tests: create keycloak test, add working test for website
Co-authored-by: b12f <b12f@noreply.git.pub.solar> Co-authored-by: Hendrik Sokolowski <hensoko@noreply.git.pub.solar>
This commit is contained in:
parent
b6be95d032
commit
701c62dd69
23
flake.nix
23
flake.nix
|
@ -65,6 +65,7 @@
|
|||
system,
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
{
|
||||
|
@ -77,6 +78,27 @@
|
|||
unstable = import inputs.unstable { inherit system; };
|
||||
master = import inputs.master { inherit system; };
|
||||
};
|
||||
|
||||
checks =
|
||||
let
|
||||
nixos-lib = import (inputs.nixpkgs + "/nixos/lib") { };
|
||||
testDir = builtins.attrNames (builtins.readDir ./tests);
|
||||
testFiles = builtins.filter (n: builtins.match "^.*.nix$" n != null) testDir;
|
||||
in
|
||||
builtins.listToAttrs (
|
||||
map (x: {
|
||||
name = "test-${lib.strings.removeSuffix ".nix" x}";
|
||||
value = nixos-lib.runTest (
|
||||
import (./tests + "/${x}") {
|
||||
inherit self;
|
||||
inherit pkgs;
|
||||
inherit lib;
|
||||
inherit config;
|
||||
}
|
||||
);
|
||||
}) testFiles
|
||||
);
|
||||
|
||||
devShells.default = pkgs.mkShell {
|
||||
buildInputs = with pkgs; [
|
||||
deploy-rs
|
||||
|
@ -95,6 +117,7 @@
|
|||
jq
|
||||
];
|
||||
};
|
||||
|
||||
devShells.ci = pkgs.mkShell { buildInputs = with pkgs; [ nodejs ]; };
|
||||
};
|
||||
|
||||
|
|
|
@ -6,7 +6,7 @@
|
|||
...
|
||||
}:
|
||||
{
|
||||
nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ];
|
||||
nixpkgs.config = lib.mkDefault { allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ]; };
|
||||
|
||||
nix = {
|
||||
# Use default version alias for nix package
|
||||
|
|
92
tests/keycloak.nix
Normal file
92
tests/keycloak.nix
Normal file
|
@ -0,0 +1,92 @@
|
|||
{
|
||||
self,
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
in
|
||||
{
|
||||
name = "keycloak";
|
||||
|
||||
hostPkgs = pkgs;
|
||||
|
||||
node.pkgs = pkgs;
|
||||
node.specialArgs = self.outputs.nixosConfigurations.nachtigall._module.specialArgs;
|
||||
|
||||
nodes = {
|
||||
acme-server = {
|
||||
imports = [
|
||||
self.nixosModules.home-manager
|
||||
self.nixosModules.core
|
||||
./support/ca.nix
|
||||
];
|
||||
};
|
||||
|
||||
client = {
|
||||
imports = [
|
||||
self.nixosModules.home-manager
|
||||
self.nixosModules.core
|
||||
./support/client.nix
|
||||
];
|
||||
};
|
||||
|
||||
nachtigall = {
|
||||
imports = [
|
||||
self.inputs.agenix.nixosModules.default
|
||||
self.nixosModules.home-manager
|
||||
self.nixosModules.core
|
||||
self.nixosModules.backups
|
||||
self.nixosModules.nginx
|
||||
self.nixosModules.keycloak
|
||||
self.nixosModules.postgresql
|
||||
./support/global.nix
|
||||
];
|
||||
|
||||
systemd.tmpfiles.rules = [ "f /tmp/dbf 1777 root root 10d password" ];
|
||||
|
||||
virtualisation.memorySize = 4096;
|
||||
|
||||
pub-solar-os.auth = {
|
||||
enable = true;
|
||||
database-password-file = "/tmp/dbf";
|
||||
};
|
||||
services.keycloak.database.createLocally = true;
|
||||
|
||||
networking.interfaces.eth0.ipv4.addresses = [
|
||||
{
|
||||
