commit 1b7b89c4efc7e7338cc68eb0e34db94a43bd2200 · pyrox.dev/nixpkgs

-2

nixos/doc/manual/release-notes/rl-2411.section.md

···

       933
        
       

     

       934
        
       - `buildNimSbom` was added as an alternative to `buildNimPackage`. `buildNimSbom` uses [SBOMs](https://cyclonedx.org/) to generate packages whereas `buildNimPackage` uses a custom JSON lockfile format.

     

       935
        
       

     

       936
       -
       - `services.syncthing.folders.<name>.devices` now accepts an `attrset`, allowing to set `encryptionPassword` file for a device.

     

       937
       -
       

     

       938
        
       ## Detailed Migration Information {#sec-release-24.11-migration}

     

       939
        
       

     

       940
        
       ### `sound` options removal {#sec-release-24.11-migration-sound}

···

       933
        
       

     

       934
        
       - `buildNimSbom` was added as an alternative to `buildNimPackage`. `buildNimSbom` uses [SBOMs](https://cyclonedx.org/) to generate packages whereas `buildNimPackage` uses a custom JSON lockfile format.

     

       935
        
       

     

       0
        
       
     

       0
        
       
     

       936
        
       ## Detailed Migration Information {#sec-release-24.11-migration}

     

       937
        
       

     

       938
        
       ### `sound` options removal {#sec-release-24.11-migration-sound}

+99 -82

nixos/modules/services/networking/syncthing.nix

···

       59
        
                   let

     

       60
        
                     folderDevices = folder.devices;

     

       61
        
                   in

     

       62
       -
                   if builtins.isList folderDevices then

     

       63
       -
                     map (

     

       64
       -
                       device:

     

       65
       -
                       if builtins.isString device then { deviceId = cfg.settings.devices.${device}.id; } else device

     

       66
       -
                     ) folderDevices

     

       67
       -
                   else if builtins.isAttrs folderDevices then

     

       68
       -
                     mapAttrsToList (

     

       69
       -
                       deviceName: deviceValue: deviceValue // { deviceId = cfg.settings.devices.${deviceName}.id; }

     

       70
       -
                     ) folderDevices

     

       71
       -
                   else

     

       72
       -
                     throw "Invalid type for devices in folder '${folderName}'; expected list or attrset.";

     

       73
        
               }

     

       74
        
         ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);

     

       75
        
       

     
···

       142
        
                     (map (

     

       143
        
                       new_cfg:

     

       144
        
                       let

     

       145
       -
                         isSecret = attr: value: builtins.isString value && attr == "encryptionPassword";

     

       146
       -
       

     

       147
       -
                         resolveSecrets =

     

       148
       -
                           attr: value:

     

       149
       -
                           if builtins.isAttrs value then

     

       150
       -
                             # Attribute set: process each attribute

     

       151
       -
                             builtins.mapAttrs (name: val: resolveSecrets name val) value

     

       152
       -
                           else if builtins.isList value then

     

       153
       -
                             # List: process each element

     

       154
       -
                             map (item: resolveSecrets "" item) value

     

       155
       -
                           else if isSecret attr value then

     

       156
       -
                             # String that looks like a path: replace with placeholder

     

       157
       -
                             let

     

       158
       -
                               varName = "secret_${builtins.hashString "sha256" value}";

     

       159
       -
                             in

     

       160
       -
                             "\${${varName}}"

     

       161
       -
                           else

     

       162
       -
                             # Other types: return as is

     

       163
       -
                             value;

     

       164
       -
       

     

       165
       -
                         # Function to collect all file paths from the configuration

     

       166
       -
                         collectPaths =

     

       167
       -
                           attr: value:

     

       168
       -
                           if builtins.isAttrs value then

     

       169
       -
                             concatMap (name: collectPaths name value.${name}) (builtins.attrNames value)

     

       170
       -
                           else if builtins.isList value then

     

