETS in targets.ts; uses helpers/authentik.ts.
Dockerfile / run-and-upload.sh — container image; runs suite, uploads artifacts to MinIO, exits with the suite's real code.

Run locally

cd tests/e2e
npm install
npx playwright install webkit
BASE_DOMAIN=riotpiao.com npm test          # add E2E_IGNORE_TLS=1 for staging certs
AK_ADMIN_PASSWORD=… npm test               # to exercise the authentik login
npm run report                              # open HTML report (video/trace)

Env

Var	Default	Purpose
`BASE_DOMAIN`	`riotpiao.com`	domain suffix for `NAME.<domain>`
`E2E_IGNORE_TLS`	`0`	`1` = accept staging/self-signed certs (bootstrap only)
`AK_ADMIN_USER` / `AK_ADMIN_PASSWORD`	`akadmin` / —	authentik login (password from secret store)
`MINIO_ENDPOINT` / `MINIO_BUCKET` / `MINIO_ACCESS_KEY` / `MINIO_SECRET_KEY`	—	artifact upload target

In-cluster

k8s/platform/e2e/ has a Job (deploy gate — attach as ArgoCD PostSync hook or Rollouts AnalysisTemplate) and a CronJob (continuous smoke, alert on failure). Both need a e2e-credentials Secret (authentik password + MinIO keys) — create it SOPS-encrypted. Not yet wired into any kustomization / app-of-apps — that is ADR 0001 migration phase 7.

Build image

docker build -t <registry>/riotpiao.com/homelab-e2e:$(git rev-parse --short HEAD) tests/e2e
docker push  <registry>/riotpiao.com/homelab-e2e:…