pyrox.dev
1{ pkgs, ... }:
2let
3 snakeOil =
4 pkgs.runCommand "snakeoil-certs"
5 {
6 outputs = [
7 "out"
8 "cacert"
9 "cert"
10 "key"
11 "crl"
12 ];
13 buildInputs = [ pkgs.gnutls.bin ];
14 caTemplate = pkgs.writeText "snakeoil-ca.template" ''
15 cn = server
16 expiration_days = -1
17 cert_signing_key
18 ca
19 '';
20 certTemplate = pkgs.writeText "snakeoil-cert.template" ''
21 cn = server
22 expiration_days = -1
23 tls_www_server
24 encryption_key
25 signing_key
26 '';
27 crlTemplate = pkgs.writeText "snakeoil-crl.template" ''
28 expiration_days = -1
29 '';
30 userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
31 organization = snakeoil
32 cn = server
33 expiration_days = -1
34 tls_www_client
35 encryption_key
36 signing_key
37 '';
38 }
39 ''
40 certtool -p --bits 4096 --outfile ca.key
41 certtool -s --template "$caTemplate" --load-privkey ca.key \
42 --outfile "$cacert"
43 certtool -p --bits 4096 --outfile "$key"
44 certtool -c --template "$certTemplate" \
45 --load-ca-privkey ca.key \
46 --load-ca-certificate "$cacert" \
47 --load-privkey "$key" \
48 --outfile "$cert"
49 certtool --generate-crl --template "$crlTemplate" \
50 --load-ca-privkey ca.key \
51 --load-ca-certificate "$cacert" \
52 --outfile "$crl"
53
54 mkdir "$out"
55
56 # Stripping key information before the actual PEM-encoded values is solely
57 # to make test output a bit less verbose when copying the client key to the
58 # actual client.
59 certtool -p --bits 4096 | sed -n \
60 -e '/^----* *BEGIN/,/^----* *END/p' > "$out/alice.key"
61
62 certtool -c --template "$userCertTemplate" \
63 --load-privkey "$out/alice.key" \
64 --load-ca-privkey ca.key \
65 --load-ca-certificate "$cacert" \
66 --outfile "$out/alice.cert"
67 '';
68
69in
70{
71 name = "taskserver";
72
73 nodes = rec {
74 server = {
75 services.taskserver.enable = true;
76 services.taskserver.listenHost = "::";
77 services.taskserver.openFirewall = true;
78 services.taskserver.fqdn = "server";
79 services.taskserver.organisations = {
80 testOrganisation.users = [
81 "alice"
82 "foo"
83 ];
84 anotherOrganisation.users = [ "bob" ];
85 };
86
87 specialisation.manual_config.configuration = {
88 services.taskserver.pki.manual = {
89 ca.cert = snakeOil.cacert;
90 server.cert = snakeOil.cert;
91 server.key = snakeOil.key;
92 server.crl = snakeOil.crl;
93 };
94 };
95 };
96
97 client1 =
98 { pkgs, ... }:
99 {
100 environment.systemPackages = [
101 pkgs.taskwarrior2
102 pkgs.gnutls
103 ];
104 users.users.alice.isNormalUser = true;
105 users.users.bob.isNormalUser = true;
106 users.users.foo.isNormalUser = true;
107 users.users.bar.isNormalUser = true;
108 };
109
110 client2 = client1;
111 };
112
113 testScript =
114 { nodes, ... }:
115 let
116 cfg = nodes.server.services.taskserver;
117 portStr = toString cfg.listenPort;
118 specialisations = "${nodes.server.system.build.toplevel}/specialisation";
119 newServerSystem = "${specialisations}/manual_config";
120 switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
121 in
122 ''
123 from shlex import quote
124
125
126 def su(user, cmd):
127 return f"su - {user} -c {quote(cmd)}"
128
129
130 def no_extra_init(client, org, user):
131 pass
132
133
134 def setup_clients_for(org, user, extra_init=no_extra_init):
135 for client in [client1, client2]:
136 with client.nested(f"initialize client for user {user}"):
137 client.succeed(
138 su(user, f"rm -rf /home/{user}/.task"),
139 su(user, "task rc.confirmation=no config confirmation no"),
140 )
141
142 exportinfo = server.succeed(f"nixos-taskserver user export {org} {user}")
143
144 with client.nested("importing taskwarrior configuration"):
145 client.succeed(su(user, f"eval {quote(exportinfo)} >&2"))
146
147 extra_init(client, org, user)
148
149 client.succeed(su(user, "task config taskd.server server:${portStr} >&2"))
150
151 client.succeed(su(user, "task sync init >&2"))
152
153
154 def restart_server():
155 server.systemctl("restart taskserver.service")
156 server.wait_for_open_port(${portStr})
157
158
159 def re_add_imperative_user():
160 with server.nested("(re-)add imperative user bar"):