       171
       -
                             concatMap (name: collectPaths "" name) value

     

       172
       -
                           else if isSecret attr value then

     

       173
       -
                             [ value ]

     

       174
       -
                           else

     

       175
       -
                             [ ];

     

       176
       -
       

     

       177
       -
                         # Function to generate variable assignments for the secrets

     

       178
       -
                         generateSecretVars =

     

       179
       -
                           paths:

     

       180
       -
                           concatStringsSep "\n" (

     

       181
       -
                             map (

     

       182
       -
                               path:

     

       183
        
                               let

     

       184
       -
                                 varName = "secret_${builtins.hashString "sha256" path}";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       185
        
                               in

     

       186
       -
                               ''

     

       187
       -
                                 if [ ! -r ${path} ]; then

     

       188
       -
                                   echo "${path} does not exist"

     

       189
       -
                                   exit 1

     

       190
       -
                                 fi

     

       191
       -
                                 ${varName}=$(<${path})

     

       192
       -
                               ''

     

       193
       -
                             ) paths

     

       194
       -
                           );

     

       195
       -
       

     

       196
       -
                         resolved_cfg = resolveSecrets "" new_cfg;

     

       197
       -
                         secretPaths = collectPaths "" new_cfg;

     

       198
       -
                         secretVarsScript = generateSecretVars secretPaths;

     

       199
       -
       

     

       200
       -
                         jsonString = builtins.toJSON resolved_cfg;

     

       201
       -
                         escapedJson = builtins.replaceStrings [ "\"" ] [ "\\\"" ] jsonString;

     

       202
        
                       in

     

       203
        
                       ''

     

       204
       -
                         ${secretVarsScript}

     

       205
       -
       

     

       206
       -
                         curl -d "${escapedJson}" -X POST ${s.baseAddress}

     

       207
        
                       ''

     

       208
        
                     ))

     

       209
        
                     (lib.concatStringsSep "\n")

     
···

       513
        
                             };

     

       514
        
       

     

       515
        
                             devices = mkOption {

     

       516
       -
                               type = types.oneOf [

     

       517
       -
                                 (types.listOf types.str)

     

       518
       -
                                 (types.attrsOf (

     

       519
       -
                                   types.submodule (

     

       520
       -
                                     { name, ... }:

     

       521
        
                                     {

     

       522
        
                                       freeformType = settingsFormat.type;

     

       523
        
                                       options = {

     

       524
       -
                                         encryptionPassword = mkOption {

     

       525
       -
                                           type = types.nullOr types.str;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       526
        
                                           default = null;

     

       527
        
                                           description = ''

     

       528
        
                                             Path to encryption password. If set, the file will be read during

     
···

       531
        
                                         };

     

       532
        
                                       };

     

       533
        
                                     }

     

       534
       -
                                   )

     

       535
       -
                                 ))

     

       536
       -
                               ];

     

       537
        
                               default = [ ];

     

       538
        
                               description = ''

     

       539
        
                                 The devices this folder should be shared with. Each device must

     

       540
        
                                 be defined in the [devices](#opt-services.syncthing.settings.devices) option.

     

       541
        
       

     

       542
       -
                                 Either a list of strings, or an attribute set, where keys are defined in the

     

       543
       -
                                 [devices](#opt-services.syncthing.settings.devices) option, and values are

     

       544
       -
                                 device configurations.

     

       545
        
                               '';

     

       546
        
                             };

     

       547

···

       59
        
                   let

     

       60
        
                     folderDevices = folder.devices;

     

       61
        
                   in

     

       62
       +
                   map (

     

       63
       +
                     device:

     

       64
       +
                     if builtins.isString device then

     

       65
       +
                       { deviceId = cfg.settings.devices.${device}.id; }

     

       66
       +
                     else if builtins.isAttrs device then

     

       67
       +
                       { deviceId = cfg.settings.devices.${device.name}.id; } // device

     

       68
       +
                     else

     

       69
       +
                       throw "Invalid type for devices in folder '${folderName}'; expected list or attrset."