address = "192.168.1.3";
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
testScript =
|
||||
{ nodes, ... }:
|
||||
let
|
||||
user = nodes.client.users.users.${nodes.client.pub-solar-os.authentication.username};
|
||||
#uid = toString user.uid;
|
||||
bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u ${user.name})/bus";
|
||||
gdbus = "${bus} gdbus";
|
||||
su = command: "su - ${user.name} -c '${command}'";
|
||||
gseval = "call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval";
|
||||
wmClass = su "${gdbus} ${gseval} global.display.focus_window.wm_class";
|
||||
in
|
||||
''
|
||||
start_all()
|
||||
|
||||
nachtigall.wait_for_unit("system.slice")
|
||||
nachtigall.succeed("ping 127.0.0.1 -c 2")
|
||||
nachtigall.wait_for_unit("nginx.service")
|
||||
nachtigall.wait_for_unit("keycloak.service")
|
||||
nachtigall.wait_until_succeeds("curl http://127.0.0.1:8080/")
|
||||
nachtigall.wait_until_succeeds("curl https://auth.test.pub.solar/")
|
||||
|
||||
client.wait_for_unit("system.slice")
|
||||
client.sleep(30)
|
||||
# client.wait_until_succeeds("${wmClass} | grep -q 'firefox'")
|
||||
client.screenshot("screen")
|
||||
'';
|
||||
}
|
47
tests/support/ca.nix
Normal file
47
tests/support/ca.nix
Normal file
|
@ -0,0 +1,47 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ ./global.nix ];
|
||||
|
||||
systemd.tmpfiles.rules = [ "f /tmp/step-ca-intermediate-pw 1777 root root 10d password" ];
|
||||
|
||||
networking.interfaces.eth0.ipv4.addresses = [
|
||||
{
|
||||
address = "192.168.1.1";
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
|
||||
services.step-ca =
|
||||
let
|
||||
certificates = pkgs.stdenv.mkDerivation {
|
||||
name = "certificates";
|
||||
src = ./step;
|
||||
installPhase = ''
|
||||
mkdir -p $out;
|
||||
cp -r certs $out/
|
||||
cp -r secrets $out/
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
intermediatePasswordFile = "/tmp/step-ca-intermediate-pw";
|
||||
port = 443;
|
||||
address = "0.0.0.0";
|
||||
settings = (builtins.fromJSON (builtins.readFile ./step/config/ca.json)) // {
|
||||
root = "${certificates}/certs/root_ca.crt";
|
||||
crt = "${certificates}/certs/intermediate_ca.crt";
|
||||
key = "${certificates}/secrets/intermediate_ca_key";
|
||||
db = {
|
||||
type = "badgerv2";
|
||||
dataSource = "/var/lib/step-ca/db";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
35
tests/support/client.nix
Normal file
35
tests/support/client.nix
Normal file
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
imports = [ ./global.nix ];
|
||||
|
||||
services.xserver.enable = true;
|
||||
services.xserver.displayManager.gdm.enable = true;
|
||||
services.xserver.desktopManager.gnome.enable = true;
|
||||
services.xserver.displayManager.autoLogin.enable = true;
|
||||
services.xserver.displayManager.autoLogin.user = config.pub-solar-os.authentication.username;
|
||||
|
||||
systemd.user.services = {
|
||||
"org.gnome.Shell@wayland" = {
|
||||
serviceConfig = {
|
||||
ExecStart = [
|
||||
# Clear the list before overriding it.
|
||||
""
