pyrox.dev
1import ./make-test-python.nix ({ pkgs, ... }: let
2 snakeOil = pkgs.runCommand "snakeoil-certs" {
3 outputs = [ "out" "cacert" "cert" "key" "crl" ];
4 buildInputs = [ pkgs.gnutls.bin ];
5 caTemplate = pkgs.writeText "snakeoil-ca.template" ''
6 cn = server
7 expiration_days = -1
8 cert_signing_key
9 ca
10 '';
11 certTemplate = pkgs.writeText "snakeoil-cert.template" ''
12 cn = server
13 expiration_days = -1
14 tls_www_server
15 encryption_key
16 signing_key
17 '';
18 crlTemplate = pkgs.writeText "snakeoil-crl.template" ''
19 expiration_days = -1
20 '';
21 userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
22 organization = snakeoil
23 cn = server
24 expiration_days = -1
25 tls_www_client
26 encryption_key
27 signing_key
28 '';
29 } ''
30 certtool -p --bits 4096 --outfile ca.key
31 certtool -s --template "$caTemplate" --load-privkey ca.key \
32 --outfile "$cacert"
33 certtool -p --bits 4096 --outfile "$key"
34 certtool -c --template "$certTemplate" \
35 --load-ca-privkey ca.key \
36 --load-ca-certificate "$cacert" \
37 --load-privkey "$key" \
38 --outfile "$cert"
39 certtool --generate-crl --template "$crlTemplate" \
40 --load-ca-privkey ca.key \
41 --load-ca-certificate "$cacert" \
42 --outfile "$crl"
43
44 mkdir "$out"
45
46 # Stripping key information before the actual PEM-encoded values is solely
47 # to make test output a bit less verbose when copying the client key to the
48 # actual client.
49 certtool -p --bits 4096 | sed -n \
50 -e '/^----* *BEGIN/,/^----* *END/p' > "$out/alice.key"
51
52 certtool -c --template "$userCertTemplate" \
53 --load-privkey "$out/alice.key" \
54 --load-ca-privkey ca.key \
55 --load-ca-certificate "$cacert" \
56 --outfile "$out/alice.cert"
57 '';
58
59in {
60 name = "taskserver";
61
62 nodes = rec {
63 server = {
64 services.taskserver.enable = true;
65 services.taskserver.listenHost = "::";
66 services.taskserver.openFirewall = true;
67 services.taskserver.fqdn = "server";
68 services.taskserver.organisations = {
69 testOrganisation.users = [ "alice" "foo" ];
70 anotherOrganisation.users = [ "bob" ];
71 };
72 };
73
74 # New generation of the server with manual config
75 newServer = { lib, nodes, ... }: {
76 imports = [ server ];
77 services.taskserver.pki.manual = {
78 ca.cert = snakeOil.cacert;
79 server.cert = snakeOil.cert;
80 server.key = snakeOil.key;
81 server.crl = snakeOil.crl;
82 };
83 # This is to avoid assigning a different network address to the new
84 # generation.
85 networking = lib.mapAttrs (lib.const lib.mkForce) {
86 interfaces.eth1.ipv4 = nodes.server.config.networking.interfaces.eth1.ipv4;
87 inherit (nodes.server.config.networking)
88 hostName primaryIPAddress extraHosts;
89 };
90 };
91
92 client1 = { pkgs, ... }: {
93 environment.systemPackages = [ pkgs.taskwarrior pkgs.gnutls ];
94 users.users.alice.isNormalUser = true;
95 users.users.bob.isNormalUser = true;
96 users.users.foo.isNormalUser = true;
97 users.users.bar.isNormalUser = true;
98 };
99
100 client2 = client1;
101 };
102
103 testScript = { nodes, ... }: let
104 cfg = nodes.server.config.services.taskserver;
105 portStr = toString cfg.listenPort;
106 newServerSystem = nodes.newServer.config.system.build.toplevel;
107 switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
108 in ''
109 from shlex import quote
110
111
112 def su(user, cmd):
113 return f"su - {user} -c {quote(cmd)}"
114
115
116 def no_extra_init(client, org, user):
117 pass
118
119
120 def setup_clients_for(org, user, extra_init=no_extra_init):
121 for client in [client1, client2]:
122 with client.nested(f"initialize client for user {user}"):
123 client.succeed(
124 su(user, f"rm -rf /home/{user}/.task"),
125 su(user, "task rc.confirmation=no config confirmation no"),
126 )
127
128 exportinfo = server.succeed(f"nixos-taskserver user export {org} {user}")
129
130 with client.nested("importing taskwarrior configuration"):
131 client.succeed(su(user, f"eval {quote(exportinfo)} >&2"))
132
133 extra_init(client, org, user)
134
135 client.succeed(su(user, "task config taskd.server server:${portStr} >&2"))
136
137 client.succeed(su(user, "task sync init >&2"))
138
139
140 def restart_server():
141 server.systemctl("restart taskserver.service")
