nixosTests.taskserver: Port to python
This commit is contained in:
Olli Helenius
parent
f138879273
commit
6b1c347a85
1 changed files with 134 additions and 143 deletions
|
|
@ -1,4 +1,4 @@
|
||||||
import ./make-test.nix ({ pkgs, ... }: let
|
import ./make-test-python.nix ({ pkgs, ... }: let
|
||||||
snakeOil = pkgs.runCommand "snakeoil-certs" {
|
snakeOil = pkgs.runCommand "snakeoil-certs" {
|
||||||
outputs = [ "out" "cacert" "cert" "key" "crl" ];
|
outputs = [ "out" "cacert" "cert" "key" "crl" ];
|
||||||
buildInputs = [ pkgs.gnutls.bin ];
|
buildInputs = [ pkgs.gnutls.bin ];
|
||||||
|
|
@ -105,187 +105,178 @@ in {
|
||||||
newServerSystem = nodes.newServer.config.system.build.toplevel;
|
newServerSystem = nodes.newServer.config.system.build.toplevel;
|
||||||
switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
|
switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
|
||||||
in ''
|
in ''
|
||||||
sub su ($$) {
|
from shlex import quote
|
||||||
my ($user, $cmd) = @_;
|
|
||||||
my $esc = $cmd =~ s/'/'\\${"'"}'/gr;
|
|
||||||
return "su - $user -c '$esc'";
|
|
||||||
}
|
|
||||||
|
|
||||||
sub setupClientsFor ($$;$) {
|
|
||||||
my ($org, $user, $extraInit) = @_;
|
|
||||||
|
|
||||||
for my $client ($client1, $client2) {
|
def su(user, cmd):
|
||||||
$client->nest("initialize client for user $user", sub {
|
return f"su - {user} -c {quote(cmd)}"
|
||||||
$client->succeed(
|
|
||||||
(su $user, "rm -rf /home/$user/.task"),
|
|
||||||
(su $user, "task rc.confirmation=no config confirmation no")
|
|
||||||
);
|
|
||||||
|
|
||||||
my $exportinfo = $server->succeed(
|
|
||||||
"nixos-taskserver user export $org $user"
|
|
||||||
);
|
|
||||||
|
|
||||||
$exportinfo =~ s/'/'\\'''/g;
|
def no_extra_init(client, org, user):
|
||||||
|
pass
|
||||||
|
|
||||||
$client->nest("importing taskwarrior configuration", sub {
|
|
||||||
my $cmd = su $user, "eval '$exportinfo' >&2";
|
|
||||||
my ($status, $out) = $client->execute_($cmd);
|
|
||||||
if ($status != 0) {
|
|
||||||
$client->log("output: $out");
|
|
||||||
die "command `$cmd' did not succeed (exit code $status)\n";
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
eval { &$extraInit($client, $org, $user) };
|
def setup_clients_for(org, user, extra_init=no_extra_init):
|
||||||
|
for client in [client1, client2]:
|
||||||
|
with client.nested(f"initialize client for user {user}"):
|
||||||
|
client.succeed(
|
||||||
|
su(user, f"rm -rf /home/{user}/.task"),
|
||||||
|
su(user, "task rc.confirmation=no config confirmation no"),
|
||||||
|
)
|
||||||
|
|
||||||
$client->succeed(su $user,
|
exportinfo = server.succeed(f"nixos-taskserver user export {org} {user}")
|
||||||
"task config taskd.server server:${portStr} >&2"
|
|
||||||
);
|
|
||||||
|
|
||||||
$client->succeed(su $user, "task sync init >&2");
|
with client.nested("importing taskwarrior configuration"):
|
||||||
});
|
client.succeed(su(user, f"eval {quote(exportinfo)} >&2"))
