Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298{ pkgs, ... }:let snakeOil = pkgs.runCommand "snakeoil-certs" { outputs = [ "out" "cacert" "cert" "key" "crl" ]; buildInputs = [ pkgs.gnutls.bin ]; caTemplate = pkgs.writeText "snakeoil-ca.template" '' cn = server expiration_days = -1 cert_signing_key ca ''; certTemplate = pkgs.writeText "snakeoil-cert.template" '' cn = server expiration_days = -1 tls_www_server encryption_key signing_key ''; crlTemplate = pkgs.writeText "snakeoil-crl.template" '' expiration_days = -1 ''; userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" '' organization = snakeoil cn = server expiration_days = -1 tls_www_client encryption_key signing_key ''; } '' certtool -p --bits 4096 --outfile ca.key certtool -s --template "$caTemplate" --load-privkey ca.key \ --outfile "$cacert" certtool -p --bits 4096 --outfile "$key" certtool -c --template "$certTemplate" \ --load-ca-privkey ca.key \ --load-ca-certificate "$cacert" \ --load-privkey "$key" \ --outfile "$cert" certtool --generate-crl --template "$crlTemplate" \ --load-ca-privkey ca.key \ --load-ca-certificate "$cacert" \ --outfile "$crl"
mkdir "$out"
# Stripping key information before the actual PEM-encoded values is solely # to make test output a bit less verbose when copying the client key to the # actual client. certtool -p --bits 4096 | sed -n \ -e '/^----* *BEGIN/,/^----* *END/p' > "$out/alice.key"
certtool -c --template "$userCertTemplate" \ --load-privkey "$out/alice.key" \ --load-ca-privkey ca.key \ --load-ca-certificate "$cacert" \ --outfile "$out/alice.cert" '';
in{ name = "taskserver";
nodes = rec { server = { services.taskserver.enable = true; services.taskserver.listenHost = "::"; services.taskserver.openFirewall = true; services.taskserver.fqdn = "server"; services.taskserver.organisations = { testOrganisation.users = [ "alice" "foo" ]; anotherOrganisation.users = [ "bob" ]; };
specialisation.manual_config.configuration = { services.taskserver.pki.manual = { ca.cert = snakeOil.cacert; server.cert = snakeOil.cert; server.key = snakeOil.key; server.crl = snakeOil.crl; }; }; };
client1 = { pkgs, ... }: { environment.systemPackages = [ pkgs.taskwarrior2 pkgs.gnutls ]; users.users.alice.isNormalUser = true; users.users.bob.isNormalUser = true; users.users.foo.isNormalUser = true; users.users.bar.isNormalUser = true; };
client2 = client1; };
testScript = { nodes, ... }: let cfg = nodes.server.services.taskserver; portStr = toString cfg.listenPort; specialisations = "${nodes.server.system.build.toplevel}/specialisation"; newServerSystem = "${specialisations}/manual_config"; switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test"; in '' from shlex import quote
def su(user, cmd): return f"su - {user} -c {quote(cmd)}"
def no_extra_init(client, org, user): pass
def setup_clients_for(org, user, extra_init=no_extra_init): for client in [client1, client2]: with client.nested(f"initialize client for user {user}"): client.succeed( su(user, f"rm -rf /home/{user}/.task"), su(user, "task rc.confirmation=no config confirmation no"), )
exportinfo = server.succeed(f"nixos-taskserver user export {org} {user}")
with client.nested("importing taskwarrior configuration"): client.succeed(su(user, f"eval {quote(exportinfo)} >&2"))
extra_init(client, org, user)
client.succeed(su(user, "task config taskd.server server:${portStr} >&2"))
client.succeed(su(user, "task sync init >&2"))
def restart_server(): server.systemctl("restart taskserver.service") server.wait_for_open_port(${portStr})
def re_add_imperative_user(): with server.nested("(re-)add imperative user bar"): server.execute("nixos-taskserver org remove imperativeOrg") server.succeed( "nixos-taskserver org add imperativeOrg", "nixos-taskserver user add imperativeOrg bar", ) setup_clients_for("imperativeOrg", "bar")
def test_sync(user): with subtest(f"sync for user {user}"): client1.succeed(su(user, "task add foo >&2")) client1.succeed(su(user, "task sync >&2")) client2.fail(su(user, "task list >&2")) client2.succeed(su(user, "task sync >&2")) client2.succeed(su(user, "task list >&2"))
def check_client_cert(user): # debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040 cmd = ( f"gnutls-cli -d 3" f" --x509cafile=/home/{user}/.task/keys/ca.cert" f" --x509keyfile=/home/{user}/.task/keys/private.key" f" --x509certfile=/home/{user}/.task/keys/public.cert" f" --port=${portStr} server < /dev/null" ) return su(user, cmd)
# Explicitly start the VMs so that we don't accidentally start newServer server.start() client1.start() client2.start()
server.wait_for_unit("taskserver.service")
server.succeed( "nixos-taskserver user list testOrganisation | grep -qxF alice", "nixos-taskserver user list testOrganisation | grep -qxF foo", "nixos-taskserver user list anotherOrganisation | grep -qxF bob", )
server.wait_for_open_port(${portStr})
client1.wait_for_unit("multi-user.target") client2.wait_for_unit("multi-user.target")
setup_clients_for("testOrganisation", "alice") setup_clients_for("testOrganisation", "foo") setup_clients_for("anotherOrganisation", "bob")
for user in ["alice", "bob", "foo"]: test_sync(user)
server.fail("nixos-taskserver user add imperativeOrg bar") re_add_imperative_user()
test_sync("bar")
with subtest("checking certificate revocation of user bar"): client1.succeed(check_client_cert("bar"))
server.succeed("nixos-taskserver user remove imperativeOrg bar") restart_server()
client1.fail(check_client_cert("bar"))
client1.succeed(su("bar", "task add destroy everything >&2")) client1.fail(su("bar", "task sync >&2"))
re_add_imperative_user()
with subtest("checking certificate revocation of org imperativeOrg"): client1.succeed(check_client_cert("bar"))
server.succeed("nixos-taskserver org remove imperativeOrg") restart_server()
client1.fail(check_client_cert("bar"))
client1.succeed(su("bar", "task add destroy even more >&2")) client1.fail(su("bar", "task sync >&2"))
re_add_imperative_user()
with subtest("check whether declarative config overrides user bar"): restart_server() test_sync("bar")
def init_manual_config(client, org, user): cfgpath = f"/home/{user}/.task"
client.copy_from_host( "${snakeOil.cacert}", f"{cfgpath}/ca.cert", ) for file in ["alice.key", "alice.cert"]: client.copy_from_host( f"${snakeOil}/{file}", f"{cfgpath}/{file}", )
for file in [f"{user}.key", f"{user}.cert"]: client.copy_from_host( f"${snakeOil}/{file}", f"{cfgpath}/{file}", )
client.succeed( su("alice", f"task config taskd.ca {cfgpath}/ca.cert"), su("alice", f"task config taskd.key {cfgpath}/{user}.key"), su(user, f"task config taskd.certificate {cfgpath}/{user}.cert"), )
with subtest("check manual configuration"): # Remove the keys from automatic CA creation, to make sure the new # generation doesn't use keys from before. server.succeed("rm -rf ${cfg.dataDir}/keys/* >&2")
server.succeed( "${switchToNewServer} >&2" ) server.wait_for_unit("taskserver.service") server.wait_for_open_port(${portStr})
server.succeed( "nixos-taskserver org add manualOrg", "nixos-taskserver user add manualOrg alice", )
setup_clients_for("manualOrg", "alice", init_manual_config)
test_sync("alice") '';}