|
||||
# Eval API is now internal so Shell needs to run in unsafe mode.
|
||||
"${pkgs.gnome.gnome-shell}/bin/gnome-shell --unsafe-mode"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.interfaces.eth0.ipv4.addresses = [
|
||||
{
|
||||
address = "192.168.1.2";
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
}
|
50
tests/support/global.nix
Normal file
50
tests/support/global.nix
Normal file
|
@ -0,0 +1,50 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
pub-solar-os.networking.domain = "test.pub.solar";
|
||||
|
||||
security.acme.defaults.server = "https://ca.${config.pub-solar-os.networking.domain}/acme/acme/directory";
|
||||
|
||||
security.pki.certificates = [ (builtins.readFile ./step/certs/root_ca.crt) ];
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
PermitRootLogin = lib.mkForce "yes";
|
||||
PermitEmptyPasswords = lib.mkForce "yes";
|
||||
PasswordAuthentication = lib.mkForce true;
|
||||
};
|
||||
};
|
||||
|
||||
security.pam.services.sshd.allowNullPassword = true;
|
||||
|
||||
virtualisation.forwardPorts =
|
||||
let
|
||||
address = (builtins.elemAt config.networking.interfaces.eth0.ipv4.addresses 0).address;
|
||||
lastAddressPart = builtins.elemAt (lib.strings.splitString "." address) 3;
|
||||
in
|
||||
[
|
||||
{
|
||||
from = "host";
|
||||
host.port = 2000 + (lib.strings.toInt lastAddressPart);
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
|
||||
networking.interfaces.eth0.useDHCP = false;
|
||||
|
||||
networking.hosts = {
|
||||
"192.168.1.1" = [ "ca.${config.pub-solar-os.networking.domain}" ];
|
||||
"192.168.1.2" = [ "client.${config.pub-solar-os.networking.domain}" ];
|
||||
"192.168.1.3" = [
|
||||
"${config.pub-solar-os.networking.domain}"
|
||||
"www.${config.pub-solar-os.networking.domain}"
|
||||
"auth.${config.pub-solar-os.networking.domain}"
|
||||
];
|
||||
};
|
||||
}
|
13
tests/support/step/certs/intermediate_ca.crt
Normal file
13
tests/support/step/certs/intermediate_ca.crt
Normal file
|
@ -0,0 +1,13 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIB4DCCAYagAwIBAgIQVR/3c0swvc/ifeYqLQn3HTAKBggqhkjOPQQDAjA6MRcw
|
||||
FQYDVQQKEw5wdWIuc29sYXItdGVzdDEfMB0GA1UEAxMWcHViLnNvbGFyLXRlc3Qg
|
||||
Um9vdCBDQTAeFw0yNDA4MjQwMTI3MTBaFw0zNDA4MjIwMTI3MTBaMEIxFzAVBgNV
|
||||
BAoTDnB1Yi5zb2xhci10ZXN0MScwJQYDVQQDEx5wdWIuc29sYXItdGVzdCBJbnRl
|
||||
cm1lZGlhdGUgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATpCjy3PAiawAeb
|
||||
47ZZ9kPXuuV0EavOfFlgnlZBkOc2AXY0R6P1jK06US0SiPo17rqyNgUWH0oV4v8i
|
||||
/HbZYNXYo2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAd
|
||||
BgNVHQ4EFgQU1hueYsLAH6+wxjArqCM3IHFqnIEwHwYDVR0jBBgwFoAUxg/BmKK7
|
||||
9Zs+b1bvlpYwggy5lnswCgYIKoZIzj0EAwIDSAAwRQIgfxkjyC4HHADRmNDLqZ5L
|
||||
0po+JD5/9b1L//JoXG+vgXECIQDgkRe8r8/0Ep/NWgBtbkA3oTYq8vCwo1FewBZZ
|
||||
43fo5w==
|
||||
-----END CERTIFICATE-----
|
12
tests/support/step/certs/root_ca.crt
