Validate server compose env fragments

scripts/validate-server-production-env.ps1

@@ -87,6 +87,21 @@ function Require-Secret([hashtable]$Values, [string]$Key) {
     }
 }
 
+function Require-ExactValue([hashtable]$Values, [string]$Key, [string]$ExpectedValue) {
+    $value = Get-EnvValue $Values $Key
+    if ($value -ne $ExpectedValue) {
+        Add-Error "$Key must be $ExpectedValue."
+    }
+}
+
+function Test-ComposeFileIncludes([string]$ComposeFile, [string]$EnvKey, [string]$Fragment) {
+    if ([string]::IsNullOrWhiteSpace($ComposeFile)) {
+        return $false
+    }
+
+    return $ComposeFile.Contains($Fragment) -or $ComposeFile.Contains('${' + $EnvKey + ':-}')
+}
+
 $resolvedEnvPath = (Resolve-Path -LiteralPath $EnvPath -ErrorAction Stop).Path
 $values = Read-EnvFile $resolvedEnvPath
 
@@ -113,11 +128,27 @@ if ([string]::IsNullOrWhiteSpace($dockerTag) -or $dockerTag -eq "latest" -or ($d
     Add-Error "OC_DOCKER_TAG must pin a concrete production release tag."
 }
 
+Require-ExactValue $values "COMPOSE_PATH_SEPARATOR" ":"
+
+$composeFile = Get-EnvValue $values "COMPOSE_FILE"
+if ([string]::IsNullOrWhiteSpace($composeFile) -or -not $composeFile.Contains("docker-compose.yml")) {
+    Add-Error "COMPOSE_FILE must include docker-compose.yml."
+}
+
 if (-not (Test-Enabled $values "QSFERA")) {
     Add-Error "QSFERA=:qsfera.yml must be enabled."
+} else {
+    Require-ExactValue $values "QSFERA" ":qsfera.yml"
+    if (-not (Test-ComposeFileIncludes $composeFile "QSFERA" "qsfera.yml")) {
+        Add-Error "COMPOSE_FILE must include qsfera.yml or the `${QSFERA:-} expansion."
+    }
 }
 
 if (Test-Enabled $values "DECOMPOSEDS3") {
+    Require-ExactValue $values "DECOMPOSEDS3" ":decomposeds3.yml"
+    if (-not (Test-ComposeFileIncludes $composeFile "DECOMPOSEDS3" "decomposeds3.yml")) {
+        Add-Error "COMPOSE_FILE must include decomposeds3.yml or the `${DECOMPOSEDS3:-} expansion when DECOMPOSEDS3 is enabled."
+    }
     Require-Value $values "DECOMPOSEDS3_ENDPOINT"
     Require-Value $values "DECOMPOSEDS3_REGION"
     Require-Secret $values "DECOMPOSEDS3_ACCESS_KEY"
@@ -127,9 +158,16 @@ if (Test-Enabled $values "DECOMPOSEDS3") {
 
 if (Test-Enabled $values "DECOMPOSEDS3_MINIO") {
     Add-Error "DECOMPOSEDS3_MINIO is for test/lab installs and must not be enabled for public production."
+    if (-not (Test-ComposeFileIncludes $composeFile "DECOMPOSEDS3_MINIO" "minio.yml")) {
+        Add-Error "COMPOSE_FILE must include minio.yml or the `${DECOMPOSEDS3_MINIO:-} expansion when DECOMPOSEDS3_MINIO is enabled."
+    }
 }
 
 if (Test-Enabled $values "KEYCLOAK") {
+    Require-ExactValue $values "KEYCLOAK" ":keycloak.yml"
+    if (-not (Test-ComposeFileIncludes $composeFile "KEYCLOAK" "keycloak.yml")) {
+        Add-Error "COMPOSE_FILE must include keycloak.yml or the `${KEYCLOAK:-} expansion when KEYCLOAK is enabled."
+    }
     Require-Value $values "KEYCLOAK_DOMAIN"
     Require-Value $values "KEYCLOAK_REALM"
     Require-Secret $values "KEYCLOAK_POSTGRES_PASSWORD"