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
sub restartServer {
|
extra_init(client, org, user)
|
||||||
$server->succeed("systemctl restart taskserver.service");
|
|
||||||
$server->waitForOpenPort(${portStr});
|
|
||||||
}
|
|
||||||
|
|
||||||
sub readdImperativeUser {
|
client.succeed(su(user, "task config taskd.server server:${portStr} >&2"))
|
||||||
$server->nest("(re-)add imperative user bar", sub {
|
|
||||||
$server->execute("nixos-taskserver org remove imperativeOrg");
|
|
||||||
$server->succeed(
|
|
||||||
"nixos-taskserver org add imperativeOrg",
|
|
||||||
"nixos-taskserver user add imperativeOrg bar"
|
|
||||||
);
|
|
||||||
setupClientsFor "imperativeOrg", "bar";
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
sub testSync ($) {
|
client.succeed(su(user, "task sync init >&2"))
|
||||||
my $user = $_[0];
|
|
||||||
subtest "sync for user $user", sub {
|
|
||||||
$client1->succeed(su $user, "task add foo >&2");
|
def restart_server():
|
||||||
$client1->succeed(su $user, "task sync >&2");
|
server.systemctl("restart taskserver.service")
|
||||||
$client2->fail(su $user, "task list >&2");
|
server.wait_for_open_port(${portStr})
|
||||||
$client2->succeed(su $user, "task sync >&2");
|
|
||||||
$client2->succeed(su $user, "task list >&2");
|
|
||||||
};
|
def re_add_imperative_user():
|
||||||
}
|
with server.nested("(re-)add imperative user bar"):
|
||||||
|
server.execute("nixos-taskserver org remove imperativeOrg")
|
||||||
|
server.succeed(
|
||||||
|
"nixos-taskserver org add imperativeOrg",
|
||||||
|
"nixos-taskserver user add imperativeOrg bar",
|
||||||
|
)
|
||||||
|
setup_clients_for("imperativeOrg", "bar")
|
||||||
|
|
||||||
|
|
||||||
|
def test_sync(user):
|
||||||
|
with subtest(f"sync for user {user}"):
|
||||||
|
client1.succeed(su(user, "task add foo >&2"))
|
||||||
|
client1.succeed(su(user, "task sync >&2"))
|
||||||
|
client2.fail(su(user, "task list >&2"))
|
||||||
|
client2.succeed(su(user, "task sync >&2"))
|
||||||
|
client2.succeed(su(user, "task list >&2"))
|
||||||
|
|
||||||
|
|
||||||
|
def check_client_cert(user):
|
||||||
|
# debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040
|
||||||
|
cmd = (
|
||||||
|
f"gnutls-cli -d 3"
|
||||||
|
f" --x509cafile=/home/{user}/.task/keys/ca.cert"
|
||||||
|
f" --x509keyfile=/home/{user}/.task/keys/private.key"
|
||||||
|
f" --x509certfile=/home/{user}/.task/keys/public.cert"
|
||||||
|
f" --port=${portStr} server < /dev/null"
|
||||||
|
)
|
||||||
|
return su(user, cmd)
|
||||||
|
|
||||||
sub checkClientCert ($) {
|
|
||||||
my $user = $_[0];
|
|
||||||
# debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040
|
|
||||||
my $cmd = "gnutls-cli -d 3".
|
|
||||||
" --x509cafile=/home/$user/.task/keys/ca.cert".
|
|
||||||
" --x509keyfile=/home/$user/.task/keys/private.key".
|
|
||||||
" --x509certfile=/home/$user/.task/keys/public.cert".