Normal file
12
tests/support/step/certs/root_ca.crt
Normal file
|
@ -0,0 +1,12 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIBuDCCAV2gAwIBAgIQMXg7xoEIrVjgvKcrRaxo0DAKBggqhkjOPQQDAjA6MRcw
|
||||
FQYDVQQKEw5wdWIuc29sYXItdGVzdDEfMB0GA1UEAxMWcHViLnNvbGFyLXRlc3Qg
|
||||
Um9vdCBDQTAeFw0yNDA4MjQwMTI3MDlaFw0zNDA4MjIwMTI3MDlaMDoxFzAVBgNV
|
||||
BAoTDnB1Yi5zb2xhci10ZXN0MR8wHQYDVQQDExZwdWIuc29sYXItdGVzdCBSb290
|
||||
IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYNxMcHclQP/zv2y6LJIGx9pg
|
||||
Q2337Zb8TuPY+DnL1MjuCMoeTaMwngzjU/DSbKL0Vx/y+I+PBjhHmPrYcGDcSKNF
|
||||
MEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
|
||||
FMYPwZiiu/WbPm9W75aWMIIMuZZ7MAoGCCqGSM49BAMCA0kAMEYCIQDcgr9WyR1C
|
||||
806aEQ38alYgGg3PhQdT14q47tWIUOnpygIhAM0x/QK/mm7VvQxBLAA4DT6X730m
|
||||
k/tBvh9SHNbwPxCt
|
||||
-----END CERTIFICATE-----
|
44
tests/support/step/config/ca.json
Normal file
44
tests/support/step/config/ca.json
Normal file
|
@ -0,0 +1,44 @@
|
|||
{
|
||||
"federatedRoots": null,
|
||||
"address": ":443",
|
||||
"insecureAddress": "",
|
||||
"dnsNames": ["ca.test.pub.solar"],
|
||||
"logger": {
|
||||
"format": "text"
|
||||
},
|
||||
"db": {
|
||||
"type": "badgerv2",
|
||||
"badgerFileLoadingMode": ""
|
||||
},
|
||||
"authority": {
|
||||
"provisioners": [
|
||||
{
|
||||
"name": "acme",
|
||||
"type": "ACME"
|
||||
},
|
||||
{
|
||||
"type": "JWK",
|
||||
"name": "test.pub.solar",
|
||||
"key": {
|
||||
"use": "sig",
|
||||
"kty": "EC",
|
||||
"kid": "lM-BJXRwwQcdgxLqAS4Za23A2YatZpwXx-PP5NIt8JM",
|
||||
"crv": "P-256",
|
||||
"alg": "ES256",
|
||||
"x": "ouB2mP04Kt8rDa10C8ZzYyzA36rrz-k0c4_ud1hVjyg",
|
||||
"y": "RbXKcudQRPEFqjG_5AxuqCQXn7pyRToQCwC4MrwLVUQ"
|
||||
},
|
||||
"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiNWR5T2puR2Y5aFFNRlc1U25fRWhzUSJ9.a3xtSBuMmzZCMsdfHAXMgFpe9bq8A6bGGOoW9F2Gw7AhxL4bG-AlgA.IA68rSJSGTAKnaVS.XDQc4da-8D9Ykfw-8S4uphsauq5gsEm4qp7zKQUIvcjUlnPAtiHP3xiiBie29ncdg8rKmyzprEEOpTNvXtQl7LsPsHXyKV3SqsTnJecvim9YXGDneAHyWe-XF6hyCZAfSoFbFMgLDKR6d44hMht3ueazL_TPlkFUBLrJbsW782MfdfF3nzcaDf_JDuhKsKHDmKqZyNXDzwf6rINe8adrf5gqaLM2_sGhk7i3XyXygn8HHVw1Dj_w2gPOVm4MS7CO_NgikPqAtGuXDhpWZfXte-FlnMO6d9xQF67b0cwB8kmColPSp1zRiCKPAk9vof8Nn-gGE_aw8zxPi0CJkoY.xbuqSSspgLc_Uw17uiRF7Q"
|
||||
}
|
||||
]
|
||||
},
|
||||
"tls": {
|
||||
"cipherSuites": [
|
||||
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
|
||||
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||
],
|
||||
"minVersion": 1.2,
|
||||
"maxVersion": 1.3,
|
||||
"renegotiation": false
|
||||
}
|
||||
}
|
6
tests/support/step/config/defaults.json
Normal file
6
tests/support/step/config/defaults.json
Normal file
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
"ca-url": "https://ca.test.pub.solar",
|
||||
"ca-config": "/home/b12f/.step/config/ca.json",
|
||||
"fingerprint": "4d6a1a918355380acbd0256a2203d0a0da8436bb788e8f19326589045c3cd842",