142 server.wait_for_open_port(${portStr})
143
144
145 def re_add_imperative_user():
146 with server.nested("(re-)add imperative user bar"):
147 server.execute("nixos-taskserver org remove imperativeOrg")
148 server.succeed(
149 "nixos-taskserver org add imperativeOrg",
150 "nixos-taskserver user add imperativeOrg bar",
151 )
152 setup_clients_for("imperativeOrg", "bar")
153
154
155 def test_sync(user):
156 with subtest(f"sync for user {user}"):
157 client1.succeed(su(user, "task add foo >&2"))
158 client1.succeed(su(user, "task sync >&2"))
159 client2.fail(su(user, "task list >&2"))
160 client2.succeed(su(user, "task sync >&2"))
161 client2.succeed(su(user, "task list >&2"))
162
163
164 def check_client_cert(user):
165 # debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040
166 cmd = (
167 f"gnutls-cli -d 3"
168 f" --x509cafile=/home/{user}/.task/keys/ca.cert"
169 f" --x509keyfile=/home/{user}/.task/keys/private.key"
170 f" --x509certfile=/home/{user}/.task/keys/public.cert"
171 f" --port=${portStr} server < /dev/null"
172 )
173 return su(user, cmd)
174
175
176 # Explicitly start the VMs so that we don't accidentally start newServer
177 server.start()
178 client1.start()
179 client2.start()
180
181 server.wait_for_unit("taskserver.service")
182
183 server.succeed(
184 "nixos-taskserver user list testOrganisation | grep -qxF alice",
185 "nixos-taskserver user list testOrganisation | grep -qxF foo",
186 "nixos-taskserver user list anotherOrganisation | grep -qxF bob",
187 )
188
189 server.wait_for_open_port(${portStr})
190
191 client1.wait_for_unit("multi-user.target")
192 client2.wait_for_unit("multi-user.target")
193
194 setup_clients_for("testOrganisation", "alice")
195 setup_clients_for("testOrganisation", "foo")
196 setup_clients_for("anotherOrganisation", "bob")
197
198 for user in ["alice", "bob", "foo"]:
199 test_sync(user)
200
201 server.fail("nixos-taskserver user add imperativeOrg bar")
202 re_add_imperative_user()
203
204 test_sync("bar")
205
206 with subtest("checking certificate revocation of user bar"):
207 client1.succeed(check_client_cert("bar"))
208
209 server.succeed("nixos-taskserver user remove imperativeOrg bar")
210 restart_server()
211
212 client1.fail(check_client_cert("bar"))
213
214 client1.succeed(su("bar", "task add destroy everything >&2"))
215 client1.fail(su("bar", "task sync >&2"))
216
217 re_add_imperative_user()
218
219 with subtest("checking certificate revocation of org imperativeOrg"):
220 client1.succeed(check_client_cert("bar"))
221
222 server.succeed("nixos-taskserver org remove imperativeOrg")
223 restart_server()
224
225 client1.fail(check_client_cert("bar"))
226
227 client1.succeed(su("bar", "task add destroy even more >&2"))
228 client1.fail(su("bar", "task sync >&2"))
229
230 re_add_imperative_user()
231
232 with subtest("check whether declarative config overrides user bar"):
233 restart_server()
234 test_sync("bar")
235
236
237 def init_manual_config(client, org, user):
238 cfgpath = f"/home/{user}/.task"
239
240 client.copy_from_host(
241 "${snakeOil.cacert}",
242 f"{cfgpath}/ca.cert",
243 )
244 for file in ["alice.key", "alice.cert"]:
245 client.copy_from_host(
246 f"${snakeOil}/{file}",
247 f"{cfgpath}/{file}",
248 )
249
250 for file in [f"{user}.key", f"{user}.cert"]:
251 client.copy_from_host(
252 f"${snakeOil}/{file}",
253 f"{cfgpath}/{file}",
254 )
255
256 client.succeed(
257 su("alice", f"task config taskd.ca {cfgpath}/ca.cert"),
258 su("alice", f"task config taskd.key {cfgpath}/{user}.key"),
259 su(user, f"task config taskd.certificate {cfgpath}/{user}.cert"),
260 )
261
262
263 with subtest("check manual configuration"):
264 # Remove the keys from automatic CA creation, to make sure the new
265 # generation doesn't use keys from before.
266 server.succeed("rm -rf ${cfg.dataDir}/keys/* >&2")
267
268 server.succeed(
269 "${switchToNewServer} >&2"
270 )
271 server.wait_for_unit("taskserver.service")
272 server.wait_for_open_port(${portStr})
273
274 server.succeed(
275 "nixos-taskserver org add manualOrg",
276 "nixos-taskserver user add manualOrg alice",
277 )
278
279 setup_clients_for("manualOrg", "alice", init_manual_config)
280
281 test_sync("alice")
282 '';
283})