|
|
||||||
" --port=${portStr} server < /dev/null";
|
|
||||||
return su $user, $cmd;
|
|
||||||
}
|
|
||||||
|
|
||||||
# Explicitly start the VMs so that we don't accidentally start newServer
|
# Explicitly start the VMs so that we don't accidentally start newServer
|
||||||
$server->start;
|
server.start()
|
||||||
$client1->start;
|
client1.start()
|
||||||
$client2->start;
|
client2.start()
|
||||||
|
|
||||||
$server->waitForUnit("taskserver.service");
|
server.wait_for_unit("taskserver.service")
|
||||||
|
|
||||||
$server->succeed(
|
server.succeed(
|
||||||
"nixos-taskserver user list testOrganisation | grep -qxF alice",
|
"nixos-taskserver user list testOrganisation | grep -qxF alice",
|
||||||
"nixos-taskserver user list testOrganisation | grep -qxF foo",
|
"nixos-taskserver user list testOrganisation | grep -qxF foo",
|
||||||
"nixos-taskserver user list anotherOrganisation | grep -qxF bob"
|
"nixos-taskserver user list anotherOrganisation | grep -qxF bob",
|
||||||
);
|
)
|
||||||
|
|
||||||
$server->waitForOpenPort(${portStr});
|
server.wait_for_open_port(${portStr})
|
||||||
|
|
||||||
$client1->waitForUnit("multi-user.target");
|
client1.wait_for_unit("multi-user.target")
|
||||||
$client2->waitForUnit("multi-user.target");
|
client2.wait_for_unit("multi-user.target")
|
||||||
|
|
||||||
setupClientsFor "testOrganisation", "alice";
|
setup_clients_for("testOrganisation", "alice")
|
||||||
setupClientsFor "testOrganisation", "foo";
|
setup_clients_for("testOrganisation", "foo")
|
||||||
setupClientsFor "anotherOrganisation", "bob";
|
setup_clients_for("anotherOrganisation", "bob")
|
||||||
|
|
||||||
testSync $_ for ("alice", "bob", "foo");
|
for user in ["alice", "bob", "foo"]:
|
||||||
|
test_sync(user)
|
||||||
|
|
||||||
$server->fail("nixos-taskserver user add imperativeOrg bar");
|
server.fail("nixos-taskserver user add imperativeOrg bar")
|
||||||
readdImperativeUser;
|
re_add_imperative_user()
|
||||||
|
|
||||||
testSync "bar";
|
test_sync("bar")
|
||||||
|
|
||||||
subtest "checking certificate revocation of user bar", sub {
|
with subtest("checking certificate revocation of user bar"):
|
||||||
$client1->succeed(checkClientCert "bar");
|
client1.succeed(check_client_cert("bar"))
|
||||||
|
|
||||||
$server->succeed("nixos-taskserver user remove imperativeOrg bar");
|
server.succeed("nixos-taskserver user remove imperativeOrg bar")
|
||||||
restartServer;
|
restart_server()
|
||||||
|
|
||||||
$client1->fail(checkClientCert "bar");
|
client1.fail(check_client_cert("bar"))
|
||||||
|
|
||||||
$client1->succeed(su "bar", "task add destroy everything >&2");
|
client1.succeed(su("bar", "task add destroy everything >&2"))
|
||||||
$client1->fail(su "bar", "task sync >&2");
|
client1.fail(su("bar", "task sync >&2"))
|
||||||
};
|
|
||||||
|
|
||||||
readdImperativeUser;
|
re_add_imperative_user()
|
||||||
|
|
||||||
subtest "checking certificate revocation of org imperativeOrg", sub {
|
with subtest("checking certificate revocation of org imperativeOrg"):
|
||||||
$client1->succeed(checkClientCert "bar");
|
client1.succeed(check_client_cert("bar"))
|
||||||
|
|
||||||
$server->succeed("nixos-taskserver org remove imperativeOrg");
|
server.succeed("nixos-taskserver org remove imperativeOrg")
|
||||||
restartServer;
|
restart_server()
|
||||||
|
|
||||||
$client1->fail(checkClientCert "bar");
|
client1.fail(check_client_cert("bar"))
|
||||||
|
|
||||||
$client1->succeed(su "bar", "task add destroy even more >&2");
|
client1.succeed(su("bar", "task add destroy even more >&2"))
|
||||||
$client1->fail(su "bar", "task sync >&2");
|
client1.fail(su("bar", "task sync >&2"))
|
||||||
};
|
|
||||||
|
|
||||||
readdImperativeUser;
|
re_add_imperative_user()
|
||||||
|
|
||||||
subtest "check whether declarative config overrides user bar", sub {
|
with subtest("check whether declarative config overrides user bar"):
|
||||||
restartServer;
|
restart_server()
|
||||||
testSync "bar";
|
test_sync("bar")
|
||||||
};