|
||||
"root": "/home/b12f/.step/certs/root_ca.crt"
|
||||
}
|
8
tests/support/step/secrets/intermediate_ca_key
Normal file
8
tests/support/step/secrets/intermediate_ca_key
Normal file
|
@ -0,0 +1,8 @@
|
|||
-----BEGIN EC PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: AES-256-CBC,0b34c00cb76ffc16441f5fe762d8d915
|
||||
|
||||
xJQ5r5kGiaG6rCsmVnONxm99sqceb62dO8/YvgdZ/ouHAxz1OlXYpTJNd2GvezAc
|
||||
XA6Zx6eGzNCOyhgMNJTXEn8QmcJcMd6OjVLxQ9Tr2Mi3LShcBzMPs30/X2XYsM22
|
||||
5G4fRhQD0L4nQ08B3GG6FjPe/HYmkRNZmAeDc2wE5Fg=
|
||||
-----END EC PRIVATE KEY-----
|
8
tests/support/step/secrets/root_ca_key
Normal file
8
tests/support/step/secrets/root_ca_key
Normal file
|
@ -0,0 +1,8 @@
|
|||
-----BEGIN EC PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: AES-256-CBC,48f59a57e5a2b81359e0a3668161b61e
|
||||
|
||||
jMZbpiHSFa74ns30QrAnIlcguqWp+FE20cXbiIVPpLAJpzGskc3k5vRFTpPM8geg
|
||||
sZ6bVvq3APbKmkopxZHWpd4ly6uHkolbtR1NFxTNKymaJZuSuKspUmDohkIyZN6c
|
||||
KG0upERMZIOg6Ky1JiM5pLJMHBTsCmzJBmdFCW7GSww=
|
||||
-----END EC PRIVATE KEY-----
|
|
@ -8,17 +8,52 @@
|
|||
{
|
||||
name = "website";
|
||||
|
||||
nodes.nachtigall-test = self.nixosConfigurations.nachtigall-test;
|
||||
|
||||
node.specialArgs = self.outputs.nixosConfigurations.nachtigall._module.specialArgs;
|
||||
hostPkgs = pkgs;
|
||||
|
||||
enableOCR = true;
|
||||
node.pkgs = pkgs;
|
||||
node.specialArgs = self.outputs.nixosConfigurations.nachtigall._module.specialArgs;
|
||||
|
||||
nodes = {
|
||||
acme-server = {
|
||||
imports = [
|
||||
self.nixosModules.home-manager
|
||||
self.nixosModules.core
|
||||
./support/ca.nix
|
||||
];
|
||||
};
|
||||
|
||||
nachtigall = {
|
||||
imports = [
|
||||
self.nixosModules.home-manager
|
||||
self.nixosModules.core
|
||||
self.nixosModules.nginx
|
||||
self.nixosModules.nginx-website
|
||||
./support/global.nix
|
||||
];
|
||||
|
||||
virtualisation.memorySize = 4096;
|
||||
|
||||
networking.interfaces.eth0.ipv4.addresses = [
|
||||
{
|
||||
address = "192.168.1.3";
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
machine.wait_for_unit("system.slice")
|
||||
machine.succeed("ping 127.0.0.1 -c 2")
|
||||
machine.wait_for_unit("nginx.service")
|
||||
machine.succeed("curl -H 'Host:pub.solar' http://127.0.0.1/")
|
||||
start_all()
|
||||
|
||||
acme_server.wait_for_unit("system.slice")
|
||||
acme_server.wait_for_unit("step-ca.service")
|
||||
acme_server.succeed("ping ca.test.pub.solar -c 2")
|
||||
acme_server.wait_until_succeeds("curl 127.0.0.1:443")
|
||||
|
||||
nachtigall.wait_for_unit("system.slice")
|
||||
nachtigall.succeed("ping test.pub.solar -c 2")
|
||||
nachtigall.succeed("ping ca.test.pub.solar -c 2")
|
||||
nachtigall.wait_for_unit("nginx.service")
|
||||
nachtigall.wait_until_succeeds("curl https://test.pub.solar/")
|
||||
'';
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue