From 760d6e345822a0d880391b0f792131a9bb117e68 Mon Sep 17 00:00:00 2001 From: b12f Date: Wed, 28 Aug 2024 23:54:59 +0200 Subject: [PATCH] tests/keycloak: email sending works --- hosts/metronom/default.nix | 1 + hosts/metronom/email.nix | 45 ++++++ hosts/nachtigall/test-vm.nix | 53 -------- modules/mail/default.nix | 66 +++------ tests/keycloak.nix | 65 ++------- tests/support/{ca.nix => acme-server.nix} | 14 +- tests/support/client.nix | 14 +- tests/support/dns-server.nix | 70 ++++++++++ tests/support/global.nix | 31 ++--- tests/support/keycloak-realm-export/README.md | 2 +- .../keycloak-realm-export/realm-export.json | 128 +++++++++--------- .../keycloak-realm-export/src/index.mjs | 14 +- tests/support/mail-server.nix | 27 ++++ tests/website.nix | 8 +- 14 files changed, 269 insertions(+), 269 deletions(-) create mode 100644 hosts/metronom/email.nix delete mode 100644 hosts/nachtigall/test-vm.nix rename tests/support/{ca.nix => acme-server.nix} (86%) create mode 100644 tests/support/dns-server.nix create mode 100644 tests/support/mail-server.nix diff --git a/hosts/metronom/default.nix b/hosts/metronom/default.nix index a1699f1..a6b523c 100644 --- a/hosts/metronom/default.nix +++ b/hosts/metronom/default.nix @@ -7,6 +7,7 @@ ./networking.nix ./wireguard.nix + ./email.nix #./backups.nix ]; } diff --git a/hosts/metronom/email.nix b/hosts/metronom/email.nix new file mode 100644 index 0000000..71f3798 --- /dev/null +++ b/hosts/metronom/email.nix @@ -0,0 +1,45 @@ +{ config, flake, ... }: { + age.secrets.mail-hensoko.file = "${flake.self}/secrets/mail/hensoko.age"; + age.secrets.mail-teutat3s.file = "${flake.self}/secrets/mail/teutat3s.age"; + age.secrets.mail-admins.file = "${flake.self}/secrets/mail/admins.age"; + age.secrets.mail-bot.file = "${flake.self}/secrets/mail/bot.age"; + age.secrets.mail-crew.file = "${flake.self}/secrets/mail/crew.age"; + age.secrets.mail-erpnext.file = "${flake.self}/secrets/mail/erpnext.age"; + age.secrets.mail-hakkonaut.file = "${flake.self}/secrets/mail/hakkonaut.age"; + + mailserver = { + # A list of all login accounts. To create the password hashes, use + # nix-shell -p mkpasswd --run 'mkpasswd -R11 -m bcrypt' + loginAccounts = { + "admins@${config.pub-solar-os.networking.domain}" = { + hashedPasswordFile = config.age.secrets.mail-admins.path; + }; + "hakkonaut@${config.pub-solar-os.networking.domain}" = { + hashedPasswordFile = config.age.secrets.mail-hakkonaut.path; + }; + + "hensoko@pub.solar" = { + hashedPasswordFile = config.age.secrets.mail-hensoko.path; + quota = "2G"; + }; + "teutat3s@pub.solar" = { + hashedPasswordFile = config.age.secrets.mail-teutat3s.path; + quota = "2G"; + }; + "bot@pub.solar" = { + hashedPasswordFile = config.age.secrets.mail-bot.path; + quota = "2G"; + aliases = [ "hackernews-bot@pub.solar" ]; + }; + "crew@pub.solar" = { + hashedPasswordFile = config.age.secrets.mail-crew.path; + quota = "2G"; + aliases = [ "moderation@pub.solar" ]; + }; + "erpnext@pub.solar" = { + hashedPasswordFile = config.age.secrets.mail-erpnext.path; + quota = "2G"; + }; + }; + }; +} diff --git a/hosts/nachtigall/test-vm.nix b/hosts/nachtigall/test-vm.nix deleted file mode 100644 index ff0e4dc..0000000 --- a/hosts/nachtigall/test-vm.nix +++ /dev/null @@ -1,53 +0,0 @@ -{ flake, lib, ... }: - -{ - imports = [ - ./backups.nix - ./apps/nginx.nix - - ./apps/collabora.nix - ./apps/coturn.nix - ./apps/forgejo.nix - ./apps/keycloak.nix - ./apps/mailman.nix - ./apps/mastodon.nix - ./apps/mediawiki.nix - ./apps/nextcloud.nix - ./apps/nginx-mastodon.nix - ./apps/nginx-mastodon-files.nix - ./apps/nginx-prometheus-exporters.nix - ./apps/nginx-website.nix - ./apps/nginx-website-miom.nix - ./apps/opensearch.nix - ./apps/owncast.nix - ./apps/postgresql.nix - ./apps/prometheus-exporters.nix - ./apps/promtail.nix - ./apps/searx.nix - ./apps/tmate.nix - - ./apps/matrix/irc.nix - ./apps/matrix/mautrix-telegram.nix - ./apps/matrix/synapse.nix - ./apps/nginx-matrix.nix - ]; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - - security.acme.defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory"; - security.acme.preliminarySelfsigned = true; - - networking.useDHCP = true; - networking.interfaces."enp35s0".ipv4.addresses = [ - { - address = "10.0.0.1"; - prefixLength = 26; - } - ]; - networking.interfaces."enp35s0".ipv6.addresses = [ - { - address = "2a01:4f8:172:1c25::1"; - prefixLength = 64; - } - ]; -} diff --git a/modules/mail/default.nix b/modules/mail/default.nix index 9b28816..cfbfe87 100644 --- a/modules/mail/default.nix +++ b/modules/mail/default.nix @@ -1,62 +1,28 @@ -{ config, flake, ... }: - -{ - age.secrets.mail-hensoko.file = "${flake.self}/secrets/mail/hensoko.age"; - age.secrets.mail-teutat3s.file = "${flake.self}/secrets/mail/teutat3s.age"; - age.secrets.mail-admins.file = "${flake.self}/secrets/mail/admins.age"; - age.secrets.mail-bot.file = "${flake.self}/secrets/mail/bot.age"; - age.secrets.mail-crew.file = "${flake.self}/secrets/mail/crew.age"; - age.secrets.mail-erpnext.file = "${flake.self}/secrets/mail/erpnext.age"; - age.secrets.mail-hakkonaut.file = "${flake.self}/secrets/mail/hakkonaut.age"; - +{ config, ... }: { mailserver = { enable = true; - fqdn = "mail.pub.solar"; - domains = [ "pub.solar" ]; + fqdn = "mail.${config.pub-solar-os.networking.domain}"; + domains = [ config.pub-solar-os.networking.domain ]; # A list of all login accounts. To create the password hashes, use # nix-shell -p mkpasswd --run 'mkpasswd -R11 -m bcrypt' loginAccounts = { - "hensoko@pub.solar" = { - hashedPasswordFile = config.age.secrets.mail-hensoko.path; - quota = "2G"; - }; - "teutat3s@pub.solar" = { - hashedPasswordFile = config.age.secrets.mail-teutat3s.path; - quota = "2G"; - }; - "admins@pub.solar" = { - hashedPasswordFile = config.age.secrets.mail-admins.path; + "admins@${config.pub-solar-os.networking.domain}" = { quota = "2G"; aliases = [ - "abuse@pub.solar" - "alerts@pub.solar" - "forgejo@pub.solar" - "keycloak@pub.solar" - "mastodon-notifications@pub.solar" - "matrix@pub.solar" - "postmaster@pub.solar" - "nextcloud@pub.solar" - "no-reply@pub.solar" - "security@pub.solar" + "abuse@${config.pub-solar-os.networking.domain}" + "alerts@${config.pub-solar-os.networking.domain}" + "forgejo@${config.pub-solar-os.networking.domain}" + "keycloak@${config.pub-solar-os.networking.domain}" + "mastodon-notifications@${config.pub-solar-os.networking.domain}" + "matrix@${config.pub-solar-os.networking.domain}" + "postmaster@${config.pub-solar-os.networking.domain}" + "nextcloud@${config.pub-solar-os.networking.domain}" + "no-reply@${config.pub-solar-os.networking.domain}" + "security@${config.pub-solar-os.networking.domain}" ]; }; - "bot@pub.solar" = { - hashedPasswordFile = config.age.secrets.mail-bot.path; - quota = "2G"; - aliases = [ "hackernews-bot@pub.solar" ]; - }; - "crew@pub.solar" = { - hashedPasswordFile = config.age.secrets.mail-crew.path; - quota = "2G"; - aliases = [ "moderation@pub.solar" ]; - }; - "erpnext@pub.solar" = { - hashedPasswordFile = config.age.secrets.mail-erpnext.path; - quota = "2G"; - }; - "hakkonaut@pub.solar" = { - hashedPasswordFile = config.age.secrets.mail-hakkonaut.path; + "hakkonaut@${config.pub-solar-os.networking.domain}" = { quota = "2G"; }; }; @@ -66,5 +32,5 @@ certificateScheme = "acme-nginx"; }; security.acme.acceptTerms = true; - security.acme.defaults.email = "security@pub.solar"; + security.acme.defaults.email = "security@${config.pub-solar-os.networking.domain}"; } diff --git a/tests/keycloak.nix b/tests/keycloak.nix index 815d975..b189391 100644 --- a/tests/keycloak.nix +++ b/tests/keycloak.nix @@ -1,5 +1,6 @@ { self, + system, pkgs, lib, config, @@ -20,21 +21,10 @@ in node.specialArgs = self.outputs.nixosConfigurations.nachtigall._module.specialArgs; nodes = { - acme-server = { - imports = [ - self.nixosModules.home-manager - self.nixosModules.core - ./support/ca.nix - ]; - }; - - client = { - imports = [ - self.nixosModules.home-manager - self.nixosModules.core - ./support/client.nix - ]; - }; + dns-server.imports = [ ./support/dns-server.nix ]; + acme-server.imports = [ ./support/acme-server.nix ]; + mail-server.imports = [ ./support/mail-server.nix ]; + client.imports = [ ./support/client.nix ]; nachtigall = { imports = [ @@ -57,63 +47,30 @@ in database-password-file = "/tmp/dbf"; }; services.keycloak.database.createLocally = true; - - networking.interfaces.eth0.ipv4.addresses = [ - { - address = "192.168.1.3"; - prefixLength = 32; - } - ]; + services.keycloak.initialAdminPassword = "password"; }; }; - testScript = - { ... }: '' + testScript = { ... }: '' def puppeteer_run(cmd): client.succeed(f'puppeteer-run \'{cmd}\' ') start_all() + acme_server.wait_for_unit("system.slice") + mail_server.wait_for_unit("dovecot2.service") + mail_server.wait_for_unit("postfix.service") nachtigall.wait_for_unit("system.slice") nachtigall.succeed("ping 127.0.0.1 -c 2") nachtigall.wait_for_unit("nginx.service") - nachtigall.systemctl("stop keycloak.service") - nachtigall.wait_until_succeeds("if (($(ps aux | grep 'Dkc.home.dir=/run/keycloak' | grep -v grep | wc -l) == 0)); then true; else false; fi") - nachtigall.succeed("${pkgs.keycloak}/bin/kc.sh --verbose import --optimized --file=${realm-export}") - nachtigall.systemctl("start keycloak.service") - nachtigall.sleep(30) nachtigall.wait_until_succeeds("curl http://127.0.0.1:8080/") nachtigall.wait_until_succeeds("curl https://auth.test.pub.solar/") + nachtigall.succeed("${pkgs.keycloak}/bin/kcadm.sh create realms -f ${realm-export} --server http://localhost:8080 --realm master --user admin --password password --no-config") client.wait_for_unit("system.slice") client.wait_for_file("/tmp/puppeteer.sock") - puppeteer_run('page.goto("https://auth.test.pub.solar/admin/master/console")') - puppeteer_run('page.waitForNetworkIdle()') - client.screenshot("admin-initial") - puppeteer_run('page.locator("[name=username]").fill("admin")') - puppeteer_run('page.locator("::-p-text(Sign In)").click()') - puppeteer_run('page.waitForNetworkIdle()') - client.screenshot("admin-password") - puppeteer_run('page.locator("[name=password]").fill("password")') - puppeteer_run('page.locator("::-p-text(Sign In)").click()') - puppeteer_run('page.waitForNetworkIdle()') - client.screenshot("admin-login") - puppeteer_run('page.locator("::-p-text(Realm settings)").click()') - puppeteer_run('page.waitForNetworkIdle()') - client.screenshot("admin-theme") - puppeteer_run('page.locator("::-p-text(Themes)").click()') - puppeteer_run('page.waitForNetworkIdle()') - puppeteer_run('page.locator("#kc-login-theme").click()') - client.screenshot("admin-theme-changed") - puppeteer_run('page.locator("li