aboutsummaryrefslogtreecommitdiffstats
path: root/tests/by-name/em/email-dns/nodes/acme/default.nix
diff options
context:
space:
mode:
Diffstat (limited to 'tests/by-name/em/email-dns/nodes/acme/default.nix')
-rw-r--r--tests/by-name/em/email-dns/nodes/acme/default.nix114
1 files changed, 0 insertions, 114 deletions
diff --git a/tests/by-name/em/email-dns/nodes/acme/default.nix b/tests/by-name/em/email-dns/nodes/acme/default.nix
deleted file mode 100644
index 236ba6a..0000000
--- a/tests/by-name/em/email-dns/nodes/acme/default.nix
+++ /dev/null
@@ -1,114 +0,0 @@
-# The certificate for the ACME service is exported as:
-#
-# config.test-support.acme.caCert
-#
-# This value can be used inside the configuration of other test nodes to inject
-# the test certificate into security.pki.certificateFiles or into package
-# overlays.
-#
-# {
-# acme = { nodes, lib, ... }: {
-# imports = [ ./common/acme/server ];
-# networking.nameservers = lib.mkForce [
-# nodes.mydnsresolver.networking.primaryIPAddress
-# ];
-# };
-#
-# dnsmyresolver = ...;
-# }
-#
-# Keep in mind, that currently only _one_ resolver is supported, if you have
-# more than one resolver in networking.nameservers only the first one will be
-# used.
-#
-# Also make sure that whenever you use a resolver from a different test node
-# that it has to be started _before_ the ACME service.
-{
- config,
- pkgs,
- lib,
- ...
-}: let
- testCerts = import ./certs/snakeoil-certs.nix;
- inherit (testCerts) domain;
-
- pebbleConf.pebble = {
- listenAddress = "0.0.0.0:443";
- managementListenAddress = "0.0.0.0:15000";
-
- # The cert and key are used only for the Web Front End (WFE)
- certificate = testCerts.${domain}.cert;
- privateKey = testCerts.${domain}.key;
-
- httpPort = 80;
- tlsPort = 443;
- ocspResponderURL = "http://${domain}:4002";
- strict = true;
- };
-
- pebbleConfFile = pkgs.writeText "pebble.conf" (builtins.toJSON pebbleConf);
-in {
- options.test-support.acme = {
- caDomain = lib.mkOption {
- type = lib.types.str;
- default = domain;
- readOnly = true;
- description = ''
- A domain name to use with the `nodes` attribute to
- identify the CA server in the `client` config.
- '';
- };
- caCert = lib.mkOption {
- type = lib.types.path;
- readOnly = true;
- default = testCerts.ca.cert;
- description = ''
- A certificate file to use with the `nodes` attribute to
- inject the test CA certificate used in the ACME server into
- {option}`security.pki.certificateFiles`.
- '';
- };
- };
-
- config = {
- networking = {
- # This has priority 140, because modules/testing/test-instrumentation.nix
- # already overrides this with priority 150.
- nameservers = lib.mkOverride 140 ["127.0.0.1"];
- firewall.allowedTCPPorts = [
- 80
- 443
- 15000
- 4002
- ];
-
- extraHosts = ''
- 127.0.0.1 ${domain}
- ${config.networking.primaryIPAddress} ${domain}
- '';
- };
-
- systemd.services = {
- pebble = {
- enable = true;
- description = "Pebble ACME server";
- wantedBy = ["network.target"];
- environment = {
- # We're not testing lego, we're just testing our configuration.
- # No need to sleep.
- PEBBLE_VA_NOSLEEP = "1";
- };
-
- serviceConfig = {
- RuntimeDirectory = "pebble";
- WorkingDirectory = "/run/pebble";
-
- # Required to bind on privileged ports.
- AmbientCapabilities = ["CAP_NET_BIND_SERVICE"];
-
- ExecStart = "${pkgs.pebble}/bin/pebble -config ${pebbleConfFile}";
- };
- };
- };
- };
-}