Merge pull request #245852 from rnhmjoj/pr-fix-dnscrypt
dnscrypt-wrapper fixes
This commit is contained in:
commit
ccc33bd3d7
|
@ -71,9 +71,9 @@ let
|
||||||
if ! keyValid; then
|
if ! keyValid; then
|
||||||
echo "certificate soon to become invalid; backing up old cert"
|
echo "certificate soon to become invalid; backing up old cert"
|
||||||
mkdir -p oldkeys
|
mkdir -p oldkeys
|
||||||
mv -v ${cfg.providerName}.key oldkeys/${cfg.providerName}-$(date +%F-%T).key
|
mv -v "${cfg.providerName}.key" "oldkeys/${cfg.providerName}-$(date +%F-%T).key"
|
||||||
mv -v ${cfg.providerName}.crt oldkeys/${cfg.providerName}-$(date +%F-%T).crt
|
mv -v "${cfg.providerName}.crt" "oldkeys/${cfg.providerName}-$(date +%F-%T).crt"
|
||||||
systemctl restart dnscrypt-wrapper
|
kill "$(pidof -s dnscrypt-wrapper)"
|
||||||
fi
|
fi
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
@ -222,17 +222,6 @@ in {
|
||||||
};
|
};
|
||||||
users.groups.dnscrypt-wrapper = { };
|
users.groups.dnscrypt-wrapper = { };
|
||||||
|
|
||||||
security.polkit.extraConfig = ''
|
|
||||||
// Allow dnscrypt-wrapper user to restart dnscrypt-wrapper.service
|
|
||||||
polkit.addRule(function(action, subject) {
|
|
||||||
if (action.id == "org.freedesktop.systemd1.manage-units" &&
|
|
||||||
action.lookup("unit") == "dnscrypt-wrapper.service" &&
|
|
||||||
subject.user == "dnscrypt-wrapper") {
|
|
||||||
return polkit.Result.YES;
|
|
||||||
}
|
|
||||||
});
|
|
||||||
'';
|
|
||||||
|
|
||||||
systemd.services.dnscrypt-wrapper = {
|
systemd.services.dnscrypt-wrapper = {
|
||||||
description = "dnscrypt-wrapper daemon";
|
description = "dnscrypt-wrapper daemon";
|
||||||
after = [ "network.target" ];
|
after = [ "network.target" ];
|
||||||
|
@ -242,7 +231,7 @@ in {
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
User = "dnscrypt-wrapper";
|
User = "dnscrypt-wrapper";
|
||||||
WorkingDirectory = dataDir;
|
WorkingDirectory = dataDir;
|
||||||
Restart = "on-failure";
|
Restart = "always";
|
||||||
ExecStart = "${pkgs.dnscrypt-wrapper}/bin/dnscrypt-wrapper ${toString daemonArgs}";
|
ExecStart = "${pkgs.dnscrypt-wrapper}/bin/dnscrypt-wrapper ${toString daemonArgs}";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -255,7 +244,7 @@ in {
|
||||||
requires = [ "dnscrypt-wrapper.service" ];
|
requires = [ "dnscrypt-wrapper.service" ];
|
||||||
description = "Rotates DNSCrypt wrapper keys if soon to expire";
|
description = "Rotates DNSCrypt wrapper keys if soon to expire";
|
||||||
|
|
||||||
path = with pkgs; [ dnscrypt-wrapper dnscrypt-proxy1 gawk ];
|
path = with pkgs; [ dnscrypt-wrapper dnscrypt-proxy1 gawk procps ];
|
||||||
script = rotateKeys;
|
script = rotateKeys;
|
||||||
serviceConfig.User = "dnscrypt-wrapper";
|
serviceConfig.User = "dnscrypt-wrapper";
|
||||||
};
|
};
|
||||||
|
|
|
@ -217,7 +217,7 @@ in {
|
||||||
disable-installer-tools = handleTest ./disable-installer-tools.nix {};
|
disable-installer-tools = handleTest ./disable-installer-tools.nix {};
|
||||||
discourse = handleTest ./discourse.nix {};
|
discourse = handleTest ./discourse.nix {};
|
||||||
dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
|
dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
|
||||||
dnscrypt-wrapper = handleTestOn ["x86_64-linux"] ./dnscrypt-wrapper {};
|
dnscrypt-wrapper = runTestOn ["x86_64-linux"] ./dnscrypt-wrapper;
|
||||||
dnsdist = handleTest ./dnsdist.nix {};
|
dnsdist = handleTest ./dnsdist.nix {};
|
||||||
doas = handleTest ./doas.nix {};
|
doas = handleTest ./doas.nix {};
|
||||||
docker = handleTestOn ["aarch64-linux" "x86_64-linux"] ./docker.nix {};
|
docker = handleTestOn ["aarch64-linux" "x86_64-linux"] ./docker.nix {};
|
