diff options
Diffstat (limited to 'tests/by-name')
21 files changed, 741 insertions, 370 deletions
diff --git a/tests/by-name/at/atuin-sync/test.nix b/tests/by-name/at/atuin-sync/test.nix new file mode 100644 index 0000000..3b8f1de --- /dev/null +++ b/tests/by-name/at/atuin-sync/test.nix @@ -0,0 +1,154 @@ +{ + pkgs, + turtle, + vhack, + ... +}: +vhack.runTest { + name = "atuin-sync"; + serverDomains = [ + { + server = "atuin-sync.server"; + } + ]; + + nodes = let + atuinSession = "01969ec6b8d07e30a9d2df0911fbfe2a"; + atuin = turtle.packages."${pkgs.stdenv.hostPlatform.system}".default; + in { + server = {config, ...}: { + vhack = { + persist.enable = true; + nginx.enable = true; + atuin-sync = { + enable = true; + fqdn = "atuin-sync.server"; + }; + }; + }; + + client1 = {config, ...}: { + environment.sessionVariables.ATUIN_SESSION = atuinSession; + + environment.systemPackages = [ + atuin + pkgs.sqlite-interactive + ]; + }; + client2 = {config, ...}: { + environment.sessionVariables.ATUIN_SESSION = atuinSession; + + environment.systemPackages = [ + atuin + pkgs.sqlite-interactive + ]; + }; + }; + + services = [ + {server = "turtle.service";} + ]; + + testScript = {nodes, ...}: let + mkSyncConfig = pkgs.writeShellScript "register-atuin-sync-account" '' + mkdir --parents ~/.config/turtle/ + + cat << EOF > ~/.config/turtle/config.toml + + [sync] + address = "https://atuin-sync.server" + user_id_path = "${pkgs.writeText "user-id" "019eb88a-6b51-7e52-b12c-7d30bd8e5928"}" + encryption_key_path = "${pkgs.writeText "encryption-key" "3AAgbWsDzL7M00/Mq0LMjsyOCy3MnsypBsyQzKbMywNGzNnMrUBozIINAxdbIiDMhQ=="}" + EOF + ''; + + runCommandAndRecordInTurtle = pkgs.writeShellScript "run-command-and-record-in-atuin" '' + # SPDX-SnippetBegin + # SPDX-SnippetCopyrightText: 2023 mentalisttraceur (https://github.com/mentalisttraceur) + # Source: https://github.com/atuinsh/atuin/issues/1188#issuecomment-1698354107 + run_and_record_in_atuin() + { + local id + local status + local escaped_command="$(printf '%q ' "$@")" + id="$(turtle history start -- "$escaped_command")" + "$@" + status=$? + turtle history end --exit $status "$id" + return $status + } + # SPDX-SnippetEnd + + run_and_record_in_atuin "$@" + ''; + in + # Python + '' + server.wait_for_open_port(443) + + # Wait for the server to acquire the acme certificate + client1.wait_until_succeeds("curl https://atuin-sync.server") + + with subtest("Setup client syncing"): + for client in [client1, client2]: + client.succeed("${mkSyncConfig}") + + with subtest("Start turtle daemon"): + for client in [client1, client2]: + client.succeed("systemd-run turtle-daemon start") + + for client in [client1, client2]: + client.wait_until_succeeds("turtle daemon status") + + with subtest("Can generate shell history"): + client1.succeed("${runCommandAndRecordInTurtle} echo hi - client 1") + client2.succeed("${runCommandAndRecordInTurtle} echo hi - client 2") + + with subtest("Can sync"): + for client in [client1, client2]: + client.succeed("turtle sync perform") + client1.succeed("turtle sync perform") + + with subtest("Have correct tasks"): + hist1 = client1.succeed("turtle history list --cmd-only").strip().split('\n') + hist2 = client2.succeed("turtle history list --cmd-only").strip().split('\n') + + hist1.sort() + hist2.sort() + + canonicalHistory = [ + "echo hi - client 1", + "echo hi - client 2" + ] + + assert hist1 == hist2, f"The clients don't have the same amount of history items, client1: '{hist1}', client2: '{hist2}'" + assert hist1 == canonicalHistory, f"The history is not correct: '{hist1}' vs. '{canonicalHistory}'" + + with subtest("Can sync again"): + client1.succeed("${runCommandAndRecordInTurtle} echo second try - client 1") + client2.succeed("${runCommandAndRecordInTurtle} echo second try - client 2") + + for client in [client1, client2]: + client.succeed("turtle sync perform") + client1.succeed("turtle sync perform") + + hist1 = client1.succeed("turtle history list --cmd-only").strip().split('\n') + hist2 = client2.succeed("turtle history list --cmd-only").strip().split('\n') + + hist1.sort() + hist2.sort() + + canonicalHistory = [ + # The old history + "echo hi - client 1", + "echo hi - client 2", + + # Our newly added history entries + "echo second try - client 1", + "echo second try - client 2" + ] + + assert hist1 == hist2, f"The clients don't have the same amount of history items, client1: '{hist1}', client2: '{hist2}'" + assert hist1 == canonicalHistory, f"The history is not correct, got: '{hist1}', expected: '{canonicalHistory}'" + ''; +} diff --git a/tests/by-name/ba/back/test.nix b/tests/by-name/ba/back/test.nix index 85cb611..758980e 100644 --- a/tests/by-name/ba/back/test.nix +++ b/tests/by-name/ba/back/test.nix @@ -1,11 +1,6 @@ { - nixos-lib, - pkgsUnstable, - nixpkgs-unstable, - vhackPackages, pkgs, - extraModules, - nixLib, + vhack, ... }: let domain = "server"; @@ -22,48 +17,34 @@ option user-configs = cgit\.owner cgit\.desc cgit\.section cgit\.homepage ''; in - nixos-lib.runTest { - hostPkgs = pkgs; # the Nixpkgs package set used outside the VMs - + vhack.runTest { name = "back"; - node = { - specialArgs = {inherit pkgsUnstable vhackPackages nixpkgs-unstable nixLib;}; + ignore = "We are not using back currently."; - # Use the nixpkgs as constructed by the `nixpkgs.*` options - pkgs = null; - }; + serverDomains = [ + {server = "git.${domain}";} + {server = "issues.${domain}";} + ]; nodes = { server = {config, ...}: { environment.systemPackages = [pkgs.git]; - imports = - extraModules - ++ [ - ../../../../modules - ]; - vhack = { persist.enable = true; openssh.enable = true; nginx = { enable = true; - selfsign = true; }; git-server = { enable = true; domain = "git.${domain}"; gitolite.adminPubkey = sshKeys.admin.pub; }; - back = { + git-back = { enable = true; domain = "issues.${domain}"; - - settings = { - scan_path = "${config.services.gitolite.dataDir}/repositories"; - project_list = "${config.services.gitolite.dataDir}/projects.list"; - }; }; }; }; @@ -78,23 +59,17 @@ in PreferredAuthentications publickey ''; users.users.alice = {isNormalUser = true;}; - networking.hosts = { - "${nodes.server.networking.primaryIPAddress}" = [ - "git.${domain}" - "issues.${domain}" - "${domain}" - ]; - }; }; }; + services = [ + {server = "gitolite-init.service";} + {server = "sshd.service";} + ]; + testScript = {nodes, ...}: - /* - python - */ + # Python '' - start_all() - with subtest("can setup ssh keys on client"): client.succeed( "mkdir -p ~root/.ssh", @@ -108,12 +83,15 @@ in ) with subtest("gitolite server starts"): - server.wait_for_unit("gitolite-init.service") - server.wait_for_unit("sshd.service") client.succeed("ssh -n git@git.${domain} info") - with subtest("admin can clone and configure gitolite-admin.git"): + server.succeed("sudo -u git ${pkgs.writeShellScript "delete_main_branch_on_server" '' + set -xe + + cd ~git/repositories/gitolite-admin.git + git branch --move --force main master + ''}") client.succeed("${pkgs.writeShellScript "setup-gitolite-admin.git" '' set -xe @@ -123,12 +101,9 @@ in cp ${sshKeys.alice.pub} gitolite-admin/keydir/alice.pub - (cd gitolite-admin && git switch -c master && git branch -D main) - (cd gitolite-admin && git add . && git commit -m 'Add keys for alice' && git push -u origin master) cat ${gitoliteAdminConfSnippet} >> gitolite-admin/conf/gitolite.conf (cd gitolite-admin && git add . && git commit -m 'Add support for wild repos' && git push) - (cd gitolite-admin && git push -d origin main) ''}") with subtest("alice can create a repo"): @@ -152,35 +127,35 @@ in cd alice/repo1 - git bug user create --avatar "" --email "alice@server.org" --name "alice" --non-interactive + git bug user new --avatar "" --email "alice@server.org" --name "alice" --non-interactive - git bug add \ + git bug bug new \ --title "Some bug title" \ --message "A long description of the bug. Probably has some code segments, maybe even *markdown* mark_up_ or other things" \ --non-interactive - git bug add \ + git bug bug new \ --title "Second bug title" \ --message "" \ --non-interactive - git bug add \ + git bug bug new \ --title "Third bug title" \ --message "" \ --non-interactive - git bug select "$(git bug ls --format plain | awk '{print $1}' | head -n 1)" + git bug bug select "$(git bug bug --format plain | awk '{print $1}' | head -n 1)" - git bug comment add --message "Some comment message" --non-interactive - git bug comment add --message "Second comment message" --non-interactive + git bug bug comment new --message "Some comment message" --non-interactive + git bug bug comment new --message "Second comment message" --non-interactive # TODO: This should use `git bug push`, but their ssh implementation is just # too special to work in a VM test <2025-03-08> git push origin +refs/bugs/* git push origin +refs/identities/* - ssh git@${domain} -- config alice/repo1 --add cgit.owner Alice - ssh git@${domain} -- perms alice/repo1 + READERS @all + ssh git@git.${domain} -- config alice/repo1 --add cgit.owner Alice + ssh git@git.${domain} -- perms alice/repo1 + READERS @all ''}") with subtest("back server starts"): @@ -190,12 +165,12 @@ in client.succeed("${pkgs.writeShellScript "curl-back" '' set -xe - curl --insecure --fail --show-error "https://issues.${domain}/alice/repo1.git/issues/open" --output /root/issues.html + curl --fail --show-error "https://issues.${domain}/alice/repo1/issues/?query=status:open" --output /root/issues.html grep -- 'Second bug title' /root/issues.html - curl --insecure --fail --show-error "https://issues.${domain}/" --output /root/repos.html + curl --fail --show-error "https://issues.