commit 78b4b90d6c9a3310b8a8ba3ac450240d03199bf0 · pyrox.dev/nixpkgs

+52

nixos/doc/manual/release-notes/rl-1809.xml

···

       175
        
            for further reference.

     

       176
        
           </para>

     

       177
        
          </listitem>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       178
        
         </itemizedlist>

     

       179
        
        </section>

     

       180
        
       </section>

···

       175
        
            for further reference.

     

       176
        
           </para>

     

       177
        
          </listitem>

     

       178
       +
          <listitem>

     

       179
       +
           <para>

     

       180
       +
            The module for <option>security.dhparams</option> has two new options now:

     

       181
       +
           </para>

     

       182
       +
       

     

       183
       +
           <variablelist>

     

       184
       +
            <varlistentry>

     

       185
       +
             <term><option>security.dhparams.stateless</option></term>

     

       186
       +
             <listitem><para>

     

       187
       +
              Puts the generated Diffie-Hellman parameters into the Nix store instead

     

       188
       +
              of managing them in a stateful manner in

     

       189
       +
              <filename class="directory">/var/lib/dhparams</filename>.

     

       190
       +
             </para></listitem>

     

       191
       +
            </varlistentry>

     

       192
       +
            <varlistentry>

     

       193
       +
             <term><option>security.dhparams.defaultBitSize</option></term>

     

       194
       +
             <listitem><para>

     

       195
       +
              The default bit size to use for the generated Diffie-Hellman parameters.

     

       196
       +
             </para></listitem>

     

       197
       +
            </varlistentry>

     

       198
       +
           </variablelist>

     

       199
       +
       

     

       200
       +
           <note><para>

     

       201
       +
            The path to the actual generated parameter files should now be queried

     

       202
       +
            using

     

       203
       +
            <literal>config.security.dhparams.params.<replaceable>name</replaceable>.path</literal>

     

       204
       +
            because it might be either in the Nix store or in a directory configured

     

       205
       +
            by <option>security.dhparams.path</option>.

     

       206
       +
           </para></note>

     

       207
       +
       

     

       208
       +
           <note>

     

       209
       +
            <title>For developers:</title>

     

       210
       +
            <para>

     

       211
       +
             Module implementers should not set a specific bit size in order to let

     

       212
       +
             users configure it by themselves if they want to have a different bit

     

       213
       +
             size than the default (2048).

     

       214
       +
            </para>

     

       215
       +
            <para>

     

       216
       +
             An example usage of this would be:

     

       217
       +
       <programlisting>

     

       218
       +
       { config, ... }:

     

       219
       +
       

     

       220
       +
       {

     

       221
       +
         security.dhparams.params.myservice = {};

     

       222
       +
         environment.etc."myservice.conf".text = ''

     

       223
       +
           dhparams = ${config.security.dhparams.params.myservice.path}

     

       224
       +
         '';

     

       225
       +
       }

     

       226
       +
       </programlisting>

     

       227
       +
            </para>

     

       228
       +
           </note>

     

       229
       +
          </listitem>

     

       230
        
         </itemizedlist>

     

       231
        
        </section>

     

       232
        
       </section>

+144 -78

nixos/modules/security/dhparams.nix

···

       1
        
       { config, lib, pkgs, ... }:

     

       2
        
       

     

       3
       -
       with lib;

     

       4
        
       let

     

       0
        
       
     

       5
        
         cfg = config.security.dhparams;

     

       6
       -
       in

     

       7
       -
       {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       8
        
         options = {

     

       9
        
           security.dhparams = {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       10
        
             params = mkOption {

     

       11
       -
               description =

     

       12
       -
                 ''

     

       13
       -
                   Diffie-Hellman parameters to generate.

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       14
        
       

     

       15
       -
                   The value is the size (in bits) of the DH params to generate. The

     

       16
       -
                   generated DH params path can be found in

     

       17
       -
                   <filename><replaceable>security.dhparams.path</replaceable>/<replaceable>name</replaceable>.pem</filename>.

     

       18
        
       

     

       19
       -
                   Note: The name of the DH params is taken as being the name of the

     

       20
       -
                   service it serves: the params will be generated before the said

     

       21
       -
                   service is started.

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       22
        
       

     

       23
       -
                   Warning: If you are removing all dhparams from this list, you have

     

       24
       -
                   to leave security.dhparams.enable for at least one activation in

     

       25
       -
                   order to have them be cleaned up. This also means if you rollback to

     

       26
       -
                   a version without any dhparams the existing ones won't be cleaned

     

       27
       -
                   up.

     

       28
       -
                 '';

     

       29
       -
               type = with types; attrsOf int;

     

       30
       -
               default = {};

     

       31
       -
               example = { nginx = 3072; };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       32
        
             };

     

       33
        
       

     

       34
        
             path = mkOption {

     

       35
       -
               description =

     

       36
       -
                 ''

     

       37
       -
                   Path to the directory in which Diffie-Hellman parameters will be

     

       38
       -
                   stored.

     

       39
       -
                 '';

     

       40
        
               type = types.str;

     

       41
        
               default = "/var/lib/dhparams";

     

       42
       -
             };

     

       43
       -
       

     

       44
       -
             enable = mkOption {

     

       45
       -
               description =

     

       46
       -
                 ''

     

       47
       -
                   Whether to generate new DH params and clean up old DH params.

     

       48
       -
                 '';

     

       49
       -
               default = false;

     

       50
       -
               type = types.bool;

     

       51
        
             };

     

       52
        
           };

     

       53
        
         };

     

       54
        
       

     

       55
       -
         config = mkIf cfg.enable {

     

       56
        
           systemd.services = {

     

       57
        
             dhparams-init = {

     

       58
       -
               description = "Cleanup old Diffie-Hellman parameters";

     

       59
       -
               wantedBy = [ "multi-user.target" ]; # Clean up even when no DH params is set

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       60
        
               serviceConfig.Type = "oneshot";

     

       61
       -
               script =

     

       62
       -
                 # Create directory

     

       63
       -
                 ''

     

       64
       -
                   if [ ! -d ${cfg.path} ]; then

     

       65
       -
                     mkdir -p ${cfg.path}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       66
        
                   fi

     

       67
       -
                 '' +

     

       68
       -
                 # Remove old dhparams

     

       69
       -
                 ''

     

       70
       -
                   for file in ${cfg.path}/*; do

     

       71
       -
                     if [ ! -f "$file" ]; then

     

       72
        
                       continue

     

       73
        
                     fi

     

       74
       -
                 '' + concatStrings (mapAttrsToList (name: value:

     

       75
       -
                 ''

     

       76
       -
                     if [ "$file" == "${cfg.path}/${name}.pem" ] && \

     

       77
       -
                         ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text | head -n 1 | grep "(${toString value} bit)" > /dev/null; then

     

       78
       -
                       continue

     

       79
       -
                     fi

     

       80
       -
                 ''

     

       81
       -
                 ) cfg.params) +

     

       82
       -
                 ''

     

       83
       -
                     rm $file

     

       84
       -
                   done

     

       85
        
       

     

       86
       -
                   # TODO: Ideally this would be removing the *former* cfg.path, though this

     

       87
       -
                   # does not seem really important as changes to it are quite unlikely

     

       88
       -
                   rmdir --ignore-fail-on-non-empty ${cfg.path}

     

       89
       -
                 '';

     

       0
        
       
     

       90
        
             };

     

       91
       -
           } //

     

       92
       -
             mapAttrs' (name: value: nameValuePair "dhparams-gen-${name}" {

     

       93
       -
               description = "Generate Diffie-Hellman parameters for ${name} if they don't exist yet";

     

       94
       -
               after = [ "dhparams-init.service" ];

     

       95
       -
               before = [ "${name}.service" ];

     

       96
       -
               wantedBy = [ "multi-user.target" ];

     

       97
       -
               serviceConfig.Type = "oneshot";

     

       98
       -
               script =

     

       99
       -
                 ''

     

       100
       -
                   mkdir -p ${cfg.path}

     

       101
       -
                   if [ ! -f ${cfg.path}/${name}.pem ]; then

     

       102
       -
                     ${pkgs.openssl}/bin/openssl dhparam -out ${cfg.path}/${name}.pem ${toString value}

     

       103
       -
                   fi

     

       104
       -
                 '';

     

       105
       -
             }) cfg.params;

     

       106
        
         };

     

       107
        
       }

···

       1
        
       { config, lib, pkgs, ... }:

     

       2
        
       

     

       0
        
       
     

       3
        
       let

     

       4
       +
         inherit (lib) mkOption types;

     

       5
        
         cfg = config.security.dhparams;

     

       6
       +
       

     

       7
       +
         bitType = types.addCheck types.int (b: b >= 16) // {

     

       8
       +
           name = "bits";

     

       9
       +
           description = "integer of at least 16 bits";

     

       10
       +
         };

     

       11
       +
       

     

       12
       +
         paramsSubmodule = { name, config, ... }: {

     

       13
       +
           options.bits = mkOption {

     

       14
       +
             type = bitType;

     

       15
       +
             default = cfg.defaultBitSize;

     

       16
       +
             description = ''

     

       17
       +
               The bit size for the prime that is used during a Diffie-Hellman

     

       18
       +
               key exchange.

