commit 2281c125855b9aa6b29cceebecffb6540725b543 · pyrox.dev/nixpkgs

+72 -61

nixos/tests/step-ca.nix

···

       1
       -
       import ./make-test-python.nix ({ pkgs, ... }:

     

       0
        
       
     

       2
        
         let

     

       3
        
           test-certificates = pkgs.runCommandLocal "test-certificates" { } ''

     

       4
        
             mkdir -p $out

     
···

       10
        
         in

     

       11
        
         {

     

       12
        
           name = "step-ca";

     

       13
       -
           nodes =

     

       14
       -
             {

     

       15
       -
               caserver =

     

       16
       -
                 { config, pkgs, ... }: {

     

       17
       -
                   environment.etc.password-file.source = "${test-certificates}/intermediate-password-file";

     

       18
       -
                   services.step-ca = {

     

       19
       -
                     enable = true;

     

       20
       -
                     address = "[::]";

     

       21
       -
                     port = 8443;

     

       22
       -
                     openFirewall = true;

     

       23
       -
                     intermediatePasswordFile = "/etc/${config.environment.etc.password-file.target}";

     

       24
       -
                     settings = {

     

       25
       -
                       dnsNames = [ "caserver" ];

     

       26
       -
                       root = "${test-certificates}/root_ca.crt";

     

       27
       -
                       crt = "${test-certificates}/intermediate_ca.crt";

     

       28
       -
                       key = "${test-certificates}/intermediate_ca.key";

     

       29
       -
                       db = {

     

       30
       -
                         type = "badger";

     

       31
       -
                         dataSource = "/var/lib/step-ca/db";

     

       32
       -
                       };

     

       33
       -
                       authority = {

     

       34
       -
                         provisioners = [

     

       35
       -
                           {

     

       36
       -
                             type = "ACME";

     

       37
       -
                             name = "acme";

     

       38
       -
                           }

     

       39
       -
                         ];

     

       40
       -
                       };

     

       41
        
                     };

     

       42
        
                   };

     

       43
        
                 };

     

       0
        
       
     

       44
        
       

     

       45
       -
               caclient =

     

       46
       -
                 { config, pkgs, ... }: {

     

       47
       -
                   security.acme.defaults.server = "https://caserver:8443/acme/acme/directory";

     

       48
       -
                   security.acme.defaults.email = "root@example.org";

     

       49
       -
                   security.acme.acceptTerms = true;

     

       0
        
       
     

       50
        
       

     

       51
       -
                   security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];

     

       52
        
       

     

       53
       -
                   networking.firewall.allowedTCPPorts = [ 80 443 ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       54
        
       

     

       55
       -
                   services.nginx = {

     

       56
       -
                     enable = true;

     

       57
       -
                     virtualHosts = {

     

       58
       -
                       "caclient" = {

     

       59
       -
                         forceSSL = true;

     

       60
       -
                         enableACME = true;

     

       61
       -
                       };

     

       62
        
                     };

     

       63
        
                   };

     

       64
        
                 };

     

       0
        
       
     

       65
        
       

     

       66
       -
               caclientcaddy =

     

       67
       -
                 { config, pkgs, ... }: {

     

       68
       -
                   security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];

     

       0
        
       
     

       69
        
       

     

       70
       -
                   networking.firewall.allowedTCPPorts = [ 80 443 ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       71
        
       

     

       72
       -
                   services.caddy = {

     

       73
       -
                     enable = true;

     

       74
       -
                     virtualHosts."caclientcaddy".extraConfig = ''

     

       75
       -
                       respond "Welcome to Caddy!"

     

       76
        
       

     

       77
       -
                       tls caddy@example.org {

     

       78
       -
                         ca https://caserver:8443/acme/acme/directory

     

       79
       -
                       }

     

       80
       -
                     '';

     

       81
       -
                   };

     

       82
        
                 };

     

       0
        
       
     

       83
        
       

     

       84
       -
               catester = { config, pkgs, ... }: {

     

       0
        
       
     

       0
        
       
     

       85
        
                 security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];

     

       86
        
               };

     

       87
       -
             };

     

       88
        
       

     

       89
       -
           testScript =

     

       90
        
             ''

     

       91
        
               catester.start()

     

       92
        
               caserver.wait_for_unit("step-ca.service")

     
···

       96
        
               catester.succeed("curl https://caclient/ | grep \"Welcome to nginx!\"")

     

       97
        
       

     

       98
        
               caclientcaddy.wait_for_unit("caddy.service")

     

       99
       -
       

     

       100
        
               # It's hard to know when caddy has finished the ACME

     

       101
        
               # dance with step-ca, so we keep trying to curl

     

       102
        
               # until succeess.

     

       103
        
               catester.wait_until_succeeds("curl https://caclientcaddy/ | grep \"Welcome to Caddy!\"")

     

       104
        
             '';

     

       105
       -
         })

     