     

       70
       +
                   ) folderDevices;

     

       0
        
       
     

       0
        
       
     

       71
        
               }

     

       72
        
         ) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);

     

       73
        
       

     
···

       140
        
                     (map (

     

       141
        
                       new_cfg:

     

       142
        
                       let

     

       143
       +
                         jsonPreSecretsFile = pkgs.writeTextFile {

     

       144
       +
                           name = "${conf_type}-${new_cfg.id}-conf-pre-secrets.json";

     

       145
       +
                           text = builtins.toJSON new_cfg;

     

       146
       +
                         };

     

       147
       +
                         injectSecretsJqCmd =

     

       148
       +
                           {

     

       149
       +
                             # There are no secrets in `devs`, so no massaging needed.

     

       150
       +
                             "devs" = "${jq} .";

     

       151
       +
                             "dirs" =

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       152
        
                               let

     

       153
       +
                                 folder = new_cfg;

     

       154
       +
                                 devicesWithSecrets = lib.pipe folder.devices [

     

       155
       +
                                   (lib.filter (device: (builtins.isAttrs device) && device ? encryptionPasswordFile))

     

       156
       +
                                   (map (device: {

     

       157
       +
                                     deviceId = device.deviceId;

     

       158
       +
                                     variableName = "secret_${builtins.hashString "sha256" device.encryptionPasswordFile}";

     

       159
       +
                                     secretPath = device.encryptionPasswordFile;

     

       160
       +
                                   }))

     

       161
       +
                                 ];

     

       162
       +
                                 # At this point, `jsonPreSecretsFile` looks something like this:

     

       163
       +
                                 #

     

       164
       +
                                 #   {

     

       165
       +
                                 #     ...,

     

       166
       +
                                 #     "devices": [

     

       167
       +
                                 #       {

     

       168
       +
                                 #         "deviceId": "id1",

     

       169
       +
                                 #         "encryptionPasswordFile": "/etc/bar-encryption-password",

     

       170
       +
                                 #         "name": "..."

     

       171
       +
                                 #       }

     

       172
       +
                                 #     ],

     

       173
       +
                                 #   }

     

       174
       +
                                 #

     

       175
       +
                                 # We now generate a `jq` command that can replace those

     

       176
       +
                                 # `encryptionPasswordFile`s with `encryptionPassword`.

     

       177
       +
                                 # The `jq` command ends up looking like this:

     

       178
       +
                                 #

     

       179
       +
                                 #   jq --rawfile secret_DEADBEEF /etc/bar-encryption-password '

     

       180
       +
                                 #     .devices[] |= (

     

       181
       +
                                 #       if .deviceId == "id1" then

     

       182
       +
                                 #         del(.encryptionPasswordFile) |

     

       183
       +
                                 #         .encryptionPassword = $secret_DEADBEEF

     

       184
       +
                                 #       else

     

       185
       +
                                 #         .

     

       186
       +
                                 #       end

     

       187
       +
                                 #     )

     

       188
       +
                                 #   '

     

       189
       +
                                 jqUpdates = map (device: ''

     

       190
       +
                                   .devices[] |= (

     

       191
       +
                                     if .deviceId == "${device.deviceId}" then

     

       192
       +
                                       del(.encryptionPasswordFile) |

     

       193
       +
                                       .encryptionPassword = ''$${device.variableName}

     

       194
       +
                                     else

     

       195
       +
                                       .

     

       196
       +
                                     end

     

       197
       +
                                   )

     

       198
       +
                                 '') devicesWithSecrets;

     

       199
       +
                                 jqRawFiles = map (

     

       200
       +
                                   device: "--rawfile ${device.variableName} ${lib.escapeShellArg device.secretPath}"

     

       201
       +
                                 ) devicesWithSecrets;

     

       202
        
                               in

     

       203
       +
                               "${jq} ${lib.concatStringsSep " " jqRawFiles} ${

     

       204
       +
                                 lib.escapeShellArg (lib.concatStringsSep "|" ([ "." ] ++ jqUpdates))

     

       205
       +
                               }";

     

       206
       +
                           }

     

       207
       +
                           .${conf_type};

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       208
        
                       in

     

       209
        
                       ''

     

       210
       +
                         ${injectSecretsJqCmd} ${jsonPreSecretsFile} | curl --json @- -X POST ${s.baseAddress}

     

       0
        
       
     

       0
        
       
     

       211
        
                       ''

     

       212
        
                     ))

     

       213
        
                     (lib.concatStringsSep "\n")

     
···

       517
        
                             };

     

       518
        
       

     

       519
        
                             devices = mkOption {

     

       520
       +
                               type = types.listOf (

     

       521
       +
                                 types.oneOf [

     

       522
       +
                                   types.str

     

       523
       +
                                   (types.submodule (

     

       524
       +
                                     { ... }:

     

       525
        
                                     {

     

       526
        
                                       freeformType = settingsFormat.type;

     

       527
        
                                       options = {

     

       528
       +
                                         name = mkOption {

     

       529
       +
                                           type = types.str;

     

       530
       +
                                           default = null;

     

       531
       +
                                           description = ''

     

       532
       +
                                             The name of a device defined in the

     

       533
       +
                                             [devices](#opt-services.syncthing.settings.devices)

     

       534
       +
                                             option.

     

       535
       +
                                           '';

     

       536
       +
                                         };

     

       537
       +
                                         encryptionPasswordFile = mkOption {

     

       538
       +
                                           type = types.nullOr (

     

       539
       +
                                             types.pathWith {

     

       540
       +
                                               inStore = false;

     

       541
       +
                                               absolute = true;

     

       542
       +
                                             }

     

       543
       +
                                           );

     

       544
        
                                           default = null;

     

       545
        
                                           description = ''

     

       546
        
                                             Path to encryption password. If set, the file will be read during

     
···

       549
        
                                         };

     

       550
        
                                       };

     

       551
        
                                     }

     

       552
       +
                                   ))

     

       553
       +
                                 ]

     

       554
       +
                               );

     

       555
        
                               default = [ ];

     

       556
        
                               description = ''

     

       557
        
                                 The devices this folder should be shared with. Each device must

     

       558
        
                                 be defined in the [devices](#opt-services.syncthing.settings.devices) option.

     

       559
        
       

     

       560
       +
                                 A list of either strings or attribute sets, where values

     

       561
       +
                                 are device names or device configurations.

     

       0
        
       
     

       562
        
                               '';

     

       563
        
                             };

     

       564

+1 -1

nixos/tests/all-tests.nix

···

       1219
        
         syncthing-no-settings = handleTest ./syncthing-no-settings.nix { };

     

       1220
        
         syncthing-init = handleTest ./syncthing-init.nix { };

     

       1221
        
         syncthing-many-devices = handleTest ./syncthing-many-devices.nix { };

     

       1222
       -
         syncthing-folders = handleTest ./syncthing-folders.nix { };

     

       1223
        
         syncthing-relay = handleTest ./syncthing-relay.nix { };

     

       1224
        
         sysinit-reactivation = runTest ./sysinit-reactivation.nix;

     

       1225
        
         systemd = handleTest ./systemd.nix { };

···

       1219
        
         syncthing-no-settings = handleTest ./syncthing-no-settings.nix { };

     

       1220
        
         syncthing-init = handleTest ./syncthing-init.nix { };

     

       1221
        
         syncthing-many-devices = handleTest ./syncthing-many-devices.nix { };

     

       1222
       +
         syncthing-folders = runTest ./syncthing-folders.nix;

     

       1223
        
         syncthing-relay = handleTest ./syncthing-relay.nix { };

     

       1224
        
         sysinit-reactivation = runTest ./sysinit-reactivation.nix;

     

       1225
        
         systemd = handleTest ./systemd.nix { };

+83 -68

nixos/tests/syncthing-folders.nix

···

       1
       -
       import ../make-test-python.nix (

     

       2
       -
         { lib, pkgs, ... }:

     

       3
       -
         let

     

       4
       -
           genNodeId =

     

       5
       -
             name:

     

       6
       -
             pkgs.runCommand "syncthing-test-certs-${name}" { } ''

     

       7
       -
               mkdir -p $out

     

       8
       -
               ${pkgs.syncthing}/bin/syncthing generate --config=$out

     

       9
       -
               ${pkgs.libxml2}/bin/xmllint --xpath 'string(configuration/device/@id)' $out/config.xml > $out/id

     

       10
       -
             '';

     

       11
       -
           idA = genNodeId "a";

     

       12
       -
           idB = genNodeId "b";

     

       13
       -
           idC = genNodeId "c";

     

       14
       -
           testPasswordFile = pkgs.writeText "syncthing-test-password" "it's a secret";

     

       15
       -
         in

     

       16
       -
         {

     

       17
       -
           name = "syncthing";

     

       18
       -
           meta.maintainers = with pkgs.lib.maintainers; [ zarelit ];

     

       19
        
       

     

       20
       -
           nodes = {

     

       21
       -
             a = {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       22
        
               services.syncthing = {

     

       23
        
                 enable = true;

     

       24
        
                 openDefaultPorts = true;

     
···

       33
        
                   };

     

       34
        
                   folders.bar = {

     

       35
        
                     path = "/var/lib/syncthing/bar";

     

       36
       -
                     devices.c.encryptionPassword = "${testPasswordFile}";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       37
        
                   };

     

       38
        
                 };

     

       39
        
               };

     

       40
        
             };

     

       41
       -
             b = {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       42
        
               services.syncthing = {

     

       43
        
                 enable = true;

     

       44
        
                 openDefaultPorts = true;

     
···

       53
        
                   };

     

       54
        
                   folders.bar = {

     

       55
        
                     path = "/var/lib/syncthing/bar";

     

       56
       -
                     devices.c.encryptionPassword = "${testPasswordFile}";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       57
        
                   };

     

       58
        
                 };

     

       59
        
               };

     

       60
        
             };

     

       61
       -
             c = {

     

       62
       -
               services.syncthing = {

     

       63
       -
                 enable = true;

     

       64
       -
                 openDefaultPorts = true;

     

       65
       -
                 cert = "${idC}/cert.pem";

     

       66
       -
                 key = "${idC}/key.pem";

     

       67
       -
                 settings = {

     

       68
       -
                   devices.a.id = lib.fileContents "${idA}/id";

     

       69
       -
                   devices.b.id = lib.fileContents "${idB}/id";

     

       70
       -
                   folders.bar = {

     

       71
       -
                     path = "/var/lib/syncthing/bar";

     

       72
       -
                     devices = [

     

       73
       -
                       "a"

     

       74
       -
                       "b"

     

       75
       -
                     ];

     

       76
       -
                     type = "receiveencrypted";

     

       77
       -
                   };

     

       78
        
                 };

     

       79
        
               };

     

       80
        
             };

     

       81
        
           };

     

       0
        
       
     

       82
        
       

     

       83
       -
           testScript = ''

     

       84
       -
             start_all()

     

       85
        
       

     

       86
       -
             a.wait_for_unit("syncthing.service")

     

       87
       -
             b.wait_for_unit("syncthing.service")

     

       88
       -
             c.wait_for_unit("syncthing.service")

     

       89
       -
             a.wait_for_open_port(22000)

     

       90
       -
             b.wait_for_open_port(22000)

     

       91
       -
             c.wait_for_open_port(22000)

     

       92
        
       

     

       93
       -
             # Test foo

     

       94
        
       

     

       95
       -
             a.wait_for_file("/var/lib/syncthing/foo")

     

       96
       -
             b.wait_for_file("/var/lib/syncthing/foo")

     

       97
        
       

     

       98
       -
             a.succeed("echo a2b > /var/lib/syncthing/foo/a2b")

     

       99
       -
             b.succeed("echo b2a > /var/lib/syncthing/foo/b2a")

     

       100
        
       

     

       101
       -
             a.wait_for_file("/var/lib/syncthing/foo/b2a")

     

       102
       -
             b.wait_for_file("/var/lib/syncthing/foo/a2b")

     

       103
        
       

     

       104
       -
             # Test bar

     

       105
        
       

     

       106
       -
             a.wait_for_file("/var/lib/syncthing/bar")

     

       107
       -
             b.wait_for_file("/var/lib/syncthing/bar")

     

       108
       -
             c.wait_for_file("/var/lib/syncthing/bar")

     

       109
        
       

     

       110
       -
             a.succeed("echo plaincontent > /var/lib/syncthing/bar/plainname")

     

       111
        
       

     

       112
       -
             # B should be able to decrypt, check that content of file matches

     

       113
       -
             b.wait_for_file("/var/lib/syncthing/bar/plainname")

     

       114
       -
             b.succeed("grep plaincontent /var/lib/syncthing/bar/plainname")

     

       0
        
       
     

       115
        
       

     

       116
       -
             # Bar on C is untrusted, check that content is not in cleartext

     

       117
       -
             c.fail("grep -R plaincontent /var/lib/syncthing/bar")

     

       118
       -
           '';

     

       119
       -
         }

     

       120
       -
       )

···

       1
       +
       { lib, pkgs, ... }:

     

       2
       +
       let

     

       3
       +
         genNodeId =

     

       4
       +
           name:

     

       5
       +
           pkgs.runCommand "syncthing-test-certs-${name}" { } ''

     

       6
       +
             mkdir -p $out

     

       7
       +
             ${pkgs.syncthing}/bin/syncthing generate --config=$out

     

       8
       +
             ${pkgs.libxml2}/bin/xmllint --xpath 'string(configuration/device/@id)' $out/config.xml > $out/id

     

       9
       +
           '';

     

       10
       +
         idA = genNodeId "a";

     

       11
       +
         idB = genNodeId "b";

     

       12
       +
         idC = genNodeId "c";

     

       13
       +
         testPassword = "it's a secret";

     

       14
       +
       in

     

       15
       +
       {

     

       16
       +
         name = "syncthing";

     

       17
       +
         meta.maintainers = with pkgs.lib.maintainers; [ zarelit ];

     

       0
        
       
     

       18
        
       

     

       19
       +
         nodes = {

     

       20
       +
           a =

     

       21
       +
             { config, ... }:

     

       22
       +
             {

     

       23
       +
               environment.etc.bar-encryption-password.text = testPassword;

     

       24
        
               services.syncthing = {

     

       25
        
                 enable = true;

     

       26
        
                 openDefaultPorts = true;

     
···

       35
        
                   };

     

       36
        
                   folders.bar = {

     

       37
        
                     path = "/var/lib/syncthing/bar";

     

       38
       +
                     devices = [

     

       39
       +
                       {

     

       40
       +
                         name = "c";

     

       41
       +
                         encryptionPasswordFile = "/etc/${config.environment.etc.bar-encryption-password.target}";

     

       42
       +
                       }

     

       43
       +
                     ];

     

       44
        
                   };

     

       45
        
                 };

     

       46
        
               };

     

       47
        
             };

     

       48
       +
           b =

     

       49
       +
             { config, ... }:

     

       50
       +
             {

     

       51
       +
               environment.etc.bar-encryption-password.text = testPassword;

     

       52
        
               services.syncthing = {

     

       53
        
                 enable = true;

     

       54
        
                 openDefaultPorts = true;

     
···

       63
        
                   };

     

       64
        
                   folders.bar = {

     

       65
        
                     path = "/var/lib/syncthing/bar";

     

       66
       +
                     devices = [

     

       67
       +
                       {

     

       68
       +
                         name = "c";

     

       69
       +
                         encryptionPasswordFile = "/etc/${config.environment.etc.bar-encryption-password.target}";

     

       70
       +
                       }

     

       71
       +
                     ];

     

       72
        
                   };

     

       73
        
                 };

     

       74
        
               };

     

       75
        
             };

     

       76
       +
           c = {

     

       77
       +
             services.syncthing = {

     

       78
       +
               enable = true;

     

       79
       +
               openDefaultPorts = true;

     

       80
       +
               cert = "${idC}/cert.pem";

     

       81
       +
               key = "${idC}/key.pem";

     

       82
       +
               settings = {

     

       83
       +
                 devices.a.id = lib.fileContents "${idA}/id";

     

       84
       +
                 devices.b.id = lib.fileContents "${idB}/id";

     

       85
       +
                 folders.bar = {

     

       86
       +
                   path = "/var/lib/syncthing/bar";

     

       87
       +
                   devices = [

     

       88
       +
                     "a"

     

       89
       +
                     "b"

     

       90
       +
                   ];

     

       91
       +
                   type = "receiveencrypted";

     

       0
        
       
     

       92
        
                 };

     

       93
        
               };

     

       94
        
             };

     

       95
        
           };

     

       96
       +
         };

     

       97
        
       

     

       98
       +
         testScript = ''

     

       99
       +
           start_all()

     

       100
        
       

     

       101
       +
           a.wait_for_unit("syncthing.service")

     

       102
       +
           b.wait_for_unit("syncthing.service")

     

       103
       +
           c.wait_for_unit("syncthing.service")

     

       104
       +
           a.wait_for_open_port(22000)

     

       105
       +
           b.wait_for_open_port(22000)

     

       106
       +
           c.wait_for_open_port(22000)

     

       107
        
       

     

       108
       +
           # Test foo

     

       109
        
       

     

       110
       +
           a.wait_for_file("/var/lib/syncthing/foo")

     

       111
       +
           b.wait_for_file("/var/lib/syncthing/foo")

     

       112
        
       

     

       113
       +
           a.succeed("echo a2b > /var/lib/syncthing/foo/a2b")

     

       114
       +
           b.succeed("echo b2a > /var/lib/syncthing/foo/b2a")

     

       115
        
       

     

       116
       +
           a.wait_for_file("/var/lib/syncthing/foo/b2a")

     

       117
       +
           b.wait_for_file("/var/lib/syncthing/foo/a2b")

     

       118
        
       

     

       119
       +
           # Test bar

     

       120
        
       

     

       121
       +
           a.wait_for_file("/var/lib/syncthing/bar")

     

       122
       +
           b.wait_for_file("/var/lib/syncthing/bar")

     

       123
       +
           c.wait_for_file("/var/lib/syncthing/bar")

     

       124
        
       

     

       125
       +
           a.succeed("echo plaincontent > /var/lib/syncthing/bar/plainname")

     

       126
        
       

     

       127
       +
           # B should be able to decrypt, check that content of file matches

     

       128
       +
           b.wait_for_file("/var/lib/syncthing/bar/plainname")

     

       129
       +
           file_contents = b.succeed("cat /var/lib/syncthing/bar/plainname")

     

       130
       +
           assert "plaincontent\n" == file_contents, f"Unexpected file contents: {file_contents=}"

     

       131
        
       

     

       132
       +
           # Bar on C is untrusted, check that content is not in cleartext

     

       133
       +
           c.fail("grep -R plaincontent /var/lib/syncthing/bar")

     

       134
       +
         '';

     

       135
       +
       }

     

       0