tests/keycloak: working base test without client

flake.lock

@@ -14,11 +14,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1723293904,
+        "lastModified": 1722339003,
-        "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
+        "narHash": "sha256-ZeS51uJI30ehNkcZ4uKqT4ZDARPyqrHADSKAwv5vVCU=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
+        "rev": "3f1dae074a12feb7327b4bf43cbac0d124488bb7",
         "type": "github"
       },
       "original": {
@@ -299,11 +299,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1724299755,
+        "lastModified": 1722924007,
-        "narHash": "sha256-P5zMA17kD9tqiqMuNXwupkM7buM3gMNtoZ1VuJTRDE4=",
+        "narHash": "sha256-+CQDamNwqO33REJLft8c26NbUi2Td083hq6SvAm2xkU=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "a8968d88e5a537b0491f68ce910749cd870bdbef",
+        "rev": "91010a5613ffd7ee23ee9263213157a1c422b705",
         "type": "github"
       },
       "original": {
@@ -330,11 +330,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1724242322,
+        "lastModified": 1722869614,
-        "narHash": "sha256-HMpK7hNjhEk4z5SFg5UtxEio9OWFocHdaQzCfW1pE7w=",
+        "narHash": "sha256-7ojM1KSk3mzutD7SkrdSflHXEujPvW1u7QuqWoTLXQU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "224042e9a3039291f22f4f2ded12af95a616cca0",
+        "rev": "883180e6550c1723395a3a342f830bfc5c371f6b",
         "type": "github"
       },
       "original": {
@@ -519,11 +519,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1724224976,
+        "lastModified": 1722813957,
-        "narHash": "sha256-Z/ELQhrSd7bMzTO8r7NZgi9g5emh+aRKoCdaAv5fiO0=",
+        "narHash": "sha256-IAoYyYnED7P8zrBFMnmp7ydaJfwTnwcnqxUElC1I26Y=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c374d94f1536013ca8e92341b540eba4c22f9c62",
+        "rev": "cb9a96f23c491c081b38eab96d22fa958043c9fa",
         "type": "github"
       },
       "original": {

flake.nix

@@ -79,25 +79,14 @@
             master = import inputs.master { inherit system; };
           };
 
-          packages =
+          packages = let
-            let
+            nixos-lib = import (inputs.nixpkgs + "/nixos/lib") { };
-              nixos-lib = import (inputs.nixpkgs + "/nixos/lib") { };
+            testDir = builtins.attrNames (builtins.readDir ./tests);
-              testDir = builtins.attrNames (builtins.readDir ./tests);
+            testFiles = builtins.filter (n: builtins.match "^.*.nix$" n != null) testDir;
-              testFiles = builtins.filter (n: builtins.match "^.*.nix$" n != null) testDir;
+          in builtins.listToAttrs (map (x: {
-            in
+            name = "test-${lib.strings.removeSuffix ".nix" x}";
-            builtins.listToAttrs (
+            value = nixos-lib.runTest (import (./tests + "/${x}") { inherit self; inherit pkgs; inherit lib; inherit config; });
-              map (x: {
+          }) testFiles);
-                name = "test-${lib.strings.removeSuffix ".nix" x}";
-                value = nixos-lib.runTest (
-                  import (./tests + "/${x}") {
-                    inherit self;
-                    inherit pkgs;
-                    inherit lib;
-                    inherit config;
-                  }
-                );
-              }) testFiles
-            );
 
           devShells.default = pkgs.mkShell {
             buildInputs = with pkgs; [

modules/backups/default.nix

@@ -7,257 +7,247 @@
 }:
 {
   options.pub-solar-os.backups = {
-    stores =
+    stores = with lib; mkOption {
-      with lib;
+      description = ''
-      mkOption {
+        Periodic backups to create with Restic.
-        description = ''
+      '';
-          Periodic backups to create with Restic.
+      type = types.attrsOf (types.submodule ({ name, ... }: {
-        '';
+        options = {
-        type = types.attrsOf (
+          passwordFile = mkOption {
-          types.submodule (
+            type = types.str;
-            { name, ... }:
+            description = ''
-            {
+              Read the repository password from a file.
-              options = {
+            '';
-                passwordFile = mkOption {
+            example = "/etc/nixos/restic-password";
-                  type = types.str;
+          };
-                  description = ''
-                    Read the repository password from a file.
-                  '';
-                  example = "/etc/nixos/restic-password";
-                };
 
