···
+
# end‐to‐end test for Akkoma
+
inherit ((pkgs.formats.elixirConf { }).lib) mkRaw;
+
pkgs.runCommand "certificates-${lib.head names}"
+
nativeBuildInputs = with pkgs; [ openssl ];
+
-subj '/CN=${lib.head names}/' -days 49710 \
+
-addext 'subjectAltName = ${lib.concatStringsSep ", " (map (name: "DNS:${name}") names)}' \
+
-keyout "$out/key.pem" -newkey ed25519 \
+
-out "$out/cert.pem" -noenc
+
"media.akkoma-a.nixos.test"
+
"media.akkoma-b.nixos.test"
+
testMedia = pkgs.runCommand "blank.png" { nativeBuildInputs = with pkgs; [ imagemagick ]; } ''
+
magick -size 640x480 canvas:transparent "PNG8:$out"
+
checkFe = pkgs.writeShellApplication {
+
runtimeInputs = with pkgs; [ curl ];
paths=( / /static/{config,styles}.json /pleroma/admin/ )
for path in "''${paths[@]}"; do
+
<(curl -f -S -s -o /dev/null -w '%{response_code}' "https://$1$path") \
+
security.pki.certificateFiles = [
+
networking.extraHosts = ''
+
${nodes.akkoma-a.networking.primaryIPAddress} akkoma-a.nixos.test media.akkoma-a.nixos.test
+
${nodes.akkoma-b.networking.primaryIPAddress} akkoma-b.nixos.test media.akkoma-b.nixos.test
+
${nodes.client-a.networking.primaryIPAddress} client-a.nixos.test
+
${nodes.client-b.networking.primaryIPAddress} client-b.nixos.test
+
REQUESTS_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+
systemPackages = with pkgs; [ toot ];
+
firewall.allowedTCPPorts = [ 443 ];
+
systemd.services.akkoma.confinement.enable = confined;
+
name = "NixOS test Akkoma server";
+
description = "NixOS test Akkoma server";
+
email = "akkoma@nixos.test";
+
notify_email = "akkoma@nixos.test";
+
registration_open = true;
+
"Pleroma.Web.Endpoint" = {
+
url.host = config.networking.fqdn;
+
base_url = "https://media.${config.networking.fqdn}/media/";
+
# disable certificate verification until we figure out how to
+
# supply our own certificates
+
":http".adapter.pools = mkRaw "%{default: [conn_opts: [transport_opts: [verify: :verify_none]]]}";
+
services.nginx.enable = true;
+
services.postgresql.enable = true;
+
services.akkoma.nginx = {
+
sslCertificate = "${tlsCertA}/cert.pem";
+
sslCertificateKey = "${tlsCertA}/key.pem";
+
services.akkoma.nginx = {
+
sslCertificate = "${tlsCertB}/cert.pem";
+
sslCertificateKey = "${tlsCertB}/key.pem";
+
from shlex import quote
+
return "".join(random.choice(string.ascii_letters + string.digits) for _ in range(len))
+
def registerUser(user, password):
+
return 'pleroma_ctl user new {0} {0}@nixos.test --password {1} -y'.format(
+
quote(user), quote(password))
+
def loginUser(instance, user, password):
+
return 'toot login_cli -i {}.nixos.test -e {}@nixos.test -p {}'.format(
+
quote(instance), quote(user), quote(password))
+
userAName = randomString(11)
+
userBName = randomString(11)
+
userAPassword = randomString(22)
+
userBPassword = randomString(22)
+
testMessage = randomString(22)
+
testMedia = '${testMedia}'
+
akkoma_a.wait_for_unit('akkoma-initdb.service')
+
akkoma_b.wait_for_unit('akkoma-initdb.service')
+
# test repeated initialisation
+
akkoma_a.systemctl('restart akkoma-initdb.service')
+
akkoma_a.wait_for_unit('akkoma.service')
+
akkoma_b.wait_for_unit('akkoma.service')
+
akkoma_a.wait_for_file('/run/akkoma/socket');
+
akkoma_b.wait_for_file('/run/akkoma/socket');
+
akkoma_a.succeed(registerUser(userAName, userAPassword))
+
akkoma_b.succeed(registerUser(userBName, userBPassword))
+
akkoma_a.wait_for_unit('nginx.service')
+
akkoma_b.wait_for_unit('nginx.service')
+
client_a.succeed(loginUser('akkoma-a', userAName, userAPassword))
+
client_b.succeed(loginUser('akkoma-b', userBName, userBPassword))
+
client_b.succeed('toot follow {}@akkoma-a.nixos.test'.format(userAName))
+
client_a.wait_until_succeeds('toot followers | grep -F -q {}'.format(quote(userBName)))
+
client_a.succeed('toot post {} --media {} --description "nothing to see here"'.format(
+
quote(testMessage), quote(testMedia)))
+
status = json.loads(client_b.wait_until_succeeds(
+
'toot status --json "$(toot timeline -1 | grep -E -o \'^ID [^ ]+\' | cut -d \' \' -f 2)"'))
+
assert status['content'] == testMessage
+
# compare attachment to original
+
client_b.succeed('cmp {} <(curl -f -S -s {})'.format(quote(testMedia),
+
quote(status['media_attachments'][0]['url'])))
+
client_a.succeed('${lib.getExe checkFe} akkoma-a.nixos.test')
+
client_b.succeed('${lib.getExe checkFe} akkoma-b.nixos.test')
pyrox.dev