161 server.execute("nixos-taskserver org remove imperativeOrg")
162 server.succeed(
163 "nixos-taskserver org add imperativeOrg",
164 "nixos-taskserver user add imperativeOrg bar",
165 )
166 setup_clients_for("imperativeOrg", "bar")
167
168
169 def test_sync(user):
170 with subtest(f"sync for user {user}"):
171 client1.succeed(su(user, "task add foo >&2"))
172 client1.succeed(su(user, "task sync >&2"))
173 client2.fail(su(user, "task list >&2"))
174 client2.succeed(su(user, "task sync >&2"))
175 client2.succeed(su(user, "task list >&2"))
176
177
178 def check_client_cert(user):
179 # debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040
180 cmd = (
181 f"gnutls-cli -d 3"
182 f" --x509cafile=/home/{user}/.task/keys/ca.cert"
183 f" --x509keyfile=/home/{user}/.task/keys/private.key"
184 f" --x509certfile=/home/{user}/.task/keys/public.cert"
185 f" --port=${portStr} server < /dev/null"
186 )
187 return su(user, cmd)
188
189
190 # Explicitly start the VMs so that we don't accidentally start newServer
191 server.start()
192 client1.start()
193 client2.start()
194
195 server.wait_for_unit("taskserver.service")
196
197 server.succeed(
198 "nixos-taskserver user list testOrganisation | grep -qxF alice",
199 "nixos-taskserver user list testOrganisation | grep -qxF foo",
200 "nixos-taskserver user list anotherOrganisation | grep -qxF bob",
201 )
202
203 server.wait_for_open_port(${portStr})
204
205 client1.wait_for_unit("multi-user.target")
206 client2.wait_for_unit("multi-user.target")
207
208 setup_clients_for("testOrganisation", "alice")
209 setup_clients_for("testOrganisation", "foo")
210 setup_clients_for("anotherOrganisation", "bob")
211
212 for user in ["alice", "bob", "foo"]:
213 test_sync(user)
214
215 server.fail("nixos-taskserver user add imperativeOrg bar")
216 re_add_imperative_user()
217
218 test_sync("bar")
219
220 with subtest("checking certificate revocation of user bar"):
221 client1.succeed(check_client_cert("bar"))
222
223 server.succeed("nixos-taskserver user remove imperativeOrg bar")
224 restart_server()
225
226 client1.fail(check_client_cert("bar"))
227
228 client1.succeed(su("bar", "task add destroy everything >&2"))
229 client1.fail(su("bar", "task sync >&2"))
230
231 re_add_imperative_user()
232
233 with subtest("checking certificate revocation of org imperativeOrg"):
234 client1.succeed(check_client_cert("bar"))
235
236 server.succeed("nixos-taskserver org remove imperativeOrg")
237 restart_server()
238
239 client1.fail(check_client_cert("bar"))
240
241 client1.succeed(su("bar", "task add destroy even more >&2"))
242 client1.fail(su("bar", "task sync >&2"))
243
244 re_add_imperative_user()
245
246 with subtest("check whether declarative config overrides user bar"):
247 restart_server()
248 test_sync("bar")
249
250
251 def init_manual_config(client, org, user):
252 cfgpath = f"/home/{user}/.task"
253
254 client.copy_from_host(
255 "${snakeOil.cacert}",
256 f"{cfgpath}/ca.cert",
257 )
258 for file in ["alice.key", "alice.cert"]:
259 client.copy_from_host(
260 f"${snakeOil}/{file}",
261 f"{cfgpath}/{file}",
262 )
263
264 for file in [f"{user}.key", f"{user}.cert"]:
265 client.copy_from_host(
266 f"${snakeOil}/{file}",
267 f"{cfgpath}/{file}",
268 )
269
270 client.succeed(
271 su("alice", f"task config taskd.ca {cfgpath}/ca.cert"),
272 su("alice", f"task config taskd.key {cfgpath}/{user}.key"),
273 su(user, f"task config taskd.certificate {cfgpath}/{user}.cert"),
274 )
275
276
277 with subtest("check manual configuration"):
278 # Remove the keys from automatic CA creation, to make sure the new
279 # generation doesn't use keys from before.
280 server.succeed("rm -rf ${cfg.dataDir}/keys/* >&2")
281
282 server.succeed(
283 "${switchToNewServer} >&2"
284 )
285 server.wait_for_unit("taskserver.service")
286 server.wait_for_open_port(${portStr})
287
288 server.succeed(
289 "nixos-taskserver org add manualOrg",
290 "nixos-taskserver user add manualOrg alice",
291 )
292
293 setup_clients_for("manualOrg", "alice", init_manual_config)
294
295 test_sync("alice")
296 '';
297}