-                repository = mkOption {
+          repository = mkOption {
-                  type = with types; nullOr str;
+            type = with types; nullOr str;
-                  default = null;
+            default = null;
-                  description = ''
+            description = ''
-                    repository to backup to.
+              repository to backup to.
-                  '';
+            '';
-                  example = "sftp:backup@192.168.1.100:/backups/${name}";
+            example = "sftp:backup@192.168.1.100:/backups/${name}";
-                };
-              };
-            }
-          )
-        );
-
-        default = { };
-        example = {
-          remotebackup = {
-            repository = "sftp:backup@host:/backups/home";
-            passwordFile = "/etc/nixos/secrets/restic-password";
           };
         };
+      }));
+
+      default = { };
+      example = {
+        remotebackup = {
+          repository = "sftp:backup@host:/backups/home";
+          passwordFile = "/etc/nixos/secrets/restic-password";
+        };
       };
+    };
 
-    backups =
+    backups = with lib; mkOption {
-      with lib;
+      description = ''
-      mkOption {
+        Periodic backups to create with Restic.
-        description = ''
+      '';
-          Periodic backups to create with Restic.
+      type = types.attrsOf (types.submodule ({ name, ... }: {
-        '';
+        options = {
-        type = types.attrsOf (
+          paths = mkOption {
-          types.submodule (
+            # This is nullable for legacy reasons only. We should consider making it a pure listOf
-            { name, ... }:
+            # after some time has passed since this comment was added.
-            {
+            type = types.nullOr (types.listOf types.str);
-              options = {
+            default = [ ];
-                paths = mkOption {
+            description = ''
-                  # This is nullable for legacy reasons only. We should consider making it a pure listOf
+              Which paths to backup, in addition to ones specified via
-                  # after some time has passed since this comment was added.
+              `dynamicFilesFrom`.  If null or an empty array and
-                  type = types.nullOr (types.listOf types.str);
+              `dynamicFilesFrom` is also null, no backup command will be run.
-                  default = [ ];
+               This can be used to create a prune-only job.
-                  description = ''
+            '';
-                    Which paths to backup, in addition to ones specified via
+            example = [
-                    `dynamicFilesFrom`.  If null or an empty array and
+              "/var/lib/postgresql"
-                    `dynamicFilesFrom` is also null, no backup command will be run.
+              "/home/user/backup"
-                     This can be used to create a prune-only job.
-                  '';
-                  example = [
-                    "/var/lib/postgresql"
-                    "/home/user/backup"
-                  ];
-                };
-
-                exclude = mkOption {
-                  type = types.listOf types.str;
-                  default = [ ];
-                  description = ''
-                    Patterns to exclude when backing up. See
-                    https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
-                    details on syntax.
-                  '';
-                  example = [
-                    "/var/cache"
-                    "/home/*/.cache"
-                    ".git"
-                  ];
-                };
-
-                timerConfig = mkOption {
-                  type = types.nullOr (types.attrsOf unitOption);
-                  default = {
-                    OnCalendar = "daily";
-                    Persistent = true;
-                  };
-                  description = ''
-                    When to run the backup. See {manpage}`systemd.timer(5)` for
-                    details. If null no timer is created and the backup will only
-                    run when explicitly started.
-                  '';
-                  example = {
-                    OnCalendar = "00:05";
-                    RandomizedDelaySec = "5h";
-                    Persistent = true;
-                  };
-                };
-
-                user = mkOption {
-                  type = types.str;
-                  default = "root";
-                  description = ''
-                    As which user the backup should run.
-                  '';
-                  example = "postgresql";
-                };
-
-                extraBackupArgs = mkOption {
-                  type = types.listOf types.str;
-                  default = [ ];
-                  description = ''
-                    Extra arguments passed to restic backup.
-                  '';
-                  example = [ "--exclude-file=/etc/nixos/restic-ignore" ];
-                };
-
-                extraOptions = mkOption {
-                  type = types.listOf types.str;
-                  default = [ ];
-                  description = ''
-                    Extra extended options to be passed to the restic --option flag.
-                  '';
-                  example = [ "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'" ];
-                };
-
-                initialize = mkOption {
-                  type = types.bool;
-                  default = false;
-                  description = ''
-                    Create the repository if it doesn't exist.
-                  '';
-                };
-
-                pruneOpts = mkOption {
-                  type = types.listOf types.str;
-                  default = [ ];
-                  description = ''
-                    A list of options (--keep-\* et al.) for 'restic forget
-                    --prune', to automatically prune old snapshots.  The
-                    'forget' command is run *after* the 'backup' command, so
-                    keep that in mind when constructing the --keep-\* options.
-                  '';
-                  example = [
-                    "--keep-daily 7"
-                    "--keep-weekly 5"
-                    "--keep-monthly 12"
-                    "--keep-yearly 75"
-                  ];
-                };
-
-                runCheck = mkOption {
-                  type = types.bool;
-                  default = (builtins.length config.services.restic.backups.${name}.checkOpts > 0);
-                  defaultText = literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
-                  description = "Whether to run the `check` command with the provided `checkOpts` options.";
-                  example = true;
-                };
-
-                checkOpts = mkOption {
-                  type = types.listOf types.str;
-                  default = [ ];
-                  description = ''
-                    A list of options for 'restic check'.
-                  '';
-                  example = [ "--with-cache" ];
-                };
-
-                dynamicFilesFrom = mkOption {
-                  type = with types; nullOr str;
-                  default = null;