       0

···

       1
       +
       import ./make-test-python.nix (

     

       2
       +
         { pkgs, ... }:

     

       3
        
         let

     

       4
        
           test-certificates = pkgs.runCommandLocal "test-certificates" { } ''

     

       5
        
             mkdir -p $out

     
···

       11
        
         in

     

       12
        
         {

     

       13
        
           name = "step-ca";

     

       14
       +
           nodes = {

     

       15
       +
             caserver =

     

       16
       +
               { config, pkgs, ... }:

     

       17
       +
               {

     

       18
       +
                 environment.etc.password-file.source = "${test-certificates}/intermediate-password-file";

     

       19
       +
                 services.step-ca = {

     

       20
       +
                   enable = true;

     

       21
       +
                   address = "[::]";

     

       22
       +
                   port = 8443;

     

       23
       +
                   openFirewall = true;

     

       24
       +
                   intermediatePasswordFile = "/etc/${config.environment.etc.password-file.target}";

     

       25
       +
                   settings = {

     

       26
       +
                     dnsNames = [ "caserver" ];

     

       27
       +
                     root = "${test-certificates}/root_ca.crt";

     

       28
       +
                     crt = "${test-certificates}/intermediate_ca.crt";

     

       29
       +
                     key = "${test-certificates}/intermediate_ca.key";

     

       30
       +
                     db = {

     

       31
       +
                       type = "badger";

     

       32
       +
                       dataSource = "/var/lib/step-ca/db";

     

       33
       +
                     };

     

       34
       +
                     authority = {

     

       35
       +
                       provisioners = [

     

       36
       +
                         {

     

       37
       +
                           type = "ACME";

     

       38
       +
                           name = "acme";

     

       39
       +
                         }

     

       40
       +
                       ];

     

       0
        
       
     

       41
        
                     };

     

       42
        
                   };

     

       43
        
                 };

     

       44
       +
               };

     

       45
        
       

     

       46
       +
             caclient =

     

       47
       +
               { config, pkgs, ... }:

     

       48
       +
               {

     

       49
       +
                 security.acme.defaults.server = "https://caserver:8443/acme/acme/directory";

     

       50
       +
                 security.acme.defaults.email = "root@example.org";

     

       51
       +
                 security.acme.acceptTerms = true;

     

       52
        
       

     

       53
       +
                 security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];

     

       54
        
       

     

       55
       +
                 networking.firewall.allowedTCPPorts = [

     

       56
       +
                   80

     

       57
       +
                   443

     

       58
       +
                 ];

     

       59
        
       

     

       60
       +
                 services.nginx = {

     

       61
       +
                   enable = true;

     

       62
       +
                   virtualHosts = {

     

       63
       +
                     "caclient" = {

     

       64
       +
                       forceSSL = true;

     

       65
       +
                       enableACME = true;

     

       0
        
       
     

       66
        
                     };

     

       67
        
                   };

     

       68
        
                 };

     

       69
       +
               };

     

       70
        
       

     

       71
       +
             caclientcaddy =

     

       72
       +
               { config, pkgs, ... }:

     

       73
       +
               {

     

       74
       +
                 security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];

     

       75
        
       

     

       76
       +
                 networking.firewall.allowedTCPPorts = [

     

       77
       +
                   80

     

       78
       +
                   443

     

       79
       +
                 ];

     

       80
        
       

     

       81
       +
                 services.caddy = {

     

       82
       +
                   enable = true;

     

       83
       +
                   virtualHosts."caclientcaddy".extraConfig = ''

     

       84
       +
                     respond "Welcome to Caddy!"

     

       85
        
       

     

       86
       +
                     tls caddy@example.org {

     

       87
       +
                       ca https://caserver:8443/acme/acme/directory

     

       88
       +
                     }

     

       89
       +
                   '';

     

       0
        
       
     

       90
        
                 };

     

       91
       +
               };

     

       92
        
       

     

       93
       +
             catester =

     

       94
       +
               { config, pkgs, ... }:

     

       95
       +
               {

     

       96
        
                 security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];

     

       97
        
               };

     

       98
       +
           };

     

       99
        
       

     

       100
       +
           testScript = # python

     

       101
        
             ''

     

       102
        
               catester.start()

     

       103
        
               caserver.wait_for_unit("step-ca.service")

     
···

       107
        
               catester.succeed("curl https://caclient/ | grep \"Welcome to nginx!\"")

     

       108
        
       

     

       109
        
               caclientcaddy.wait_for_unit("caddy.service")

     

       0
        
       
     

       110
        
               # It's hard to know when caddy has finished the ACME

     

       111
        
               # dance with step-ca, so we keep trying to curl

     

       112
        
               # until succeess.

     

       113
        
               catester.wait_until_succeeds("curl https://caclientcaddy/ | grep \"Welcome to Caddy!\"")

     

       114
        
             '';

     

       115
       +
         }

     

       116
       +
       )