pub-solar/infra
6
1
Fork 3
Code Issues 24 Pull requests 10 Actions Packages Projects 1 Releases Wiki Activity

WIP: feat/automated-account-deletion #174

Draft
b12f wants to merge 23 commits from feat/automated-account-deletion into main
pull from: feat/automated-account-deletion
merge into: pub-solar:main
Conversation 0 Commits 23 Files changed 31 +374 -358
10 changed files with 374 additions and 358 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 74f03555e5 - Show all commits

19
flake.nix
View file

@ -79,14 +79,25 @@
master = import inputs.master { inherit system; };
};
packages = let
packages =
let
nixos-lib = import (inputs.nixpkgs + "/nixos/lib") { };
testDir = builtins.attrNames (builtins.readDir ./tests);
testFiles = builtins.filter (n: builtins.match "^.*.nix$" n != null) testDir;
in builtins.listToAttrs (map (x: {
in
builtins.listToAttrs (
map (x: {
name = "test-${lib.strings.removeSuffix ".nix" x}";
value = nixos-lib.runTest (import (./tests + "/${x}") { inherit self; inherit pkgs; inherit lib; inherit config; });
}) testFiles);
value = nixos-lib.runTest (
import (./tests + "/${x}") {
inherit self;
inherit pkgs;
inherit lib;
inherit config;
}
);
}) testFiles
);
devShells.default = pkgs.mkShell {
buildInputs = with pkgs; [

52
modules/backups/default.nix
View file

@ -7,11 +7,16 @@
}:
{
options.pub-solar-os.backups = {
stores = with lib; mkOption {
stores =
with lib;
mkOption {
description = ''
Periodic backups to create with Restic.
'';
type = types.attrsOf (types.submodule ({ name, ... }: {
type = types.attrsOf (
types.submodule (
{ name, ... }:
{
options = {
passwordFile = mkOption {
type = types.str;
@ -30,7 +35,9 @@
example = "sftp:backup@192.168.1.100:/backups/${name}";
};
};
}));
}
)
);
default = { };
example = {
@ -41,11 +48,16 @@
};
};
backups = with lib; mkOption {
backups =
with lib;
mkOption {
description = ''
Periodic backups to create with Restic.
'';
type = types.attrsOf (types.submodule ({ name, ... }: {
type = types.attrsOf (
types.submodule (
{ name, ... }:
{
options = {
paths = mkOption {
# This is nullable for legacy reasons only. We should consider making it a pure listOf
@ -112,9 +124,7 @@
description = ''
Extra arguments passed to restic backup.
'';
example = [
"--exclude-file=/etc/nixos/restic-ignore"
];
example = [ "--exclude-file=/etc/nixos/restic-ignore" ];
};
extraOptions = mkOption {
@ -123,9 +133,7 @@
description = ''
Extra extended options to be passed to the restic --option flag.
'';
example = [
"sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'"
];
example = [ "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'" ];
};
initialize = mkOption {
@ -167,9 +175,7 @@
description = ''
A list of options for 'restic check'.
'';
example = [
"--with-cache"
];
example = [ "--with-cache" ];
};
dynamicFilesFrom = mkOption {
@ -211,7 +217,9 @@
'';
};
};
}));
}
)
);
default = { };
example = {
localbackup = {
@ -234,20 +242,22 @@
};
config = {
services.restic.backups = let
services.restic.backups =
let
stores = config.pub-solar-os.backups.stores;
backups = config.pub-solar-os.backups.backups;
storeNames = builtins.attrNames stores;
backupNames = builtins.attrNames backups;
createBackups = backupName: map
(storeName: {
createBackups =
backupName:
map (storeName: {
name = "${backupName}-${storeName}";
value = stores."${storeName}" // backups."${backupName}";
})
storeNames;
}) storeNames;
in builtins.listToAttrs (lib.lists.flatten (map createBackups backupNames));
in
builtins.listToAttrs (lib.lists.flatten (map createBackups backupNames));
};
}

