pyrox.dev
1import ./make-test-python.nix ({pkgs, lib, ...}:
2let
3 gpgKeyring = (pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } ''
4 mkdir -p $out
5 export GNUPGHOME=$out
6 cat > foo <<EOF
7 %echo Generating a basic OpenPGP key
8 %no-protection
9 Key-Type: DSA
10 Key-Length: 1024
11 Subkey-Type: ELG-E
12 Subkey-Length: 1024
13 Name-Real: Bob Foobar
14 Name-Email: bob@foo.bar
15 Expire-Date: 0
16 # Do a commit here, so that we can later print "done"
17 %commit
18 %echo done
19 EOF
20 gpg --batch --generate-key foo
21 rm $out/S.gpg-agent $out/S.gpg-agent.*
22 gpg --export bob@foo.bar -a > $out/pubkey.gpg
23 '');
24
25 nspawnImages = (pkgs.runCommand "localhost" { buildInputs = [ pkgs.coreutils pkgs.gnupg ]; } ''
26 mkdir -p $out
27 cd $out
28
29 # produce a testimage.raw
30 dd if=/dev/urandom of=$out/testimage.raw bs=$((1024*1024+7)) count=5
31
32 # produce a testimage2.tar.xz, containing the hello store path
33 tar cvJpf testimage2.tar.xz ${pkgs.hello}
34
35 # produce signature(s)
36 sha256sum testimage* > SHA256SUMS
37 export GNUPGHOME="$(mktemp -d)"
38 cp -R ${gpgKeyring}/* $GNUPGHOME
39 gpg --batch --sign --detach-sign --output SHA256SUMS.gpg SHA256SUMS
40 '');
41in {
42 name = "systemd-nspawn";
43
44 nodes = {
45 server = { pkgs, ... }: {
46 networking.firewall.allowedTCPPorts = [ 80 ];
47 services.nginx = {
48 enable = true;
49 virtualHosts."server".root = nspawnImages;
50 };
51 };
52 client = { pkgs, ... }: {
53 environment.etc."systemd/import-pubring.gpg".source = "${gpgKeyring}/pubkey.gpg";
54 };
55 };
56
57 testScript = ''
58 start_all()
59
60 server.wait_for_unit("nginx.service")
61 client.wait_for_unit("network-online.target")
62 client.succeed("machinectl pull-raw --verify=signature http://server/testimage.raw")
63 client.succeed(
64 "cmp /var/lib/machines/testimage.raw ${nspawnImages}/testimage.raw"
65 )
66 client.succeed("machinectl pull-tar --verify=signature http://server/testimage2.tar.xz")
67 client.succeed(
68 "cmp /var/lib/machines/testimage2/${pkgs.hello}/bin/hello ${pkgs.hello}/bin/hello"
69 )
70 '';
71})