     

       19
       +
             '';

     

       20
       +
           };

     

       21
       +
       

     

       22
       +
           options.path = mkOption {

     

       23
       +
             type = types.path;

     

       24
       +
             readOnly = true;

     

       25
       +
             description = ''

     

       26
       +
               The resulting path of the generated Diffie-Hellman parameters

     

       27
       +
               file for other services to reference. This could be either a

     

       28
       +
               store path or a file inside the directory specified by

     

       29
       +
               <option>security.dhparams.path</option>.

     

       30
       +
             '';

     

       31
       +
           };

     

       32
       +
       

     

       33
       +
           config.path = let

     

       34
       +
             generated = pkgs.runCommand "dhparams-${name}.pem" {

     

       35
       +
               nativeBuildInputs = [ pkgs.openssl ];

     

       36
       +
             } "openssl dhparam -out \"$out\" ${toString config.bits}";

     

       37
       +
           in if cfg.stateful then "${cfg.path}/${name}.pem" else generated;

     

       38
       +
         };

     

       39
       +
       

     

       40
       +
       in {

     

       41
        
         options = {

     

       42
        
           security.dhparams = {

     

       43
       +
             enable = mkOption {

     

       44
       +
               type = types.bool;

     

       45
       +
               default = false;

     

       46
       +
               description = ''

     

       47
       +
                 Whether to generate new DH params and clean up old DH params.

     

       48
       +
               '';

     

       49
       +
             };

     

       50
       +
       

     

       51
        
             params = mkOption {

     

       52
       +
               type = with types; let

     

       53
       +
                 coerce = bits: { inherit bits; };

     

       54
       +
               in attrsOf (coercedTo int coerce (submodule paramsSubmodule));

     

       55
       +
               default = {};

     

       56
       +
               example = lib.literalExample "{ nginx.bits = 3072; }";

     

       57
       +
               description = ''

     

       58
       +
                 Diffie-Hellman parameters to generate.

     

       59
       +
       

     

       60
       +
                 The value is the size (in bits) of the DH params to generate. The

     

       61
       +
                 generated DH params path can be found in

     

       62
       +
                 <literal>config.security.dhparams.params.<replaceable>name</replaceable>.path</literal>.

     

       63
        
       

     

       64
       +
                 <note><para>The name of the DH params is taken as being the name of

     

       65
       +
                 the service it serves and the params will be generated before the

     

       66
       +
                 said service is started.</para></note>

     

       67
        
       

     

       68
       +
                 <warning><para>If you are removing all dhparams from this list, you

     

       69
       +
                 have to leave <option>security.dhparams.enable</option> for at

     

       70
       +
                 least one activation in order to have them be cleaned up. This also

     

       71
       +
                 means if you rollback to a version without any dhparams the

     

       72
       +
                 existing ones won't be cleaned up. Of course this only applies if

     

       73
       +
                 <option>security.dhparams.stateful</option> is

     

       74
       +
                 <literal>true</literal>.</para></warning>

     

       75
       +
       

     

       76
       +
                 <note><title>For module implementers:</title><para>It's recommended

     

       77
       +
                 to not set a specific bit size here, so that users can easily

     

       78
       +
                 override this by setting

     

       79
       +
                 <option>security.dhparams.defaultBitSize</option>.</para></note>

     

       80
       +
               '';

     

       81
       +
             };

     

       82
       +
       

     

       83
       +
             stateful = mkOption {

     

       84
       +
               type = types.bool;

     

       85
       +
               default = true;

     

       86
       +
               description = ''

     

       87
       +
                 Whether generation of Diffie-Hellman parameters should be stateful or

     

       88
       +
                 not. If this is enabled, PEM-encoded files for Diffie-Hellman

     

       89
       +
                 parameters are placed in the directory specified by

     

       90
       +
                 <option>security.dhparams.path</option>. Otherwise the files are

     

       91
       +
                 created within the Nix store.

     

       92
        
       

     

       93
       +
                 <note><para>If this is <literal>false</literal> the resulting store

     

       94
       +
                 path will be non-deterministic and will be rebuilt every time the

     

       95
       +
                 <package>openssl</package> package changes.</para></note>

     

       96
       +
               '';

     

       97
       +
             };

     

       98
       +
       

     

       99
       +
             defaultBitSize = mkOption {

     

       100
       +
               type = bitType;

     

       101
       +
               default = 2048;

     

       102
       +
               description = ''

     

       103
       +
                 This allows to override the default bit size for all of the

     

       104
       +
                 Diffie-Hellman parameters set in

     

       105
       +
                 <option>security.dhparams.params</option>.

     

       106
       +
               '';

     

       107
        
             };

     

       108
        
       

     

       109
        
             path = mkOption {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       110
        
               type = types.str;

     

       111
        
               default = "/var/lib/dhparams";

     

       112
       +
               description = ''

     

       113
       +
                 Path to the directory in which Diffie-Hellman parameters will be

     

       114
       +
                 stored. This only is relevant if

     

       115
       +
                 <option>security.dhparams.stateful</option> is

     

       116
       +
                 <literal>true</literal>.

     

       117
       +
               '';

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       118
        
             };

     

       119
        
           };

     

       120
        
         };

     

       121
        
       

     

       122
       +
         config = lib.mkIf (cfg.enable && cfg.stateful) {

     

       123
        
           systemd.services = {

     

       124
        
             dhparams-init = {

     

       125
       +
               description = "Clean Up Old Diffie-Hellman Parameters";

     

       126
       +
       

     

       127
       +
               # Clean up even when no DH params is set

     

       128
       +
               wantedBy = [ "multi-user.target" ];

     

       129
       +
       

     

       130
       +
               serviceConfig.RemainAfterExit = true;

     

       131
        
               serviceConfig.Type = "oneshot";

     

       132
       +
       

     

       133
       +
               script = ''

     

       134
       +
                 if [ ! -d ${cfg.path} ]; then

     

       135
       +
                   mkdir -p ${cfg.path}

     

       136
       +
                 fi

     

       137
       +
       

     

       138
       +
                 # Remove old dhparams

     

       139
       +
                 for file in ${cfg.path}/*; do

     

       140
       +
                   if [ ! -f "$file" ]; then

     

       141
       +
                     continue

     

       142
        
                   fi

     

       143
       +
                   ${lib.concatStrings (lib.mapAttrsToList (name: { bits, path, ... }: ''

     

       144
       +
                     if [ "$file" = ${lib.escapeShellArg path} ] && \

     

       145
       +
                        ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \

     

       146
       +
                        | head -n 1 | grep "(${toString bits} bit)" > /dev/null; then

     

       0
        
       
     

       147
        
                       continue

     

       148
        
                     fi

     

       149
       +
                   '') cfg.params)}

     

       150
       +
                   rm $file

     

       151
       +
                 done

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       152
        
       

     

       153
       +
                 # TODO: Ideally this would be removing the *former* cfg.path, though

     

       154
       +
                 # this does not seem really important as changes to it are quite

     

       155
       +
                 # unlikely

     

       156
       +
                 rmdir --ignore-fail-on-non-empty ${cfg.path}

     

       157
       +
               '';

     

       158
        
             };

     

       159
       +
           } // lib.mapAttrs' (name: { bits, path, ... }: lib.nameValuePair "dhparams-gen-${name}" {

     

       160
       +
             description = "Generate Diffie-Hellman Parameters for ${name}";

     

       161
       +
             after = [ "dhparams-init.service" ];

     

       162
       +
             before = [ "${name}.service" ];

     

       163
       +
             wantedBy = [ "multi-user.target" ];

     

       164
       +
             unitConfig.ConditionPathExists = "!${path}";

     

       165
       +
             serviceConfig.Type = "oneshot";

     

       166
       +
             script = ''

     

       167
       +
               mkdir -p ${lib.escapeShellArg cfg.path}

     

       168
       +
               ${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \

     

       169
       +
                 ${toString bits}

     

       170
       +
             '';

     

       171
       +
           }) cfg.params;

     

       0
        
       
     

       0
        
       
     

       172
        
         };

     

       173
        
       }

nixos/release.nix

···

       269
        
         tests.containers-macvlans = callTest tests/containers-macvlans.nix {};

     

       270
        
         tests.couchdb = callTest tests/couchdb.nix {};

     

       271
        
         tests.deluge = callTest tests/deluge.nix {};

     

       0
        
       
     

       272
        
         tests.docker = callTestOnMatchingSystems ["x86_64-linux"] tests/docker.nix {};

     

       273
        
         tests.docker-tools = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools.nix {};

     

       274
        
         tests.docker-tools-overlay = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools-overlay.nix {};

···

       269
        
         tests.containers-macvlans = callTest tests/containers-macvlans.nix {};

     

       270
        
         tests.couchdb = callTest tests/couchdb.nix {};

     

       271
        
         tests.deluge = callTest tests/deluge.nix {};

     

       272
       +
         tests.dhparams = callTest tests/dhparams.nix {};

     

       273
        
         tests.docker = callTestOnMatchingSystems ["x86_64-linux"] tests/docker.nix {};

     

       274
        
         tests.docker-tools = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools.nix {};

     

       275
        
         tests.docker-tools-overlay = callTestOnMatchingSystems ["x86_64-linux"] tests/docker-tools-overlay.nix {};

+144

nixos/tests/dhparams.nix

···

       1
       +
       let

     

       2
       +
         common = { pkgs, ... }: {

     

       3
       +
           security.dhparams.enable = true;

     

       4
       +
           environment.systemPackages = [ pkgs.openssl ];

     

       5
       +
         };

     

       6
       +
       

     

       7
       +
       in import ./make-test.nix {

     

       8
       +
         name = "dhparams";

     

       9
       +
       

     

       10
       +
         nodes.generation1 = { pkgs, config, ... }: {

     

       11
       +
           imports = [ common ];

     

       12
       +
           security.dhparams.params = {

     

       13
       +
             # Use low values here because we don't want the test to run for ages.

     

       14
       +
             foo.bits = 16;

     

       15
       +
             # Also use the old format to make sure the type is coerced in the right

     

       16
       +
             # way.

     

       17
       +
             bar = 17;

     

       18
       +
           };

     

       19
       +
       

     

       20
       +
           systemd.services.foo = {

     

       21
       +
             description = "Check systemd Ordering";

     

       22
       +
             wantedBy = [ "multi-user.target" ];

     

       23
       +
             unitConfig = {

     

       24
       +
               # This is to make sure that the dhparams generation of foo occurs

     

       25
       +
               # before this service so we need this service to start as early as

     

       26
       +
               # possible to provoke a race condition.

     

       27
       +
               DefaultDependencies = false;

     

       28
       +
       

     

       29
       +
               # We check later whether the service has been started or not.

     

       30
       +
               ConditionPathExists = config.security.dhparams.params.foo.path;

     

       31
       +
             };

     

       32
       +
             serviceConfig.Type = "oneshot";

     

       33
       +
             serviceConfig.RemainAfterExit = true;

     

       34
       +
             # The reason we only provide an ExecStop here is to ensure that we don't

     

       35
       +
             # accidentally trigger an error because a file system is not yet ready

     

       36
       +
             # during very early startup (we might not even have the Nix store

     

       37
       +
             # available, for example if future changes in NixOS use systemd mount

     

       38
       +
             # units to do early file system initialisation).

     

       39
       +
             serviceConfig.ExecStop = "${pkgs.coreutils}/bin/true";

     

       40
       +
           };

     

       41
       +
         };

     

       42
       +
       

     

       43
       +
         nodes.generation2 = {

     

       44
       +
           imports = [ common ];

     

       45
       +
           security.dhparams.params.foo.bits = 18;

     

       46
       +
         };

     

       47
       +
       

     

       48
       +
         nodes.generation3 = common;

     

       49
       +
       

     

       50
       +
         nodes.generation4 = {

     

       51
       +
           imports = [ common ];

     

       52
       +
           security.dhparams.stateful = false;

     

       53
       +
           security.dhparams.params.foo2.bits = 18;

     

       54
       +
           security.dhparams.params.bar2.bits = 19;

     

       55
       +
         };

     

       56
       +
       

     

       57
       +
         nodes.generation5 = {

     

       58
       +
           imports = [ common ];

     

       59
       +
           security.dhparams.defaultBitSize = 30;

     

       60
       +
           security.dhparams.params.foo3 = {};

     

       61
       +
           security.dhparams.params.bar3 = {};

     

       62
       +
         };

     

       63
       +
       

     

       64
       +
         testScript = { nodes, ... }: let

     

       65
       +
           getParamPath = gen: name: let

     

       66
       +
             node = "generation${toString gen}";

     

       67
       +
           in nodes.${node}.config.security.dhparams.params.${name}.path;

     

       68
       +
       

     

       69
       +
           assertParamBits = gen: name: bits: let

     

       70
       +
             path = getParamPath gen name;

     

       71
       +
           in ''

     

       72
       +
             $machine->nest('check bit size of ${path}', sub {

     

       73
       +
               my $out = $machine->succeed('openssl dhparam -in ${path} -text');

     

       74
       +
               $out =~ /^\s*DH Parameters:\s+\((\d+)\s+bit\)\s*$/m;

     

       75
       +
               die "bit size should be ${toString bits} but it is $1 instead."

     

       76
       +
                 if $1 != ${toString bits};

     

       77
       +
             });

     

       78
       +
           '';

     

       79
       +
       

     

       80
       +
           switchToGeneration = gen: let

     

       81
       +
             node = "generation${toString gen}";

     

       82
       +
             inherit (nodes.${node}.config.system.build) toplevel;

     

       83
       +
             switchCmd = "${toplevel}/bin/switch-to-configuration test";

     

       84
       +
           in ''

     

       85
       +
             $machine->nest('switch to generation ${toString gen}', sub {

     

       86
       +
               $machine->succeed('${switchCmd}');

     

       87
       +
               $main::machine = ''$${node};

     

       88
       +
             });

     

       89
       +
           '';

     

       90
       +
       

     

       91
       +
         in ''

     

       92
       +
           my $machine = $generation1;

     

       93
       +
       

     

       94
       +
           $machine->waitForUnit('multi-user.target');

     

       95
       +
       

     

       96
       +
           subtest "verify startup order", sub {

     

       97
       +
             $machine->succeed('systemctl is-active foo.service');

     

       98
       +
           };

     

       99
       +
       

     

       100
       +
           subtest "check bit sizes of dhparam files", sub {

     

       101
       +
             ${assertParamBits 1 "foo" 16}

     

       102
       +
             ${assertParamBits 1 "bar" 17}

     

       103
       +
           };

     

       104
       +
       

     

       105
       +
           ${switchToGeneration 2}

     

       106
       +
       

     

       107
       +
           subtest "check whether bit size has changed", sub {

     

       108
       +
             ${assertParamBits 2 "foo" 18}

     

       109
       +
           };

     

       110
       +
       

     

       111
       +
           subtest "ensure that dhparams file for 'bar' was deleted", sub {

     

       112
       +
             $machine->fail('test -e ${getParamPath 1 "bar"}');

     

       113
       +
           };

     

       114
       +
       

     

       115
       +
           ${switchToGeneration 3}

     

       116
       +
       

     

       117
       +
           subtest "ensure that 'security.dhparams.path' has been deleted", sub {

     

       118
       +
             $machine->fail(

     

       119
       +
               'test -e ${nodes.generation3.config.security.dhparams.path}'

     

       120
       +
             );

     

       121
       +
           };

     

       122
       +
       

     

       123
       +
           ${switchToGeneration 4}

     

       124
       +
       

     

       125
       +
           subtest "check bit sizes dhparam files", sub {

     

       126
       +
             ${assertParamBits 4 "foo2" 18}

     

       127
       +
             ${assertParamBits 4 "bar2" 19}

     

       128
       +
           };

     

       129
       +
       

     

       130
       +
           subtest "check whether dhparam files are in the Nix store", sub {

     

       131
       +
             $machine->succeed(

     

       132
       +
               'expr match ${getParamPath 4 "foo2"} ${builtins.storeDir}',

     

       133
       +
               'expr match ${getParamPath 4 "bar2"} ${builtins.storeDir}',

     

       134
       +
             );

     

       135
       +
           };

     

       136
       +
       

     

       137
       +
           ${switchToGeneration 5}

     

       138
       +
       

     

       139
       +
           subtest "check whether defaultBitSize works as intended", sub {

     

       140
       +
             ${assertParamBits 5 "foo3" 30}

     

       141
       +
             ${assertParamBits 5 "bar3" 30}

     

       142
       +
           };

     

       143
       +
         '';

     

       144
       +
       }