4
modules/core/nix.nix
View file

@ -6,9 +6,7 @@
...
}:
{
nixpkgs.config = lib.mkDefault {
allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ];
};
nixpkgs.config = lib.mkDefault { allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ]; };
nix = {
# Use default version alias for nix package

4
modules/keycloak/default.nix
View file

@ -42,9 +42,7 @@
};
};
nixpkgs.config = lib.mkDefault {
permittedInsecurePackages = [ "keycloak-23.0.6" ];
};
nixpkgs.config = lib.mkDefault { permittedInsecurePackages = [ "keycloak-23.0.6" ]; };
# keycloak
services.keycloak = {

17
tests/keycloak.nix
View file

@ -4,8 +4,10 @@
lib,
config,
...
}: let
in {
}:
let
in
{
name = "keycloak";
hostPkgs = pkgs;
@ -42,9 +44,7 @@ in {
./support/global.nix
];
systemd.tmpfiles.rules = [
"f /tmp/dbf 1777 root root 10d password"
];
systemd.tmpfiles.rules = [ "f /tmp/dbf 1777 root root 10d password" ];
virtualisation.memorySize = 4096;
@ -65,7 +65,9 @@ in {
enableOCR = true;
testScript = {nodes, ...}: let
testScript =
{ nodes, ... }:
let
user = nodes.client.users.users.${nodes.client.pub-solar-os.authentication.username};
#uid = toString user.uid;
bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u ${user.name})/bus";
@ -73,7 +75,8 @@ in {
su = command: "su - ${user.name} -c '${command}'";
gseval = "call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval";
wmClass = su "${gdbus} ${gseval} global.display.focus_window.wm_class";
in ''
in
''
start_all()
nachtigall.wait_for_unit("system.slice")

17
tests/support/ca.nix
View file

@ -3,14 +3,11 @@
lib,
config,
...
}: {
imports = [
./global.nix
];
}:
{
imports = [ ./global.nix ];
systemd.tmpfiles.rules = [
"f /tmp/step-ca-intermediate-pw 1777 root root 10d password"
];
systemd.tmpfiles.rules = [ "f /tmp/step-ca-intermediate-pw 1777 root root 10d password" ];
networking.interfaces.eth0.ipv4.addresses = [
{
@ -19,7 +16,8 @@
}
];
services.step-ca = let
services.step-ca =
let
certificates = pkgs.stdenv.mkDerivation {
name = "certificates";
src = ./step;
@ -29,7 +27,8 @@
cp -r secrets $out/
'';
};
in {
in
{
enable = true;
openFirewall = true;
intermediatePasswordFile = "/tmp/step-ca-intermediate-pw";

4
tests/support/client.nix
View file

@ -5,9 +5,7 @@
...
}:
{
imports = [
./global.nix
];
imports = [ ./global.nix ];
services.xserver.enable = true;
services.xserver.displayManager.gdm.enable = true;

13
tests/support/global.nix
View file

@ -3,14 +3,13 @@
lib,
config,
...
}: {
}:
{
pub-solar-os.networking.domain = "test.pub.solar";
security.acme.defaults.server = "https://ca.${config.pub-solar-os.networking.domain}/acme/acme/directory";
security.pki.certificates = [
(builtins.readFile ./step/certs/root_ca.crt)
];
security.pki.certificates = [ (builtins.readFile ./step/certs/root_ca.crt) ];
services.openssh = {
enable = true;
@ -24,10 +23,12 @@
security.pam.services.sshd.allowNullPassword = true;
virtualisation.forwardPorts = let
virtualisation.forwardPorts =
let
address = (builtins.elemAt config.networking.interfaces.eth0.ipv4.addresses 0).address;
lastAddressPart = builtins.elemAt (lib.strings.splitString "." address) 3;
in [
in
[
{
from = "host";
host.port = 2000 + (lib.strings.toInt lastAddressPart);

4
tests/support/step/config/ca.json
View file

@ -2,9 +2,7 @@
"federatedRoots": null,
"address": ":443",
"insecureAddress": "",
"dnsNames": [
"ca.test.pub.solar"
],
"dnsNames": ["ca.test.pub.solar"],
"logger": {
"format": "text"
},