|
|
||||||
|
|
||||||
subtest "check manual configuration", sub {
|
|
||||||
# Remove the keys from automatic CA creation, to make sure the new
|
|
||||||
# generation doesn't use keys from before.
|
|
||||||
$server->succeed('rm -rf ${cfg.dataDir}/keys/* >&2');
|
|
||||||
|
|
||||||
$server->succeed('${switchToNewServer} >&2');
|
def init_manual_config(client, org, user):
|
||||||
$server->waitForUnit("taskserver.service");
|
cfgpath = f"/home/{user}/.task"
|
||||||
$server->waitForOpenPort(${portStr});
|
|
||||||
|
|
||||||
$server->succeed(
|
client.copy_from_host(
|
||||||
"nixos-taskserver org add manualOrg",
|
"${snakeOil.cacert}",
|
||||||
"nixos-taskserver user add manualOrg alice"
|
f"{cfgpath}/ca.cert",
|
||||||
);
|
)
|
||||||
|
for file in ["alice.key", "alice.cert"]:
|
||||||
|
client.copy_from_host(
|
||||||
|
f"${snakeOil}/{file}",
|
||||||
|
f"{cfgpath}/{file}",
|
||||||
|
)
|
||||||
|
|
||||||
setupClientsFor "manualOrg", "alice", sub {
|
for file in [f"{user}.key", f"{user}.cert"]:
|
||||||
my ($client, $org, $user) = @_;
|
client.copy_from_host(
|
||||||
my $cfgpath = "/home/$user/.task";
|
f"${snakeOil}/{file}",
|
||||||
|
f"{cfgpath}/{file}",
|
||||||
|
)
|
||||||
|
|
||||||
$client->copyFileFromHost("${snakeOil.cacert}", "$cfgpath/ca.cert");
|
client.succeed(
|
||||||
for my $file ('alice.key', 'alice.cert') {
|
su("alice", f"task config taskd.ca {cfgpath}/ca.cert"),
|
||||||
$client->copyFileFromHost("${snakeOil}/$file", "$cfgpath/$file");
|
su("alice", f"task config taskd.key {cfgpath}/{user}.key"),
|
||||||
}
|
su(user, f"task config taskd.certificate {cfgpath}/{user}.cert"),
|
||||||
|
)
|
||||||
|
|
||||||
for my $file ("$user.key", "$user.cert") {
|
|
||||||
$client->copyFileFromHost(
|
|
||||||
"${snakeOil}/$file", "$cfgpath/$file"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
$client->copyFileFromHost(
|
|
||||||
"${snakeOil.cacert}", "$cfgpath/ca.cert"
|
|
||||||
);
|
|
||||||
$client->succeed(
|
|
||||||
(su "alice", "task config taskd.ca $cfgpath/ca.cert"),
|
|
||||||
(su "alice", "task config taskd.key $cfgpath/$user.key"),
|
|
||||||
(su $user, "task config taskd.certificate $cfgpath/$user.cert")
|
|
||||||
);
|
|
||||||
};
|
|
||||||
|
|
||||||
testSync "alice";
|
with subtest("check manual configuration"):
|
||||||
};
|
# Remove the keys from automatic CA creation, to make sure the new
|
||||||
|
# generation doesn't use keys from before.
|
||||||
|
server.succeed("rm -rf ${cfg.dataDir}/keys/* >&2")
|
||||||
|
|
||||||
|
server.succeed(
|
||||||
|
"${switchToNewServer} >&2"
|
||||||
|
)
|
||||||
|
server.wait_for_unit("taskserver.service")
|
||||||
|
server.wait_for_open_port(${portStr})
|
||||||
|
|
||||||
|
server.succeed(
|
||||||
|
"nixos-taskserver org add manualOrg",
|
||||||
|
"nixos-taskserver user add manualOrg alice",
|
||||||
|
)
|
||||||
|
|
||||||
|
setup_clients_for("manualOrg", "alice", init_manual_config)
|
||||||
|
|
||||||
|
test_sync("alice")
|
||||||
'';
|
'';
|
||||||
})
|
})
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue