Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284/* Pleroma E2E VM test.
Abstract: ========= Using pleroma, postgresql, a local CA cert, a nginx reverse proxy and a toot-based client, we're going to:
1. Provision a pleroma service from scratch (pleroma config + postgres db). 2. Create a "jamy" admin user. 3. Send a toot from this user. 4. Send a upload from this user. 5. Check the toot is part of the server public timeline
Notes: - We need a fully functional TLS setup without having any access to the internet. We do that by issuing a self-signed cert, add this self-cert to the hosts pki trust store and finally spoof the hostnames using /etc/hosts. - For this NixOS test, we *had* to store some DB-related and pleroma-related secrets to the store. Keep in mind the store is world-readable, it's the worst place possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD DEPLOYMENT**.*/
import ./make-test-python.nix ( { pkgs, ... }: let send-toot = pkgs.writeScriptBin "send-toot" '' set -eux # toot is using the requests library internally. This library # sadly embed its own certificate store instead of relying on the # system one. Overriding this pretty bad default behaviour. export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
toot login_cli -i "pleroma.nixos.test" -e "jamy@nixos.test" -p 'jamy-password' echo "Login OK"
# Send a toot then verify it's part of the public timeline toot post "hello world Jamy here" echo "Send toot OK" toot timeline -1 | grep -F -q "hello world Jamy here" echo "Get toot from timeline OK"
# Test file upload echo "y" | ${pkgs.toot}/bin/toot upload <(dd if=/dev/zero bs=1024 count=1024 status=none) \ | grep -F -q "https://pleroma.nixos.test/media"
echo "=====================================================" echo "= SUCCESS =" echo "= =" echo "= We were able to sent a toot + a upload and =" echo "= retrieve both of them in the public timeline. =" echo "=====================================================" '';
provision-db = pkgs.writeScriptBin "provision-db" '' set -eux sudo -u postgres psql -f ${db-seed} '';
test-db-passwd = "SccZOvTGM//BMrpoQj68JJkjDkMGb4pHv2cECWiI+XhVe3uGJTLI0vFV/gDlZ5jJ";
/* For this NixOS test, we *had* to store this secret to the store. Keep in mind the store is world-readable, it's the worst place possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD DEPLOYMENT**. */ db-seed = pkgs.writeText "provision.psql" '' CREATE USER pleroma WITH ENCRYPTED PASSWORD '${test-db-passwd}'; CREATE DATABASE pleroma OWNER pleroma; \c pleroma; --Extensions made by ecto.migrate that need superuser access CREATE EXTENSION IF NOT EXISTS citext; CREATE EXTENSION IF NOT EXISTS pg_trgm; CREATE EXTENSION IF NOT EXISTS "uuid-ossp"; '';
pleroma-conf = '' import Config
config :pleroma, Pleroma.Web.Endpoint, url: [host: "pleroma.nixos.test", scheme: "https", port: 443], http: [ip: {127, 0, 0, 1}, port: 4000]
config :pleroma, :instance, name: "NixOS test pleroma server", email: "pleroma@nixos.test", notify_email: "pleroma@nixos.test", limit: 5000, registrations_open: true
config :pleroma, :media_proxy, enabled: false, redirect_on_failure: true #base_url: "https://cache.pleroma.social"
config :pleroma, Pleroma.Repo, adapter: Ecto.Adapters.Postgres, username: "pleroma", password: "${test-db-passwd}", database: "pleroma", hostname: "localhost", pool_size: 10, prepare: :named, parameters: [ plan_cache_mode: "force_custom_plan" ]
config :pleroma, :database, rum_enabled: false config :pleroma, :instance, static_dir: "/var/lib/pleroma/static" config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads" config :pleroma, configurable_from_database: false '';
/* For this NixOS test, we *had* to store this secret to the store. Keep in mind the store is world-readable, it's the worst place possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD DEPLOYMENT**. In a real-word deployment, you'd handle this either by: - manually upload your pleroma secrets to /var/lib/pleroma/secrets.exs - use a deployment tool such as morph or NixOps to deploy your secrets. */ pleroma-conf-secret = pkgs.writeText "secrets.exs" '' import Config