${domain}/" --output /root/repos.html grep -- 'repo' /root/repos.html - grep -- "<No description>" /root/repos.html + grep -- "<No description>" /root/repos.html grep -- '<span class="user-name">Alice</span>' /root/repos.html ''} >&2") diff --git a/tests/by-name/gi/git-server/test.nix b/tests/by-name/gi/git-server/test.nix index 5cd8c33..09e559c 100644 --- a/tests/by-name/gi/git-server/test.nix +++ b/tests/by-name/gi/git-server/test.nix @@ -1,10 +1,6 @@ { - nixos-lib, - pkgsUnstable, - nixpkgs-unstable, pkgs, - extraModules, - nixLib, + vhack, ... }: let sshKeys = @@ -35,39 +31,24 @@ option user-configs = cgit\.owner cgit\.desc cgit\.section cgit\.homepage ''; - expectedHtmlReadme = pkgs.writeText "expectedHtmlReadme" '' - <h1>Alice's Repo</h1> - ''; expectedMdReadme = pkgs.writeText "expectedMdReadme" '' # Alice's Repo ''; in - nixos-lib.runTest { - hostPkgs = pkgs; # the Nixpkgs package set used outside the VMs - + vhack.runTest { name = "git-server"; - node = { - specialArgs = {inherit pkgsUnstable nixpkgs-unstable nixLib;}; - - # Use the nixpkgs as constructed by the `nixpkgs.*` options - pkgs = null; - }; + serverDomains = [ + {server = gitServerDomain;} + ]; nodes = { server = {config, ...}: { - imports = - extraModules - ++ [ - ../../../../modules - ]; - vhack = { persist.enable = true; openssh.enable = true; nginx = { enable = true; - selfsign = true; }; git-server = { enable = true; @@ -77,7 +58,7 @@ in }; }; - client = {...}: { + client = { environment.systemPackages = [pkgs.git]; programs.ssh.extraConfig = '' Host * @@ -91,13 +72,14 @@ in }; }; - testScript = {nodes, ...}: - /* - python - */ - '' - start_all() + services = [ + {server = "gitolite-init.service";} + {server = "sshd.service";} + ]; + testScript = {...}: + # Python + '' with subtest("can setup ssh keys on client"): client.succeed( "mkdir -p ~root/.ssh", @@ -116,12 +98,16 @@ in ) with subtest("gitolite server starts"): - server.wait_for_unit("gitolite-init.service") - server.wait_for_unit("sshd.service") client.succeed("ssh -n git@server info") with subtest("admin can clone and configure gitolite-admin.git"): + server.succeed("sudo -u git ${pkgs.writeShellScript "delete_main_branch_on_server" '' + set -xe + + cd ~git/repositories/gitolite-admin.git + git branch --move --force main master + ''}") client.succeed("${pkgs.writeShellScript "setup-gitolite-admin.git" '' set -xe @@ -132,12 +118,9 @@ in cp ${sshKeys.alice.pub} gitolite-admin/keydir/alice.pub cp ${sshKeys.bob.pub} gitolite-admin/keydir/bob.pub - (cd gitolite-admin && git switch -c master && git branch -D main) - (cd gitolite-admin && git add . && git commit -m 'Add keys for alice, bob' && git push -u origin master) cat ${gitoliteAdminConfSnippet} >> gitolite-admin/conf/gitolite.conf (cd gitolite-admin && git add . && git commit -m 'Add support for wild repos' && git push) - (cd gitolite-admin && git push -d origin main) ''}") server.succeed("${pkgs.writeShellScript "verify gitolite-admin.conf" '' @@ -202,7 +185,7 @@ in cd ~bob # Disable ssl verification, as the certs are self-signed - git -c http.sslVerify=false clone https://server/alice/alice-project.git + git -c http.sslVerify=false clone https://server/alice/alice-project ''}") with subtest("Alice can change settings in her repo"): @@ -221,15 +204,13 @@ in } ''}") + with subtest("Bob can see alice's README"): + client.succeed("sudo -u bob ${pkgs.writeShellScript "bob-alice-readme" '' + set -xe - # He can't see the readme (FIXME: find out why this does not work. <2024-08-13> ) - # with subtest("Bob can see alice's README"): - # client.succeed("sudo -u bob ${pkgs.writeShellScript "bob-alice-readme" '' - # set -xe - # - # curl --insecure --silent --fail --show-error 'https://server/alice/alice-project/about' > readme.html - # cat readme.html - # diff --side-by-side ${expectedHtmlReadme} readme.html - # ''}") + curl --fail --show-error 'https://server/alice/alice-project/about/' > readme.html + grep 'alice-project - My nice project.' ./readme.html + grep 'My nice project.' ./readme.html + ''}") ''; } diff --git a/tests/by-name/mo/monitoring-basic/test.nix b/tests/by-name/mo/monitoring-basic/test.nix new file mode 100644 index 0000000..2983085 --- /dev/null +++ b/tests/by-name/mo/monitoring-basic/test.nix @@ -0,0 +1,57 @@ +{vhack, ...}: let + grafanaDomain = "grafana.server.org"; +in + vhack.runTest { + name = "monitoring"; + + serverDomains = [ + {server = grafanaDomain;} + ]; + + nodes = { + client = {}; + + server = {config, ...}: { + # there are no SMART available disk in the VM, so this service always fails. + systemd.services."smartd".enable = false; + + age.identityPaths = ["${../../../common/email/hostKey}"]; + + vhack = { + monitoring = { + grafana = { + enable = true; + contactPoints = ["me@example.com"]; + fqdn = grafanaDomain; + + adminPassword = ../../../common/email/dkim/alice.com/private.age; + secretKey = ../../../common/email/dkim/bob.com/private.age; + + # TODO: Add a test for that <2026-07-19> + smtp = null; + }; + + loki = { + enable = true; + }; + + prometheus = { + enable = true; + }; + }; + }; + }; + }; + + services = [ + {server = "grafana.service";} + {server = "fluent-bit.service";} + {server = "loki.service";} + ]; + + testScript = {...}: + # Python + '' + # TODO: We should probably query some of the prometheus metrics here? <2026-07-19> + ''; + } diff --git a/tests/by-name/mo/monitoring-federation/test.nix b/tests/by-name/mo/monitoring-federation/test.nix new file mode 100644 index 0000000..278626f --- /dev/null +++ b/tests/by-name/mo/monitoring-federation/test.nix @@ -0,0 +1,90 @@ +{ + pkgs, + vhack, + ... +}: let + prometheusMain = "prometheus.server2.server.org"; + remoteWriteTo = { + url = "https://${prometheusMain}"; + }; + promPort = 3001; +in + vhack.runTest { + name = "monitoring"; + + serverDomains = [ + {server2 = prometheusMain;} + ]; + + nodes = { + server2 = {config, ...}: { + environment.systemPackages = [ + pkgs.curl + ]; + + vhack = { + monitoring = { + prometheus = { + enable = true; + port = promPort; + remoteWriteReceiver = prometheusMain; + }; + }; + }; + }; + server3 = {config, ...}: { + vhack = { + monitoring = { + prometheus = { + enable = true; + port = promPort; + inherit remoteWriteTo; + }; + }; + }; + }; + server4 = {config, ...}: { + vhack = { + monitoring = { + prometheus = { + enable = true; + port = promPort; + inherit remoteWriteTo; + }; + }; + }; + }; + }; + + services = [ + {server2 = "prometheus.service";} + {server3 = "prometheus.service";} + {server4 = "prometheus.service";} + ]; + + testScript = {...}: + # Python + '' + import json, time + + # Give the Prometheus servers some time to generate metrics and sync with the main + # one. + time.sleep(15) + + metrics = server2.succeed("${pkgs.writeShellScript "query-metrics" '' + curl --silent \ + http://127.0.0.1:${toString promPort}/api/v1/query?query="go_gc_cleanups_queued_cleanups_total" + ''}") + + metrics = json.loads(metrics) + + hosts = [] + for result in metrics["data"]["result"]: + server2.log(json.dumps(result,indent=4)) + hosts.append(result["metric"]["hostname"]) + + hosts.sort() + + assert hosts == ["server2", "server3", "server4"], f"Not all hosts used the remote write (got {hosts})" + ''; + } diff --git a/tests/by-name/ro/rocie/secrets/login.age b/tests/by-name/ro/rocie/secrets/login.age new file mode 100644 index 0000000..33d63be --- /dev/null +++ b/tests/by-name/ro/rocie/secrets/login.age @@ -0,0 +1,16 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzMWE5dTBiU0hDUC9jUi93 +Y1phYllHRk9YSHBzUGQ2YmF5ZC9ydXNGV0JrClRpTjZZUHZ5MEFFa0VrYVVhTkE2 +eCtSaEU1YVlhNjFNYlRRYzNCdjhYRWMKLT4gWDI1NTE5IDUrZWdDUmpQcFBOcE0x +UE5QRDR5NXVXUHdQOVk3UGV1S3lCc0pUQmZIZ00KUldVSVF3TzB0cHFVaDZuNlZR +b2FoT0lVSTZydHFTNHhnQ3U0NGdSR1k1MAotPiBzc2gtZWQyNTUxOSBSc2dXcFEg +dldGZU15UXgrRTMxRkp2MEVKUllWQ3VFdnJDMnM4OS8wc202WW9lNW5BYwpPWjV0 +cmNuaDlPZndtUVVScm5TaGlvVUhHa0JiN1MvbDhCTTUxYzNhM3RRCi0+IDxXeEhv +cC1ncmVhc2UKM3N5OHRLNTJEY1NIeGlWYm9yR096Y1NpSlVOM1lYQk9jOHkxU3N2 +K2c3QitDYnR6QTJOOWczV0xBa2dEUE1PTQpYU2Z1elZwRzU0Tm1RVDE2VWVqekUw +bFROLzU0c2NNTXYwL2N5QkxTaGtXUWxKVVF6SE0KLS0tIGlYMHIvUkJpZUR0SHo4 +cldLSTdnbU90SGJTcGZGaHkyOTZON0hka3BLdlEKeP4nHmKWvJfqgEXuiLBMzldi +n1qIsnlF3IU1EA0abJg/RK1BFwWlx4wBlLmViw6UTL+VEw8lv23PuZl2t7UtXVzQ +smXDapW8nInNmTaElBPdwJ072/dD0Ly+KF95Qr0FDDv+jlKG/D/Mw+xD4jvuJHSo +2HQnPF6MLTjCxpyPPggleWgKrBQggHBjm/pHtOKmPC5qfp+LAjmQoJXny/0X6cA= +-----END AGE ENCRYPTED FILE----- diff --git a/tests/by-name/ro/rocie/test.nix b/tests/by-name/ro/rocie/test.nix new file mode 100644 index 0000000..5882cd4 --- /dev/null +++ b/tests/by-name/ro/rocie/test.nix @@ -0,0 +1,42 @@ +{vhack, ...}: +vhack.runTest { + name = "rocie"; + + serverDomains = [ + {server = "rocie.server";} + ]; + + nodes = { + server = {config, ...}: { + age.identityPaths = ["${../../../common/email/hostKey}"]; + + vhack = { + persist.enable = true; + nginx.enable = true; + rocie = { + enable = true; + domain = "rocie.server"; + loginSecret = ./secrets/login.age; + }; + }; + }; + + client = {_, ...}: {}; + }; + + services = [ + {server = "rocie.service";} + ]; + + ports = [ + {server = 80;} + {server = 443;} + ]; + + testScript = {...}: + # Python + '' + client.wait_until_succeeds("curl --verbose https://rocie.server/api/can-be-provisioned > out.file") + client.copy_from_machine("out.file") + ''; +} diff --git a/tests/by-name/ru/rust-motd/test.nix b/tests/by-name/ru/rust-motd/test.nix new file mode 100644 index 0000000..b50abf5 --- /dev/null +++ b/tests/by-name/ru/rust-motd/test.nix @@ -0,0 +1,30 @@ +{vhack, ...}: +vhack.runTest { + name = "rust-motd"; + + nodes = { + server = {config, ...}: { + vhack = { + rust-motd.enable = true; + }; + }; + }; + + services = [ + { + server = { + name = "rust-motd.service"; + should_be_started = true; + }; + } + ]; + + testScript = {nodes, ...}: + # Python + '' + with subtest("Motd generated"): + server.succeed("cat /var/lib/rust-motd/motd | tee /dev/stderr | grep --invert-match --ignore-case Error") + + server.copy_from_machine("/var/lib/rust-motd/motd") + ''; +} diff --git a/tests/by-name/sh/sharkey-cpu/test.nix b/tests/by-name/sh/sharkey-cpu/test.nix index 438cfb3..f38fd46 100644 --- a/tests/by-name/sh/sharkey-cpu/test.nix +++ b/tests/by-name/sh/sharkey-cpu/test.nix @@ -1,33 +1,14 @@ { - nixos-lib, - pkgsUnstable, - nixpkgs-unstable, - vhackPackages, pkgs, - extraModules, - nixLib, + vhack, ... }: -nixos-lib.runTest { - hostPkgs = pkgs; # the Nixpkgs package set used outside the VMs - +vhack.runTest { name = "sharkey-cpu"; - - node = { - specialArgs = {inherit pkgsUnstable extraModules vhackPackages nixpkgs-unstable nixLib;}; - - # Use the nixpkgs as constructed by the `nixpkgs.*` options - pkgs = null; - }; + ignore = true; nodes = { server = {config, ...}: { - imports = - extraModules - ++ [ - ../../../../modules - ]; - vhack = { persist.enable = true; nginx.enable = true; @@ -38,19 +19,29 @@ nixos-lib.runTest { }; systemd.services = { # Avoid an error from this service. - "acme-sharkey.server".serviceConfig.ExecStart = pkgs.lib.mkForce "${pkgs.lib.getExe' pkgs.coreutils "true"}"; + "acme-sharkey.server".enable = false; # Test that sharkey's hardening still allows access to the CPUs. sharkey.serviceConfig.ExecStart = let - nodejs = pkgs.lib.getExe pkgsUnstable.nodejs; + nodejs = pkgs.lib.getExe pkgs.nodejs; script = pkgs.writeTextFile { name = "script.js"; - text = '' - import * as os from 'node:os'; + text = + # js + '' + import * as os from 'node:os'; - console.log(os.cpus()[0].model) - console.log(os.cpus().length) - ''; + var cpus = os.cpus() + + if (cpus.length != 0) { + console.log(cpus[0].model) + } else { + // Fail? + } + + while (true) { + } + ''; }; in pkgs.lib.mkForce "${nodejs} ${script}"; @@ -58,24 +49,16 @@ nixos-lib.runTest { }; }; - testScript = {nodes, ...}: - /* - python - */ + services = [ + {server = "sharkey.service";} + ]; + + testScript = {...}: + # Python '' from time import sleep - start_all() - # Give the service time to run. sleep(3) - - with subtest("All services running"): - import json - def all_services_running(host): - (status, output) = host.systemctl("list-units --state=failed --plain --no-pager --output=json") - host_failed = json.loads(output) - assert len(host_failed) == 0, f"Expected zero failing services, but found: {json.dumps(host_failed, indent=4)}" - all_services_running(server) ''; } diff --git a/tests/by-name/sh/sharkey/test.nix b/tests/by-name/sh/sharkey/test.nix index b2ad461..03a8281 100644 --- a/tests/by-name/sh/sharkey/test.nix +++ b/tests/by-name/sh/sharkey/test.nix @@ -1,68 +1,14 @@ -{ - nixos-lib, - pkgsUnstable, - nixpkgs-unstable, - vhackPackages, - pkgs, - extraModules, - nixLib, - ... -}: -nixos-lib.runTest { - hostPkgs = pkgs; # the Nixpkgs package set used outside the VMs - +{vhack, ...}: +vhack.runTest { name = "sharkey"; + ignore = true; - node = { - specialArgs = {inherit pkgsUnstable extraModules vhackPackages nixpkgs-unstable nixLib;}; - - # Use the nixpkgs as constructed by the `nixpkgs.*` options - pkgs = null; - }; + serverDomains = [ + {server = "sharkey.server";} + ]; nodes = { - acme = {...}: { - imports = [ - ../../../common/acme/server.nix - ../../../common/dns/client.nix - ]; - }; - name_server = {nodes, ...}: { - imports = - extraModules - ++ [ - ../../../common/acme/client.nix - ../../../common/dns/server.nix - ]; - - vhack.dns.zones = { - "sharkey.server" = { - SOA = { - nameServer = "ns"; - adminEmail = "admin@server.com"; - serial = 2025012301; - }; - useOrigin = false; - - A = [ - nodes.server.networking.primaryIPAddress - ]; - AAAA = [ - nodes.server.networking.primaryIPv6Address - ]; - }; - }; - }; - server = {config, ...}: { - imports = - extraModules - ++ [ - ../../../../modules - ../../../common/acme/client.nix - ../../../common/dns/client.nix - ]; - vhack = { persist.enable = true; nginx.enable = true; @@ -73,45 +19,16 @@ nixos-lib.runTest { }; }; - client = {...}: { - imports = [ - ../../../common/acme/client.nix - ../../../common/dns/client.nix - ]; - }; + client = {...}: {}; }; - testScript = {nodes, ...}: let - acme_scripts = import ../../../common/acme/scripts.nix {inherit pkgs;}; - in - /* - python - */ - '' - # Start dependencies for the other services - acme.start() - acme.wait_for_unit("pebble.service") - name_server.start() - name_server.wait_for_unit("nsd.service") - - # Start the actual testing machines - start_all() - - with subtest("Add pebble ca key to all services"): - for node in [name_server, server, client]: - node.wait_for_unit("network-online.target") - node.succeed("${acme_scripts.add_pebble_acme_ca}") - - server.wait_for_unit("sharkey.service") - - with subtest("All services running"): - import json - def all_services_running(host): - (status, output) = host.systemctl("list-units --state=failed --plain --no-pager --output=json") - host_failed = json.loads(output) - assert len(host_failed) == 0, f"Expected zero failing services, but found: {json.dumps(host_failed, indent=4)}" - all_services_running(server) + services = [ + {server = "sharkey.service";} + ]; - client.wait_until_succeeds("curl --silent https://sharkey.server | grep 'Thank you for using Sharkey!'") - ''; + testScript = {...}: + # Python + '' + client.wait_until_succeeds("curl --verbose https://sharkey.server | grep 'Thank you for using Sharkey!'") + ''; } diff --git a/tests/by-name/sn/snm-email-dual-server/test.nix b/tests/by-name/sn/snm-email-dual-server/test.nix new file mode 100644 index 0000000..6f7bebb --- /dev/null +++ b/tests/by-name/sn/snm-email-dual-server/test.nix @@ -0,0 +1,134 @@ +{ + lib, + vhack, + pkgs, + vhackPackages, + ... +}: let + server1Domain = "mail.server1"; + server2Domain = "mail.server2"; + + common = import ../../../common/email/functions.nix {inherit pkgs vhackPackages;}; + + # That's a horrible hack. We should instead wait, until the delivery of the email is + # confirmed. + sleepTime = "40"; +in + vhack.runTest { + name = "email"; + + serverDomains = [ + {server1 = server1Domain;} + {server2 = server2Domain;} + ]; + + nodes = { + server1 = common.mkMailServer server1Domain "alice"; + server2 = common.mkMailServer server2Domain "bob"; + + alice = common.mkUser "alice" server1Domain; + bob = common.mkUser "bob" server2Domain; + }; + + dns = { + server1 = common.mkDnsZone server1Domain; + server2 = common.mkDnsZone server2Domain; + }; + + services = [ + {server1 = "postfix.service";} + {server1 = "dovecot.service";} + {server2 = "postfix.service";} + {server2 = "dovecot.service";} + + {alice = "multi-user.target";} + {bob = "multi-user.target";} + ]; + + ports = [ + {server1 = 993;} # imap + {server1 = 465;} # smtp + + {server2 = 993;} # imap + {server2 = 465;} # smtp + ]; + + testScript = {...}: + # Python + '' + from time import sleep + + with subtest("Dkim keys work"): + server1.succeed("sudo -u rspamd ${pkgs.writeShellScript "dkim-keys-check" '' + set -xe + + stat /run/agenix/mailDkim + + ${lib.getExe pkgs.openssl} pkey -text -noout -in /run/agenix/mailDkim | grep Private-Key + ${lib.getExe pkgs.openssl} pkey -text -noout -in /run/agenix/mailDkim + ''}") + + with subtest("Both start without mail"): + alice.succeed("sudo -u alice ${common.scripts.expectNoNewMail}") + bob.succeed("sudo -u bob ${common.scripts.expectNoNewMail}") + + + with subtest("Alice can send an empty email to bob"): + alice.succeed("sudo -u alice ${pkgs.writeShellScript "alice-send" '' + set -xe + + echo "" | msmtp --debug --account alice bob@${server2Domain} >&2 + ''}") + + # Give the mail server some time to send the email. + sleep(${sleepTime}) + + bob.succeed("sudo -u bob ${common.scripts.expectNewSpamMail}") + + with subtest("Alice can send an non-empty email to bob"): + alice.succeed("sudo -u alice ${pkgs.writeShellScript "alice-send" '' + set -xe + + cat << EOF | msmtp --debug --account alice bob@${server2Domain} >&2 + Subject: Hi bob, I'm Alice! + + Good day, Bob! + + This is an email. + It contains a subject and a body. + I also assert utf8 support by including my last name in this very message. + + XOXO + Alice van Dåligen. + + . + EOF + ''}") + + # Give the mail server some time to send the email. + sleep(${sleepTime}) + + bob.succeed("sudo -u bob ${common.scripts.expectNewSpamMail}") + + with subtest("Bob can send an email to alice"): + bob.succeed("sudo -u bob ${pkgs.writeShellScript "bob-send" '' + set -xe + + cat << EOF | msmtp --debug --account bob alice@${server1Domain} >&2 + Hi Alice! + + Thank you for your emails! (Although they seemed kinda weird tbh :?) + + XXX + Bob Älšter + + . + EOF + ''}") + + # Give the mail server some time to send the email. + sleep(${sleepTime}) + + alice.succeed("sudo -u alice ${common.scripts.expectNewSpamMail}") + ''; + } diff --git a/tests/by-name/sn/snm-email-single-server/test.nix b/tests/by-name/sn/snm-email-single-server/test.nix new file mode 100644 index 0000000..7b5ec03 --- /dev/null +++ b/tests/by-name/sn/snm-email-single-server/test.nix @@ -0,0 +1,86 @@ +{ + vhack, + pkgs, + vhackPackages, + ... +}: let + domain = "mail.server.test"; + + common = import ../../../common/email/functions.nix {inherit pkgs vhackPackages;}; +in + vhack.runTest { + name = "email"; + + serverDomains = [ + {server = domain;} + ]; + + nodes = { + server = {config, ...}: { + systemd.tmpfiles.rules = [ + #- path mode user group - content + "f /passwords/alice 777 root root - alice-password" + "f /passwords/bob 777 root root - bob-password" + ]; + + # This DNS resolver is only there for rspamd (and apparently not even needed). But it + # also removes our own name server changes, so the test node could no longer find + # e.g. `acme.test` and so on. + # See: https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/work_items/100 + mailserver.localDnsResolver = false; + + vhack = { + mail = { + enable = true; + fqdn = domain; + domains = [ + domain + ]; + accounts = { + "alice@${domain}" = { + passwordFile = "/passwords/alice"; + }; + "bob@${domain}" = { + passwordFile = "/passwords/bob"; + }; + }; + }; + }; + }; + + alice = common.mkUser "alice" domain; + bob = common.mkUser "bob" domain; + }; + + services = [ + {server = "postfix.service";} + ]; + + ports = [ + {server = 993;} # imap + {server = 465;} # smtp + ]; + + testScript = {...}: + # Python + '' + with subtest("Both start without mail"): + alice.succeed("sudo -u alice ${common.scripts.expectNoNewMail}") + bob.succeed("sudo -u bob ${common.scripts.expectNoNewMail}") + + with subtest("Alice can send an email to bob"): + alice.succeed("sudo -u alice ${pkgs.writeShellScript "alice-send" '' + set -xe + + cat << EOF | msmtp --debug --account alice bob@${domain} >&2 + Hi Bob! + + This is an email. + It contains a subject and a body. + + ALICE + EOF + ''}") + bob.succeed("sudo -u bob ${common.scripts.expectNewMail}") + ''; + } diff --git a/tests/by-name/em/email-dns/nodes/mail_server.nix b/tests/by-name/st/stalwart-email-dns/nodes/mail_server.nix index 279d289..279d289 100644 --- a/tests/by-name/em/email-dns/nodes/mail_server.nix +++ b/tests/by-name/st/stalwart-email-dns/nodes/mail_server.nix diff --git a/tests/by-name/em/email-dns/nodes/name_server.nix b/tests/by-name/st/stalwart-email-dns/nodes/name_server.nix index d9d3617..bde1a16 100644 --- a/tests/by-name/em/email-dns/nodes/name_server.nix +++ b/tests/by-name/st/stalwart-email-dns/nodes/name_server.nix @@ -63,7 +63,7 @@ adkim = "strict"; aspf = "strict"; fo = ["0" "1" "d" "s"]; - p = "quarantine"; + p = "reject"; rua = cfg.admin; ruf = [cfg.admin]; } diff --git a/tests/by-name/em/email-dns/nodes/user.nix b/tests/by-name/st/stalwart-email-dns/nodes/user.nix index fba02ce..fba02ce 100644 --- a/tests/by-name/em/email-dns/nodes/user.nix +++ b/tests/by-name/st/stalwart-email-dns/nodes/user.nix diff --git a/tests/by-name/em/email-dns/test.nix b/tests/by-name/st/stalwart-email-dns/test.nix index f0399a5..33955d8 100644 --- a/tests/by-name/em/email-dns/test.nix +++ b/tests/by-name/st/stalwart-email-dns/test.nix @@ -14,6 +14,9 @@ inherit (user) mkUser; in nixos-lib.runTest { + # Wait until we actually use stalwart again + meta.broken = true; + hostPkgs = pkgs; # the Nixpkgs package set used outside the VMs name = "email-dns"; @@ -90,23 +93,13 @@ in } ''; - acme_scripts = import ../../../common/acme/scripts.nix {inherit pkgs;}; + acme = import ../../../common/acme {inherit pkgs;}; in - /* - python - */ + acme.prepare ["mail1_server" "mail2_server" "alice" "bob"] + # Python '' from time import sleep - # Start dependencies for the other services - acme.start() - acme.wait_for_unit("pebble.service") - name_server.start() - name_server.wait_for_unit("nsd.service") - - # Start the actual testing machines - start_all() - mail1_server.wait_for_unit("stalwart-mail.service") mail1_server.wait_for_open_port(993) # imap mail1_server.wait_for_open_port(465) # smtp @@ -120,10 +113,6 @@ in name_server.wait_until_succeeds("stat /var/lib/acme/mta-sts.alice.com/cert.pem") name_server.wait_until_succeeds("stat /var/lib/acme/mta-sts.bob.com/cert.pem") - with subtest("Add pebble ca key to all services"): - for node in [name_server, mail1_server, mail2_server, alice, bob]: - node.succeed("${acme_scripts.add_pebble_acme_ca}") - with subtest("Both mailserver successfully started all services"): import json def all_services_running(host): diff --git a/tests/by-name/em/email-http/nodes/mail_server.nix b/tests/by-name/st/stalwart-email-http/nodes/mail_server.nix index e94c4e9..e94c4e9 100644 --- a/tests/by-name/em/email-http/nodes/mail_server.nix +++ b/tests/by-name/st/stalwart-email-http/nodes/mail_server.nix diff --git a/tests/by-name/em/email-http/nodes/user.nix b/tests/by-name/st/stalwart-email-http/nodes/user.nix index 73b9ff7..73b9ff7 100644 --- a/tests/by-name/em/email-http/nodes/user.nix +++ b/tests/by-name/st/stalwart-email-http/nodes/user.nix diff --git a/tests/by-name/em/email-http/test.nix b/tests/by-name/st/stalwart-email-http/test.nix index f508b9f..42fd22b 100644 --- a/tests/by-name/em/email-http/test.nix +++ b/tests/by-name/st/stalwart-email-http/test.nix @@ -14,6 +14,9 @@ inherit (user) mkUser; in nixos-lib.runTest { + # Wait until we actually use stalwart again + meta.broken = true; + hostPkgs = pkgs; # the Nixpkgs package set used outside the VMs name = "email-http"; @@ -71,32 +74,17 @@ in # TODO(@bpeetz): This test should also test the http JMAP features of stalwart-mail. <2025-04-12> testScript = _: let - acme_scripts = import ../../../common/acme/scripts.nix {inherit pkgs;}; + acme = import ../../../common/acme {inherit pkgs;}; in - /* - python - */ + acme.prepare ["mail_server" "bob"] + # Python '' - # Start dependencies for the other services - acme.start() - acme.wait_for_unit("pebble.service") - name_server.start() - name_server.wait_for_unit("nsd.service") - - # Start the actual testing machines - start_all() - mail_server.wait_for_unit("stalwart-mail.service") mail_server.wait_for_open_port(993) # imap mail_server.wait_for_open_port(465) # smtp bob.wait_for_unit("multi-user.target") - with subtest("Add pebble ca key to all services"): - for node in [name_server, mail_server, bob]: - node.wait_for_unit("network-online.target") - node.succeed("${acme_scripts.add_pebble_acme_ca}") - with subtest("The mailserver successfully started all services"): import json def all_services_running(host): diff --git a/tests/by-name/em/email-ip/test.nix b/tests/by-name/st/stalwart-email-ip/test.nix index dabc404..c0b2d7e 100644 --- a/tests/by-name/em/email-ip/test.nix +++ b/tests/by-name/st/stalwart-email-ip/test.nix @@ -78,6 +78,9 @@ }; in nixos-lib.runTest { + # Wait until we actually use stalwart again + meta.broken = true; + hostPkgs = pkgs; # the Nixpkgs package set used outside the VMs name = "email"; diff --git a/tests/by-name/ta/taskchampion-sync/test.nix b/tests/by-name/ta/taskchampion-sync/test.nix index 99134bc..54eef45 100644 --- a/tests/by-name/ta/taskchampion-sync/test.nix +++ b/tests/by-name/ta/taskchampion-sync/test.nix @@ -1,72 +1,21 @@ { - nixos-lib, - pkgsUnstable, - nixpkgs-unstable, - vhackPackages, pkgs, - extraModules, - nixLib, + vhack, ... }: -nixos-lib.runTest { - hostPkgs = pkgs; +vhack.runTest { name = "taskchampion-sync"; - node = { - specialArgs = {inherit pkgsUnstable vhackPackages nixpkgs-unstable nixLib;}; - - # Use the nixpkgs as constructed by the `nixpkgs.*` options - pkgs = null; - }; + serverDomains = [ + {server = "taskchampion.server";} + ]; nodes = let - # The feature flag is only in version 3.2 and upwards. Stable is still on 3.1 - taskwarriorPackage = pkgsUnstable.taskwarrior3.overrideAttrs (final: prev: { + taskwarriorPackage = pkgs.taskwarrior3.overrideAttrs (final: prev: { cmakeFlags = (prev.cmakeFlags or []) ++ ["-DENABLE_TLS_NATIVE_ROOTS=true"]; }); in { - acme = { - imports = [ - ../../../common/acme/server.nix - ../../../common/dns/client.nix - ]; - }; - name_server = {nodes, ...}: { - imports = - extraModules - ++ [ - ../../../common/acme/client.nix - ../../../common/dns/server.nix - ]; - - vhack.dns.zones = { - "taskchampion.server" = { - SOA = { - nameServer = "ns"; - adminEmail = "admin@server.com"; - serial = 2025012301; - }; - useOrigin = false; - - A = [ - nodes.server.networking.primaryIPAddress - ]; - AAAA = [ - nodes.server.networking.primaryIPv6Address - ]; - }; - }; - }; - server = {config, ...}: { - imports = - extraModules - ++ [ - ../../../../modules - ../../../common/acme/client.nix - ../../../common/dns/client.nix - ]; - vhack = { persist.enable = true; nginx.enable = true; @@ -78,27 +27,25 @@ nixos-lib.runTest { }; task_client1 = {config, ...}: { - imports = [ - ../../../common/acme/client.nix - ../../../common/dns/client.nix - ]; - environment.systemPackages = [ taskwarriorPackage ]; }; task_client2 = {config, ...}: { - imports = [ - ../../../common/acme/client.nix - ../../../common/dns/client.nix - ]; - environment.systemPackages = [ taskwarriorPackage ]; }; }; + services = [ + {server = "taskchampion-sync-server.service";} + ]; + + ports = [ + {server = 443;} + ]; + testScript = {nodes, ...}: let # Generated with uuidgen uuid = "bf01376e-04a4-435a-9263-608567531af3"; @@ -113,30 +60,9 @@ nixos-lib.runTest { echo 'sync.server.client_id=${uuid}' >> "${path}" echo 'sync.encryption_secret=${password}' >> "${path}" ''; - - acme_scripts = import ../../../common/acme/scripts.nix {inherit pkgs;}; in - /* - python - */ + # Python '' - # Start dependencies for the other services - acme.start() - acme.wait_for_unit("pebble.service") - name_server.start() - name_server.wait_for_unit("nsd.service") - - # Start actual test - start_all() - - with subtest("Add pebble ca key to all services"): - for node in [name_server, server, task_client1, task_client2]: - node.wait_for_unit("network-online.target") - node.succeed("${acme_scripts.add_pebble_acme_ca}") - - server.wait_for_unit("taskchampion-sync-server.service") - server.wait_for_open_port(443) - with subtest("Setup task syncing"): for task in [task_client1, task_client2]: # See man task-sync(5) @@ -148,7 +74,7 @@ nixos-lib.runTest { task_client2.succeed("task add 'First task -- task_client2'") # Wait for the server to acquire the acme certificate - task_client1.wait_until_succeed("curl https://taskchampion.server") + task_client1.wait_until_succeeds("curl https://taskchampion.server") with subtest("Can sync tasks"): for task in [task_client1, task_client2]: |