-                  description = ''
-                    A script that produces a list of files to back up.  The
-                    results of this command are given to the '--files-from'
-                    option. The result is merged with paths specified via `paths`.
-                  '';
-                  example = "find /home/matt/git -type d -name .git";
-                };
-
-                backupPrepareCommand = mkOption {
-                  type = with types; nullOr str;
-                  default = null;
-                  description = ''
-                    A script that must run before starting the backup process.
-                  '';
-                };
-
-                backupCleanupCommand = mkOption {
-                  type = with types; nullOr str;
-                  default = null;
-                  description = ''
-                    A script that must run after finishing the backup process.
-                  '';
-                };
-
-                package = mkPackageOption pkgs "restic" { };
-
-                createWrapper = lib.mkOption {
-                  type = lib.types.bool;
-                  default = true;
-                  description = ''
-                    Whether to generate and add a script to the system path, that has the same environment variables set
-                    as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
-                    having to manually specify most options.
-                  '';
-                };
-              };
-            }
-          )
-        );
-        default = { };
-        example = {
-          localbackup = {
-            paths = [ "/home" ];
-            exclude = [ "/home/*/.cache" ];
-            initialize = true;
-          };
-          remotebackup = {
-            paths = [ "/home" ];
-            extraOptions = [
-              "sftp.command='ssh backup@host -i /etc/nixos/secrets/backup-private-key -s sftp'"
             ];
-            timerConfig = {
+          };
+
+          exclude = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            description = ''
+              Patterns to exclude when backing up. See
+              https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
+              details on syntax.
+            '';
+            example = [
+              "/var/cache"
+              "/home/*/.cache"
+              ".git"
+            ];
+          };
+
+          timerConfig = mkOption {
+            type = types.nullOr (types.attrsOf unitOption);
+            default = {
+              OnCalendar = "daily";
+              Persistent = true;
+            };
+            description = ''
+              When to run the backup. See {manpage}`systemd.timer(5)` for
+              details. If null no timer is created and the backup will only
+              run when explicitly started.
+            '';
+            example = {
               OnCalendar = "00:05";
               RandomizedDelaySec = "5h";
+              Persistent = true;
             };
           };
+
+          user = mkOption {
+            type = types.str;
+            default = "root";
+            description = ''
+              As which user the backup should run.
+            '';
+            example = "postgresql";
+          };
+
+          extraBackupArgs = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            description = ''
+              Extra arguments passed to restic backup.
+            '';
+            example = [
+              "--exclude-file=/etc/nixos/restic-ignore"
+            ];
+          };
+
+          extraOptions = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            description = ''
+              Extra extended options to be passed to the restic --option flag.
+            '';
+            example = [
+              "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'"
+            ];
+          };
+
+          initialize = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Create the repository if it doesn't exist.
+            '';
+          };
+
+          pruneOpts = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            description = ''
+              A list of options (--keep-\* et al.) for 'restic forget
+              --prune', to automatically prune old snapshots.  The
+              'forget' command is run *after* the 'backup' command, so
+              keep that in mind when constructing the --keep-\* options.
+            '';
+            example = [
+              "--keep-daily 7"
+              "--keep-weekly 5"
+              "--keep-monthly 12"
+              "--keep-yearly 75"
+            ];
+          };
+
+          runCheck = mkOption {
+            type = types.bool;
+            default = (builtins.length config.services.restic.backups.${name}.checkOpts > 0);
+            defaultText = literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
+            description = "Whether to run the `check` command with the provided `checkOpts` options.";
+            example = true;
+          };
+
+          checkOpts = mkOption {
+            type = types.listOf types.str;
+            default = [ ];
+            description = ''
+              A list of options for 'restic check'.
+            '';
+            example = [
+              "--with-cache"
+            ];
+          };
+
+          dynamicFilesFrom = mkOption {
+            type = with types; nullOr str;
+            default = null;
+            description = ''
+              A script that produces a list of files to back up.  The
+              results of this command are given to the '--files-from'
+              option. The result is merged with paths specified via `paths`.
+            '';
+            example = "find /home/matt/git -type d -name .git";
+          };
+
+          backupPrepareCommand = mkOption {
+            type = with types; nullOr str;
+            default = null;
+            description = ''
+              A script that must run before starting the backup process.
+            '';
+          };
+
+          backupCleanupCommand = mkOption {
+            type = with types; nullOr str;
+            default = null;
+            description = ''
+              A script that must run after finishing the backup process.
+            '';
+          };
+
+          package = mkPackageOption pkgs "restic" { };
+
+          createWrapper = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = ''
+              Whether to generate and add a script to the system path, that has the same environment variables set
+              as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
+              having to manually specify most options.
+            '';
+          };
+        };
+      }));
+      default = { };
+      example = {
+        localbackup = {
+          paths = [ "/home" ];
+          exclude = [ "/home/*/.cache" ];
+          initialize = true;
+        };
+        remotebackup = {
+          paths = [ "/home" ];
+          extraOptions = [
+            "sftp.command='ssh backup@host -i /etc/nixos/secrets/backup-private-key -s sftp'"
+          ];
+          timerConfig = {
+            OnCalendar = "00:05";
+            RandomizedDelaySec = "5h";
+          };
         };
       };
+    };
   };
 
   config = {
-    services.restic.backups =
+    services.restic.backups = let 
-      let
+      stores = config.pub-solar-os.backups.stores;
-        stores = config.pub-solar-os.backups.stores;
+      backups = config.pub-solar-os.backups.backups;
-        backups = config.pub-solar-os.backups.backups;
 
-        storeNames = builtins.attrNames stores;
+      storeNames = builtins.attrNames stores;
-        backupNames = builtins.attrNames backups;
+      backupNames = builtins.attrNames backups;
 
-        createBackups =
+      createBackups = backupName: map
-          backupName:
+        (storeName: {
-          map (storeName: {
+          name = "${backupName}-${storeName}";
-            name = "${backupName}-${storeName}";
+          value = stores."${storeName}" // backups."${backupName}";
-            value = stores."${storeName}" // backups."${backupName}";
+        })
-          }) storeNames;
+        storeNames;
 
-      in
+    in builtins.listToAttrs (lib.lists.flatten (map createBackups backupNames));
-      builtins.listToAttrs (lib.lists.flatten (map createBackups backupNames));
   };
 }

modules/core/nix.nix

@@ -6,7 +6,9 @@
   ...
 }:
 {
-  nixpkgs.config = lib.mkDefault { allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ]; };
+  nixpkgs.config = lib.mkDefault {
+    allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ];
+  };
 
   nix = {
     # Use default version alias for nix package

modules/keycloak/default.nix

@@ -42,7 +42,9 @@
       };
     };
 
-    nixpkgs.config = lib.mkDefault { permittedInsecurePackages = [ "keycloak-23.0.6" ]; };
+    nixpkgs.config = lib.mkDefault {
+      permittedInsecurePackages = [ "keycloak-23.0.6" ];
+    };
 
     # keycloak
     services.keycloak = {

tests/keycloak.nix

@@ -4,10 +4,8 @@
   lib,
   config,
   ...
-}:
+}: let
-let
+in {
-in
-{
   name = "keycloak";
 
   hostPkgs = pkgs;
@@ -44,7 +42,9 @@ in
         ./support/global.nix
       ];
 
-      systemd.tmpfiles.rules = [ "f /tmp/dbf 1777 root root 10d password" ];
+      systemd.tmpfiles.rules = [
+        "f /tmp/dbf 1777 root root 10d password"
+      ];
 
       virtualisation.memorySize = 4096;
 
@@ -65,30 +65,27 @@ in
 
   enableOCR = true;
 
-  testScript =
+  testScript = {nodes, ...}: let
-    { nodes, ... }:
+    user = nodes.client.users.users.${nodes.client.pub-solar-os.authentication.username};
-    let
+    #uid = toString user.uid;
-      user = nodes.client.users.users.${nodes.client.pub-solar-os.authentication.username};
+    bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u ${user.name})/bus";
-      #uid = toString user.uid;
+    gdbus = "${bus} gdbus";
-      bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u ${user.name})/bus";
+    su = command: "su - ${user.name} -c '${command}'";
-      gdbus = "${bus} gdbus";
+    gseval = "call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval";
-      su = command: "su - ${user.name} -c '${command}'";
+    wmClass = su "${gdbus} ${gseval} global.display.focus_window.wm_class";
-      gseval = "call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval";
+  in ''
-      wmClass = su "${gdbus} ${gseval} global.display.focus_window.wm_class";
+    start_all()
-    in
-    ''
-      start_all()
 
-      nachtigall.wait_for_unit("system.slice")
+    nachtigall.wait_for_unit("system.slice")
-      nachtigall.succeed("ping 127.0.0.1 -c 2")
+    nachtigall.succeed("ping 127.0.0.1 -c 2")
-      nachtigall.wait_for_unit("nginx.service")
+    nachtigall.wait_for_unit("nginx.service")
-      nachtigall.wait_for_unit("keycloak.service")
+    nachtigall.wait_for_unit("keycloak.service")
-      nachtigall.wait_until_succeeds("curl http://127.0.0.1:8080/")
+    nachtigall.wait_until_succeeds("curl http://127.0.0.1:8080/")
-      nachtigall.wait_until_succeeds("curl https://auth.test.pub.solar/")
+    nachtigall.wait_until_succeeds("curl https://auth.test.pub.solar/")
 
-      client.wait_for_unit("system.slice")
+    client.wait_for_unit("system.slice")
-      client.sleep(30)
+    client.sleep(30)
-      # client.wait_until_succeeds("${wmClass} | grep -q 'firefox'")
+    # client.wait_until_succeeds("${wmClass} | grep -q 'firefox'")
-      client.screenshot("screen")
+    client.screenshot("screen")
-    '';
+  '';
 }

tests/support/ca.nix

@@ -3,11 +3,14 @@
   lib,
   config,
   ...
-}:
+}: {
-{
+  imports = [
-  imports = [ ./global.nix ];
+    ./global.nix
+  ];
 
-  systemd.tmpfiles.rules = [ "f /tmp/step-ca-intermediate-pw 1777 root root 10d password" ];
+  systemd.tmpfiles.rules = [
+    "f /tmp/step-ca-intermediate-pw 1777 root root 10d password"
+  ];
 
   networking.interfaces.eth0.ipv4.addresses = [
     {
@@ -16,32 +19,30 @@
     }
   ];
 
