tests/test_app.py

@@ -309,3 +309,16 @@ def test_proxy_route_endpoint_configures_caddy_and_dns(monkeypatch):
         ("caddy", "speed.guck.tv", "127.0.0.1:8080"),
         ("dns", "guck.tv", "speed"),
     ]
+
+
+def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch):
+    reads = iter([None, "refreshed-token"])
+    calls = []
+    monkeypatch.setattr(app, "_read", lambda _name: next(reads))
+    monkeypatch.setattr(app, "_load_vault_cache", lambda: calls.append("reload"))
+    monkeypatch.setattr(app, "_ssh", lambda host, command, timeout=600: (calls.append((host, command, timeout)) or (0, "vault-sync: ok", "")))
+
+    assert app._get_hetzner_dns_token() == "refreshed-token"
+    assert calls[0][0] == "sascha@10.4.1.116"
+    assert calls[0][1] == "sudo /app-config/homelab-butler/vault-sync.sh"
+    assert calls[1] == "reload"