||||||
|
|
|
@ -1,4 +1,6 @@
|
||||||
import ../make-test-python.nix ({ pkgs, ... }: {
|
{ lib, pkgs, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
name = "dnscrypt-wrapper";
|
name = "dnscrypt-wrapper";
|
||||||
meta = with pkgs.lib.maintainers; {
|
meta = with pkgs.lib.maintainers; {
|
||||||
maintainers = [ rnhmjoj ];
|
maintainers = [ rnhmjoj ];
|
||||||
|
@ -50,23 +52,23 @@ import ../make-test-python.nix ({ pkgs, ... }: {
|
||||||
server.wait_for_unit("dnscrypt-wrapper")
|
server.wait_for_unit("dnscrypt-wrapper")
|
||||||
server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.key")
|
server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.key")
|
||||||
server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.crt")
|
server.wait_for_file("/var/lib/dnscrypt-wrapper/2.dnscrypt-cert.server.crt")
|
||||||
|
almost_expiration = server.succeed("date --date '4days 23 hours 56min'").strip()
|
||||||
|
|
||||||
with subtest("The client can connect to the server"):
|
with subtest("The client can connect to the server"):
|
||||||
server.wait_for_unit("tinydns")
|
server.wait_for_unit("tinydns")
|
||||||
client.wait_for_unit("dnscrypt-proxy2")
|
client.wait_for_unit("dnscrypt-proxy2")
|
||||||
assert "1.2.3.4" in client.succeed(
|
assert "1.2.3.4" in client.wait_until_succeeds(
|
||||||
"host it.works"
|
"host it.works"
|
||||||
), "The IP address of 'it.works' does not match 1.2.3.4"
|
), "The IP address of 'it.works' does not match 1.2.3.4"
|
||||||
|
|
||||||
with subtest("The server rotates the ephemeral keys"):
|
with subtest("The server rotates the ephemeral keys"):
|
||||||
# advance time by a little less than 5 days
|
# advance time by a little less than 5 days
|
||||||
server.succeed("date -s \"$(date --date '4 days 6 hours')\"")
|
server.succeed(f"date -s '{almost_expiration}'")
|
||||||
client.succeed("date -s \"$(date --date '4 days 6 hours')\"")
|
client.succeed(f"date -s '{almost_expiration}'")
|
||||||
server.wait_for_file("/var/lib/dnscrypt-wrapper/oldkeys")
|
server.wait_for_file("/var/lib/dnscrypt-wrapper/oldkeys")
|
||||||
|
|
||||||
with subtest("The client can still connect to the server"):
|
with subtest("The client can still connect to the server"):
|
||||||
server.wait_for_unit("dnscrypt-wrapper")
|
server.wait_for_unit("dnscrypt-wrapper")
|
||||||
client.succeed("host it.works")
|
client.succeed("host it.works")
|
||||||
'';
|
'';
|
||||||
})
|
}
|
||||||
|
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libsodium, libevent }:
|
{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libsodium, libevent, nixosTests }:
|
||||||
|
|
||||||
stdenv.mkDerivation rec {
|
stdenv.mkDerivation rec {
|
||||||
pname = "dnscrypt-wrapper";
|
pname = "dnscrypt-wrapper";
|
||||||
|
@ -13,9 +13,16 @@ stdenv.mkDerivation rec {
|
||||||
|
|
||||||
enableParallelBuilding = true;
|
enableParallelBuilding = true;
|
||||||
|
|
||||||
|
# causes `dnscrypt-wrapper --gen-provider-keypair` to crash
|
||||||
|
hardeningDisable = [ "fortify3" ];
|
||||||
|
|
||||||
nativeBuildInputs = [ pkg-config autoreconfHook ];
|
nativeBuildInputs = [ pkg-config autoreconfHook ];
|
||||||
buildInputs = [ libsodium libevent ];
|
buildInputs = [ libsodium libevent ];
|
||||||
|
|
||||||
|
passthru.tests = {
|
||||||
|
inherit (nixosTests) dnscrypt-wrapper;
|
||||||
|
};
|
||||||
|
|
||||||
meta = with lib; {
|
meta = with lib; {
|
||||||
description = "A tool for adding dnscrypt support to any name resolver";
|
description = "A tool for adding dnscrypt support to any name resolver";
|
||||||
homepage = "https://dnscrypt.info/";
|
homepage = "https://dnscrypt.info/";
|
||||||
|
|
Loading…
Reference in a new issue