-  services.step-ca =
+  services.step-ca = let
-    let
+   certificates = pkgs.stdenv.mkDerivation {
-      certificates = pkgs.stdenv.mkDerivation {
+      name = "certificates";
-        name = "certificates";
+      src = ./step;
-        src = ./step;
+      installPhase = ''
-        installPhase = ''
+        mkdir -p $out;
-          mkdir -p $out;
+        cp -r certs $out/
-          cp -r certs $out/
+        cp -r secrets $out/
-          cp -r secrets $out/
+      '';
-        '';
+    };
-      };
+  in {
-    in
+    enable = true;
-    {
+    openFirewall = true;
-      enable = true;
+    intermediatePasswordFile = "/tmp/step-ca-intermediate-pw";
-      openFirewall = true;
+    port = 443;
-      intermediatePasswordFile = "/tmp/step-ca-intermediate-pw";
+    address = "0.0.0.0";
-      port = 443;
+    settings = (builtins.fromJSON (builtins.readFile ./step/config/ca.json)) // {
-      address = "0.0.0.0";
+      root = "${certificates}/certs/root_ca.crt";
-      settings = (builtins.fromJSON (builtins.readFile ./step/config/ca.json)) // {
+      crt = "${certificates}/certs/intermediate_ca.crt";
-        root = "${certificates}/certs/root_ca.crt";
+      key = "${certificates}/secrets/intermediate_ca_key";
-        crt = "${certificates}/certs/intermediate_ca.crt";
+      db = {
-        key = "${certificates}/secrets/intermediate_ca_key";
+        type = "badgerv2";
-        db = {
+        dataSource = "/var/lib/step-ca/db";
-          type = "badgerv2";
-          dataSource = "/var/lib/step-ca/db";
-        };
       };
     };
+  };
 }

tests/support/client.nix

@@ -5,7 +5,9 @@
   ...
 }:
 {
-  imports = [ ./global.nix ];
+  imports = [
+    ./global.nix
+  ];
 
   services.xserver.enable = true;
   services.xserver.displayManager.gdm.enable = true;

tests/support/global.nix

@@ -3,13 +3,14 @@
   lib,
   config,
   ...
-}:
+}: {
-{
   pub-solar-os.networking.domain = "test.pub.solar";
 
   security.acme.defaults.server = "https://ca.${config.pub-solar-os.networking.domain}/acme/acme/directory";
 
-  security.pki.certificates = [ (builtins.readFile ./step/certs/root_ca.crt) ];
+  security.pki.certificates = [
+    (builtins.readFile ./step/certs/root_ca.crt)
+  ];
 
   services.openssh = {
     enable = true;
@@ -23,18 +24,16 @@
 
   security.pam.services.sshd.allowNullPassword = true;
 
-  virtualisation.forwardPorts =
+  virtualisation.forwardPorts = let
-    let
+    address = (builtins.elemAt config.networking.interfaces.eth0.ipv4.addresses 0).address;
-      address = (builtins.elemAt config.networking.interfaces.eth0.ipv4.addresses 0).address;
+    lastAddressPart = builtins.elemAt (lib.strings.splitString "." address) 3;
-      lastAddressPart = builtins.elemAt (lib.strings.splitString "." address) 3;
+  in [
-    in
+    {
-    [
+      from = "host";
-      {
+      host.port = 2000 + (lib.strings.toInt lastAddressPart);
-        from = "host";
+      guest.port = 22;
-        host.port = 2000 + (lib.strings.toInt lastAddressPart);
+    }
-        guest.port = 22;
+  ];
-      }
-    ];
 
   networking.interfaces.eth0.useDHCP = false;
 

tests/support/step/config/ca.json

@@ -1,44 +1,46 @@
 {
-  "federatedRoots": null,
+	"federatedRoots": null,
-  "address": ":443",
+	"address": ":443",
-  "insecureAddress": "",
+	"insecureAddress": "",
-  "dnsNames": ["ca.test.pub.solar"],
+	"dnsNames": [
-  "logger": {
+		"ca.test.pub.solar"
-    "format": "text"
+	],
-  },
+	"logger": {
-  "db": {
+		"format": "text"
-    "type": "badgerv2",
+	},
-    "badgerFileLoadingMode": ""
+	"db": {
-  },
+		"type": "badgerv2",
-  "authority": {
+		"badgerFileLoadingMode": ""
-    "provisioners": [
+	},
+	"authority": {
+		"provisioners": [
       {
-        "name": "acme",
+          "name": "acme",
-        "type": "ACME"
+          "type": "ACME"
       },
-      {
+			{
-        "type": "JWK",
+				"type": "JWK",
-        "name": "test.pub.solar",
+				"name": "test.pub.solar",
-        "key": {
+				"key": {
-          "use": "sig",
+					"use": "sig",
-          "kty": "EC",
+					"kty": "EC",
-          "kid": "lM-BJXRwwQcdgxLqAS4Za23A2YatZpwXx-PP5NIt8JM",
+					"kid": "lM-BJXRwwQcdgxLqAS4Za23A2YatZpwXx-PP5NIt8JM",
-          "crv": "P-256",
+					"crv": "P-256",
-          "alg": "ES256",
+					"alg": "ES256",
-          "x": "ouB2mP04Kt8rDa10C8ZzYyzA36rrz-k0c4_ud1hVjyg",
+					"x": "ouB2mP04Kt8rDa10C8ZzYyzA36rrz-k0c4_ud1hVjyg",
-          "y": "RbXKcudQRPEFqjG_5AxuqCQXn7pyRToQCwC4MrwLVUQ"
+					"y": "RbXKcudQRPEFqjG_5AxuqCQXn7pyRToQCwC4MrwLVUQ"
-        },
+				},
-        "encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiNWR5T2puR2Y5aFFNRlc1U25fRWhzUSJ9.a3xtSBuMmzZCMsdfHAXMgFpe9bq8A6bGGOoW9F2Gw7AhxL4bG-AlgA.IA68rSJSGTAKnaVS.XDQc4da-8D9Ykfw-8S4uphsauq5gsEm4qp7zKQUIvcjUlnPAtiHP3xiiBie29ncdg8rKmyzprEEOpTNvXtQl7LsPsHXyKV3SqsTnJecvim9YXGDneAHyWe-XF6hyCZAfSoFbFMgLDKR6d44hMht3ueazL_TPlkFUBLrJbsW782MfdfF3nzcaDf_JDuhKsKHDmKqZyNXDzwf6rINe8adrf5gqaLM2_sGhk7i3XyXygn8HHVw1Dj_w2gPOVm4MS7CO_NgikPqAtGuXDhpWZfXte-FlnMO6d9xQF67b0cwB8kmColPSp1zRiCKPAk9vof8Nn-gGE_aw8zxPi0CJkoY.xbuqSSspgLc_Uw17uiRF7Q"
+				"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiNWR5T2puR2Y5aFFNRlc1U25fRWhzUSJ9.a3xtSBuMmzZCMsdfHAXMgFpe9bq8A6bGGOoW9F2Gw7AhxL4bG-AlgA.IA68rSJSGTAKnaVS.XDQc4da-8D9Ykfw-8S4uphsauq5gsEm4qp7zKQUIvcjUlnPAtiHP3xiiBie29ncdg8rKmyzprEEOpTNvXtQl7LsPsHXyKV3SqsTnJecvim9YXGDneAHyWe-XF6hyCZAfSoFbFMgLDKR6d44hMht3ueazL_TPlkFUBLrJbsW782MfdfF3nzcaDf_JDuhKsKHDmKqZyNXDzwf6rINe8adrf5gqaLM2_sGhk7i3XyXygn8HHVw1Dj_w2gPOVm4MS7CO_NgikPqAtGuXDhpWZfXte-FlnMO6d9xQF67b0cwB8kmColPSp1zRiCKPAk9vof8Nn-gGE_aw8zxPi0CJkoY.xbuqSSspgLc_Uw17uiRF7Q"
-      }
+			}
-    ]
+		]
-  },
+	},
-  "tls": {
+	"tls": {
-    "cipherSuites": [
+		"cipherSuites": [
-      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
-      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
-    ],
+		],
-    "minVersion": 1.2,
+		"minVersion": 1.2,
-    "maxVersion": 1.3,
+		"maxVersion": 1.3,
-    "renegotiation": false
+		"renegotiation": false
-  }
+	}
 }

tests/support/step/config/defaults.json

@@ -1,6 +1,6 @@
 {
-  "ca-url": "https://ca.test.pub.solar",
+	"ca-url": "https://ca.test.pub.solar",
-  "ca-config": "/home/b12f/.step/config/ca.json",
+	"ca-config": "/home/b12f/.step/config/ca.json",
-  "fingerprint": "4d6a1a918355380acbd0256a2203d0a0da8436bb788e8f19326589045c3cd842",
+	"fingerprint": "4d6a1a918355380acbd0256a2203d0a0da8436bb788e8f19326589045c3cd842",
-  "root": "/home/b12f/.step/certs/root_ca.crt"
+	"root": "/home/b12f/.step/certs/root_ca.crt"
-}
+}