button::-p-text(pub.solar)").click()') - puppeteer_run('page.locator("::-p-text(Save)").click()') - puppeteer_run('page.waitForNetworkIdle()') - client.screenshot("admin-theme-saved") - - - puppeteer_run('page.goto("https://auth.test.pub.solar")') puppeteer_run('page.waitForNetworkIdle()') client.screenshot("initial") diff --git a/tests/support/ca.nix b/tests/support/acme-server.nix similarity index 86% rename from tests/support/ca.nix rename to tests/support/acme-server.nix index 632c610..2ff408a 100644 --- a/tests/support/ca.nix +++ b/tests/support/acme-server.nix @@ -1,21 +1,19 @@ { + flake, pkgs, lib, config, ... }: { - imports = [ ./global.nix ]; + imports = [ + flake.self.nixosModules.home-manager + flake.self.nixosModules.core + ./global.nix + ]; systemd.tmpfiles.rules = [ "f /tmp/step-ca-intermediate-pw 1777 root root 10d password" ]; - networking.interfaces.eth0.ipv4.addresses = [ - { - address = "192.168.1.1"; - prefixLength = 32; - } - ]; - services.step-ca = let certificates = pkgs.stdenv.mkDerivation { diff --git a/tests/support/client.nix b/tests/support/client.nix index 43ad235..ddc8457 100644 --- a/tests/support/client.nix +++ b/tests/support/client.nix @@ -1,4 +1,5 @@ { + flake, pkgs, lib, config, @@ -9,7 +10,11 @@ let puppeteer-run = (pkgs.callPackage (import ./puppeteer-socket/puppeteer-run.nix) { }); in { - imports = [ ./global.nix ]; + imports = [ + flake.self.nixosModules.home-manager + flake.self.nixosModules.core + ./global.nix + ]; security.polkit.enable = true; @@ -41,11 +46,4 @@ in }; }; }; - - networking.interfaces.eth0.ipv4.addresses = [ - { - address = "192.168.1.2"; - prefixLength = 32; - } - ]; } diff --git a/tests/support/dns-server.nix b/tests/support/dns-server.nix new file mode 100644 index 0000000..c4a4abc --- /dev/null +++ b/tests/support/dns-server.nix @@ -0,0 +1,70 @@ +{ + config, + flake, + lib, + ... +}: { + imports = [ + flake.self.nixosModules.home-manager + flake.self.nixosModules.core + ./global.nix + ]; + + networking.nameservers = lib.mkForce [ + "193.110.81.0" #dns0.eu + "2a0f:fc80::" #dns0.eu + "185.253.5.0" #dns0.eu + "2a0f:fc81::" #dns0.eu + ]; + + services.resolved.enable = lib.mkForce false; + + networking.firewall.allowedUDPPorts = [53]; + networking.firewall.allowedTCPPorts = [53]; + + networking.interfaces.eth1.ipv4.addresses = [ + { + address = "192.168.1.254"; + prefixLength = 32; + } + ]; + + services.unbound = { + enable = true; + settings = { + server = { + interface = [ + "192.168.1.254" + ]; + access-control = [ + "0.0.0.0/0 allow" + ]; + local-zone = [ + "\"pub.solar\" transparent" + ]; + local-data = [ + "\"mail.${config.pub-solar-os.networking.domain}. 10800 IN CNAME mail-server\"" + "\"ca.${config.pub-solar-os.networking.domain}. 10800 IN CNAME acme-server\"" + "\"${config.pub-solar-os.networking.domain}. 10800 IN CNAME nachtigall\"" + "\"www.${config.pub-solar-os.networking.domain}. 10800 IN CNAME nachtigall\"" + "\"auth.${config.pub-solar-os.networking.domain}. 10800 IN CNAME nachtigall\"" + ]; + + tls-cert-bundle = "/etc/ssl/certs/ca-certificates.crt"; + }; + + forward-zone = [ + { + name = "."; + forward-addr = [ + "193.110.81.0#dns0.eu" + "2a0f:fc80::#dns0.eu" + "185.253.5.0#dns0.eu" + "2a0f:fc81::#dns0.eu" + ]; + forward-tls-upstream = "yes"; + } + ]; + }; + }; +} diff --git a/tests/support/global.nix b/tests/support/global.nix index f5e68c9..8736b4e 100644 --- a/tests/support/global.nix +++ b/tests/support/global.nix @@ -23,28 +23,13 @@ security.pam.services.sshd.allowNullPassword = true; - virtualisation.forwardPorts = - let - address = (builtins.elemAt config.networking.interfaces.eth0.ipv4.addresses 0).address; - lastAddressPart = builtins.elemAt (lib.strings.splitString "." address) 3; - in - [ - { - from = "host"; - host.port = 2000 + (lib.strings.toInt lastAddressPart); - guest.port = 22; - } - ]; + services.resolved.extraConfig = lib.mkForce '' + DNS=192.168.1.254 + Domains=~. + ''; - networking.interfaces.eth0.useDHCP = false; - - networking.hosts = { - "192.168.1.1" = [ "ca.${config.pub-solar-os.networking.domain}" ]; - "192.168.1.2" = [ "client.${config.pub-solar-os.networking.domain}" ]; - "192.168.1.3" = [ - "${config.pub-solar-os.networking.domain}" - "www.${config.pub-solar-os.networking.domain}" - "auth.${config.pub-solar-os.networking.domain}" - ]; - }; + environment.systemPackages = [ + pkgs.dig + ]; } + diff --git a/tests/support/keycloak-realm-export/README.md b/tests/support/keycloak-realm-export/README.md index 3edceaa..c3f71f7 100644 --- a/tests/support/keycloak-realm-export/README.md +++ b/tests/support/keycloak-realm-export/README.md @@ -2,4 +2,4 @@ 1. Export realm settings from keycloak, you'll get a file called `realm-export.json`. 2. Install dependencies for this package: `npm ci` -3. Clean the exported file: `npm start $downloadedExportJSON > realm-export.json +3. Clean the exported file: `node src/index.mjs $downloadedExportJSON > realm-export.json diff --git a/tests/support/keycloak-realm-export/realm-export.json b/tests/support/keycloak-realm-export/realm-export.json index aa76b76..63fd58c 100644 --- a/tests/support/keycloak-realm-export/realm-export.json +++ b/tests/support/keycloak-realm-export/realm-export.json @@ -1,6 +1,6 @@ { "id": "8cd6ddbb-d0d3-40ff-9f1e-efdfce05fa6e", - "realm": "test.test.pub.solar", + "realm": "test.pub.solar", "notBefore": 0, "defaultSignatureAlgorithm": "RS256", "revokeRefreshToken": false, @@ -57,7 +57,7 @@ }, { "id": "2e271b49-ed2b-4dc0-a578-47e7571a2934", - "name": "default-roles-test.test.pub.solar", + "name": "default-roles-test.pub.solar", "description": "${role_default-roles}", "composite": true, "composites": { @@ -434,7 +434,7 @@ "groups": [], "defaultRole": { "id": "2e271b49-ed2b-4dc0-a578-47e7571a2934", - "name": "default-roles-test.test.pub.solar", + "name": "default-roles-test.pub.solar", "description": "${role_default-roles}", "composite": true, "clientRole": false, @@ -494,7 +494,7 @@ "disableableCredentialTypes": [], "requiredActions": [], "realmRoles": [ - "default-roles-test.test.pub.solar" + "default-roles-test.pub.solar" ], "clientRoles": { "realm-management": [ @@ -533,7 +533,7 @@ "disableableCredentialTypes": [], "requiredActions": [], "realmRoles": [ - "default-roles-test.test.pub.solar" + "default-roles-test.pub.solar" ], "clientRoles": { "matrix": [ @@ -571,13 +571,13 @@ "description": "", "rootUrl": "${authBaseUrl}", "adminUrl": "", - "baseUrl": "/realms/test.test.pub.solar/account/", + "baseUrl": "/realms/test.pub.solar/account/", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "redirectUris": [ - "/realms/test.test.pub.solar/account/*" + "/realms/test.pub.solar/account/*" ], "webOrigins": [], "notBefore": 0, @@ -628,13 +628,13 @@ "description": "", "rootUrl": "${authBaseUrl}", "adminUrl": "", - "baseUrl": "/realms/test.test.pub.solar/account/", + "baseUrl": "/realms/test.pub.solar/account/", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "redirectUris": [ - "/realms/test.test.pub.solar/account/*" + "/realms/test.pub.solar/account/*" ], "webOrigins": [], "notBefore": 0, @@ -829,19 +829,19 @@ "clientId": "gitea", "name": "", "description": "", - "rootUrl": "https://git.test.test.pub.solar", - "adminUrl": "https://git.test.test.pub.solar", - "baseUrl": "https://git.test.test.pub.solar", + "rootUrl": "https://git.test.pub.solar", + "adminUrl": "https://git.test.pub.solar", + "baseUrl": "https://git.test.pub.solar", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "secret": "secret", "redirectUris": [ - "https://git.test.test.pub.solar/*" + "https://git.test.pub.solar/*" ], "webOrigins": [ - "https://git.test.test.pub.solar" + "https://git.test.pub.solar" ], "notBefore": 0, "bearerOnly": false, @@ -889,9 +889,9 @@ "id": "b016fab5-bced-404a-93ba-c084d360701f", "clientId": "grafana", "name": "", - "description": "https://grafana.test.test.pub.solar", - "rootUrl": "https://grafana.test.test.pub.solar", - "adminUrl": "https://grafana.test.test.pub.solar", + "description": "https://grafana.test.pub.solar", + "rootUrl": "https://grafana.test.pub.solar", + "adminUrl": "https://grafana.test.pub.solar", "baseUrl": "/login/generic_oauth", "surrogateAuthRequired": false, "enabled": true, @@ -899,10 +899,10 @@ "clientAuthenticatorType": "client-secret", "secret": "secret", "redirectUris": [ - "https://grafana.test.test.pub.solar/login/generic_oauth" + "https://grafana.test.pub.solar/login/generic_oauth" ], "webOrigins": [ - "https://grafana.test.test.pub.solar" + "https://grafana.test.pub.solar" ], "notBefore": 0, "bearerOnly": false, @@ -945,9 +945,9 @@ "clientId": "mastodon", "name": "mastodon", "description": "", - "rootUrl": "https://mastodon.test.test.pub.solar", + "rootUrl": "https://mastodon.test.pub.solar", "adminUrl": "", - "baseUrl": "https://mastodon.test.test.pub.solar", + "baseUrl": "https://mastodon.test.pub.solar", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, @@ -955,10 +955,10 @@ "secret": "secret", "redirectUris": [ "", - "https://mastodon.test.test.pub.solar/auth/auth/openid_connect/callback" + "https://mastodon.test.pub.solar/auth/auth/openid_connect/callback" ], "webOrigins": [ - "https://mastodon.test.test.pub.solar/auth/openid_connect/callback" + "https://mastodon.test.pub.solar/auth/openid_connect/callback" ], "notBefore": 0, "bearerOnly": false, @@ -1006,17 +1006,17 @@ "clientId": "matrix", "name": "", "description": "", - "rootUrl": "https://chat.test.test.pub.solar", + "rootUrl": "https://chat.test.pub.solar", "adminUrl": "", - "baseUrl": "https://chat.test.test.pub.solar", + "baseUrl": "https://chat.test.pub.solar", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "secret": "secret", "redirectUris": [ - "https://matrix.test.test.pub.solar/_synapse/client/oidc/callback", - "https://matrix.test.test.test.pub.solar/_synapse/client/oidc/callback" + "https://matrix.test.pub.solar/_synapse/client/oidc/callback", + "https://matrix.test.test.pub.solar/_synapse/client/oidc/callback" ], "webOrigins": [], "notBefore": 0, @@ -1038,7 +1038,7 @@ "tls-client-certificate-bound-access-tokens": "false", "oidc.ciba.grant.enabled": "false", "backchannel.logout.session.required": "true", - "backchannel.logout.url": "https://chat.test.test.pub.solar/_synapse/client/oidc/backchannel_logout", + "backchannel.logout.url": "https://chat.test.pub.solar/_synapse/client/oidc/backchannel_logout", "client_credentials.use_refresh_token": "false", "acr.loa.map": "{}", "require.pushed.authorization.requests": "false", @@ -1111,9 +1111,9 @@ "clientId": "matrix-authentication-service", "name": "", "description": "Used for our hosted https://github.com/matrix-org/matrix-authentication-service", - "rootUrl": "https://matrix.test.test.pub.solar/", - "adminUrl": "https://matrix.test.test.pub.solar/", - "baseUrl": "https://matrix.test.test.pub.solar/", + "rootUrl": "https://matrix.test.pub.solar/", + "adminUrl": "https://matrix.test.pub.solar/", + "baseUrl": "https://matrix.test.pub.solar/", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, @@ -1166,19 +1166,19 @@ "clientId": "mediawiki", "name": "", "description": "", - "rootUrl": "https://wiki.test.test.pub.solar", - "adminUrl": "https://wiki.test.test.pub.solar", - "baseUrl": "https://wiki.test.test.pub.solar", + "rootUrl": "https://wiki.test.pub.solar", + "adminUrl": "https://wiki.test.pub.solar", + "baseUrl": "https://wiki.test.pub.solar", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "secret": "secret", "redirectUris": [ - "https://wiki.test.test.pub.solar/*" + "https://wiki.test.pub.solar/*" ], "webOrigins": [ - "https://wiki.test.test.pub.solar" + "https://wiki.test.pub.solar" ], "notBefore": 0, "bearerOnly": false, @@ -1221,19 +1221,19 @@ "clientId": "nextcloud", "name": "", "description": "", - "rootUrl": "https://cloud.test.test.pub.solar", - "adminUrl": "https://cloud.test.test.pub.solar", - "baseUrl": "https://cloud.test.test.pub.solar", + "rootUrl": "https://cloud.test.pub.solar", + "adminUrl": "https://cloud.test.pub.solar", + "baseUrl": "https://cloud.test.pub.solar", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "secret": "secret", "redirectUris": [ - "https://cloud.test.test.pub.solar/apps/user_oidc/code" + "https://cloud.test.pub.solar/apps/user_oidc/code" ], "webOrigins": [ - "https://cloud.test.test.pub.solar" + "https://cloud.test.pub.solar" ], "notBefore": 0, "bearerOnly": false, @@ -1247,14 +1247,14 @@ "protocol": "openid-connect", "attributes": { "client.secret.creation.time": 1724762383467, - "post.logout.redirect.uris": "https://cloud.test.test.pub.solar##https://cloud.test.test.pub.solar/##https://cloud.test.test.pub.solar/*", + "post.logout.redirect.uris": "https://cloud.test.pub.solar##https://cloud.test.pub.solar/##https://cloud.test.pub.solar/*", "oauth2.device.authorization.grant.enabled": "false", "backchannel.logout.revoke.offline.tokens": "false", "use.refresh.tokens": "true", "tls-client-certificate-bound-access-tokens": "false", "oidc.ciba.grant.enabled": "false", "backchannel.logout.session.required": "true", - "backchannel.logout.url": "https://cloud.test.test.pub.solar/apps/user_oidc/backchannel-logout/test.test.pub.solar%20ID", + "backchannel.logout.url": "https://cloud.test.pub.solar/apps/user_oidc/backchannel-logout/test.pub.solar%20ID", "client_credentials.use_refresh_token": "false", "require.pushed.authorization.requests": "false", "acr.loa.map": "{}", @@ -1283,16 +1283,16 @@ "clientId": "openbikesensor-portal", "name": "", "description": "", - "rootUrl": "https://obs-portal.test.test.pub.solar", + "rootUrl": "https://obs-portal.test.pub.solar", "adminUrl": "", - "baseUrl": "https://obs-portal.test.test.pub.solar", + "baseUrl": "https://obs-portal.test.pub.solar", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "secret": "secret", "redirectUris": [ - "https://obs-portal.test.test.pub.solar/*" + "https://obs-portal.test.pub.solar/*" ], "webOrigins": [ "+" @@ -1382,13 +1382,13 @@ "clientId": "security-admin-console", "name": "${client_security-admin-console}", "rootUrl": "${authAdminUrl}", - "baseUrl": "/admin/test.test.pub.solar/console/", + "baseUrl": "/admin/test.pub.solar/console/", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "redirectUris": [ - "/admin/test.test.pub.solar/console/*" + "/admin/test.pub.solar/console/*" ], "webOrigins": [ "+" @@ -1498,19 +1498,19 @@ "clientId": "tt-rss", "name": "tt-rss", "description": "", - "rootUrl": "https://rss.test.test.pub.solar", - "adminUrl": "https://rss.test.test.pub.solar", - "baseUrl": "https://rss.test.test.pub.solar", + "rootUrl": "https://rss.test.pub.solar", + "adminUrl": "https://rss.test.pub.solar", + "baseUrl": "https://rss.test.pub.solar", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "secret": "secret", "redirectUris": [ - "https://rss.test.test.pub.solar" + "https://rss.test.pub.solar" ], "webOrigins": [ - "https://rss.test.test.pub.solar" + "https://rss.test.pub.solar" ], "notBefore": 0, "bearerOnly": false, @@ -2095,23 +2095,23 @@ "strictTransportSecurity": "max-age=31536000; includeSubDomains" }, "smtpServer": { - "password": "**********", - "replyToDisplayName": "test.test.pub.solar Support", + "password": "password", + "replyToDisplayName": "test.pub.solar Support", "starttls": "false", "auth": "true", "port": "465", - "replyTo": "admins@test.test.pub.solar", - "host": "mail.test.test.pub.solar", - "from": "keycloak@test.test.pub.solar", - "fromDisplayName": "test.test.pub.solar ID", + "replyTo": "admins@test.pub.solar", + "host": "mail.test.pub.solar", + "from": "keycloak@test.pub.solar", + "fromDisplayName": "test.pub.solar ID", "envelopeFrom": "", "ssl": "true", - "user": "admins@test.test.pub.solar" + "user": "admins@test.pub.solar" }, - "loginTheme": "test.test.pub.solar", - "accountTheme": "test.test.pub.solar", - "adminTheme": "test.test.pub.solar", - "emailTheme": "test.test.pub.solar", + "loginTheme": "pub.solar", + "accountTheme": "pub.solar", + "adminTheme": "pub.solar", + "emailTheme": "pub.solar", "eventsEnabled": false, "eventsListeners": [ "jboss-logging" diff --git a/tests/support/keycloak-realm-export/src/index.mjs b/tests/support/keycloak-realm-export/src/index.mjs index fdccbff..8aef73f 100644 --- a/tests/support/keycloak-realm-export/src/index.mjs +++ b/tests/support/keycloak-realm-export/src/index.mjs @@ -60,11 +60,23 @@ const changeIds = (node) => { return node; }; +const setExtra = (data) => ({ + ...data, + loginTheme: "pub.solar", + accountTheme: "pub.solar", + adminTheme: "pub.solar", + emailTheme: "pub.solar", + smtpServer: { + ...data.smtpServer, + password: "password", + }, +}); + (async () => { const fileContents = await readFile(filePath, { encoding: 'utf8' }); const data = JSON.parse(renameDomain(fileContents)); - const newData = changeIds(cleanClients(data)); + const newData = setExtra(changeIds(cleanClients(data))); console.log(JSON.stringify(newData, null, 2)); })(); diff --git a/tests/support/mail-server.nix b/tests/support/mail-server.nix new file mode 100644 index 0000000..b0a1ada --- /dev/null +++ b/tests/support/mail-server.nix @@ -0,0 +1,27 @@ +{ + config, + flake, + ... +}: { + imports = [ + flake.self.nixosModules.home-manager + flake.self.nixosModules.core + flake.self.nixosModules.mail + flake.inputs.simple-nixos-mailserver.nixosModule + ./global.nix + ]; + + # password is password + systemd.tmpfiles.rules = [ "f /tmp/emailpw 1777 root root 10d $2b$11$NV75HGZzMcIwrnVUZKXtxexX9DN52HayDW4eKrD1A8O3uIPnCquQ2" ]; + + mailserver = { + loginAccounts = { + "admins@${config.pub-solar-os.networking.domain}" = { + hashedPasswordFile = "/tmp/emailpw"; + }; + "hakkonaut@${config.pub-solar-os.networking.domain}" = { + hashedPasswordFile = "/tmp/emailpw"; + }; + }; + }; +} diff --git a/tests/website.nix b/tests/website.nix index 452262b..3a2b91e 100644 --- a/tests/website.nix +++ b/tests/website.nix @@ -14,13 +14,7 @@ node.specialArgs = self.outputs.nixosConfigurations.nachtigall._module.specialArgs; nodes = { - acme-server = { - imports = [ - self.nixosModules.home-manager - self.nixosModules.core - ./support/ca.nix - ]; - }; + acme-server.imports = [ ./support/acme-server.nix ]; nachtigall = { imports = [