config :joken, default_signer: "PS69/wMW7X6FIQPABt9lwvlZvgrJIncfiAMrK9J5mjVus/7/NJJi1DsDA1OghBE5"
config :pleroma, Pleroma.Web.Endpoint, secret_key_base: "NvfmU7lYaQrmmxt4NACm0AaAfN9t6WxsrX0NCB4awkGHvr1S7jyshlEmrjaPFhhq", signing_salt: "3L41+BuJ"
config :web_push_encryption, :vapid_details, subject: "mailto:pleroma@nixos.test", public_key: "BKjfNX9-UqAcncaNqERQtF7n9pKrB0-MO-juv6U5E5XQr_Tg5D-f8AlRjduAguDpyAngeDzG8MdrTejMSL4VF30", private_key: "k7o9onKMQrgMjMb6l4fsxSaXO0BTNAer5MVSje3q60k" '';
/* For this NixOS test, we *had* to store this secret to the store. Keep in mind the store is world-readable, it's the worst place possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD DEPLOYMENT**. In a real-word deployment, you'd handle this either by: - manually upload your pleroma secrets to /var/lib/pleroma/secrets.exs - use a deployment tool such as morph or NixOps to deploy your secrets. */ provision-secrets = pkgs.writeScriptBin "provision-secrets" '' set -eux cp "${pleroma-conf-secret}" "/var/lib/pleroma/secrets.exs" chown pleroma:pleroma /var/lib/pleroma/secrets.exs '';
/* For this NixOS test, we *had* to store this secret to the store. Keep in mind the store is world-readable, it's the worst place possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD DEPLOYMENT**. */ provision-user = pkgs.writeScriptBin "provision-user" '' set -eux
# Waiting for pleroma to be up. timeout 5m bash -c 'while [[ "$(curl -s -o /dev/null -w '%{http_code}' https://pleroma.nixos.test/api/v1/instance)" != "200" ]]; do sleep 2; done' # Toremove the RELEASE_COOKIE bit when https://github.com/NixOS/nixpkgs/issues/166229 gets fixed. RELEASE_COOKIE="/var/lib/pleroma/.cookie" \ pleroma_ctl user new jamy jamy@nixos.test --password 'jamy-password' --moderator --admin -y '';
tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } '' mkdir -p $out openssl req -x509 \ -subj '/CN=pleroma.nixos.test/' -days 49710 \ -addext 'subjectAltName = DNS:pleroma.nixos.test' \ -keyout "$out/key.pem" -newkey ed25519 \ -out "$out/cert.pem" -noenc '';
hosts = nodes: '' ${nodes.pleroma.networking.primaryIPAddress} pleroma.nixos.test ${nodes.client.networking.primaryIPAddress} client.nixos.test ''; in { name = "pleroma"; nodes = { client = { nodes, pkgs, config, ... }: { security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ]; networking.extraHosts = hosts nodes; environment.systemPackages = [ pkgs.toot send-toot ]; }; pleroma = { nodes, pkgs, config, ... }: { security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ]; networking.extraHosts = hosts nodes; networking.firewall.enable = false; environment.systemPackages = [ provision-db provision-secrets provision-user ]; services = { pleroma = { enable = true; configs = [ pleroma-conf ]; }; postgresql = { enable = true; package = pkgs.postgresql_13; }; nginx = { enable = true; virtualHosts."pleroma.nixos.test" = { addSSL = true; sslCertificate = "${tls-cert}/cert.pem"; sslCertificateKey = "${tls-cert}/key.pem"; locations."/" = { proxyPass = "http://127.0.0.1:4000"; extraConfig = '' add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always; add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always; add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always; if ($request_method = OPTIONS) { return 204; } add_header X-XSS-Protection "1; mode=block"; add_header X-Permitted-Cross-Domain-Policies none; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; add_header Referrer-Policy same-origin; add_header X-Download-Options noopen; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; client_max_body_size 16m; ''; }; }; }; }; }; };
testScript = { nodes, ... }: '' pleroma.wait_for_unit("postgresql.target") pleroma.wait_until_succeeds("ls /var/lib/pleroma") pleroma.succeed("provision-db") pleroma.wait_for_file("/var/lib/pleroma") pleroma.succeed("provision-secrets") pleroma.systemctl("restart pleroma-migrations.service") pleroma.systemctl("restart pleroma.service") pleroma.wait_for_unit("pleroma.service") pleroma.succeed("provision-user") client.succeed("send-toot") '';
meta.timeout = 600; })