parent
17b24b5262
commit
41f28e9fbc
@ -0,0 +1,170 @@ |
||||
import ../make-test-python.nix ({pkgs, ...}: |
||||
let |
||||
test-certificates = pkgs.runCommandLocal "test-certificates" { } '' |
||||
mkdir -p $out |
||||
echo insecure-root-password > $out/root-password-file |
||||
echo insecure-intermediate-password > $out/intermediate-password-file |
||||
${pkgs.step-cli}/bin/step certificate create "Example Root CA" $out/root_ca.crt $out/root_ca.key --password-file=$out/root-password-file --profile root-ca |
||||
${pkgs.step-cli}/bin/step certificate create "Example Intermediate CA 1" $out/intermediate_ca.crt $out/intermediate_ca.key --password-file=$out/intermediate-password-file --ca-password-file=$out/root-password-file --profile intermediate-ca --ca $out/root_ca.crt --ca-key $out/root_ca.key |
||||
''; |
||||
|
||||
hosts = '' |
||||
192.168.2.10 ca.local |
||||
192.168.2.11 mastodon.local |
||||
''; |
||||
|
||||
in |
||||
{ |
||||
name = "mastodon"; |
||||
meta.maintainers = with pkgs.lib.maintainers; [ erictapen izorkin ]; |
||||
|
||||
nodes = { |
||||
ca = { pkgs, ... }: { |
||||
networking = { |
||||
interfaces.eth1 = { |
||||
ipv4.addresses = [ |
||||
{ address = "192.168.2.10"; prefixLength = 24; } |
||||
]; |
||||
}; |
||||
extraHosts = hosts; |
||||
}; |
||||
services.step-ca = { |
||||
enable = true; |
||||
address = "0.0.0.0"; |
||||
port = 8443; |
||||
openFirewall = true; |
||||
intermediatePasswordFile = "${test-certificates}/intermediate-password-file"; |
||||
settings = { |
||||
dnsNames = [ "ca.local" ]; |
||||
root = "${test-certificates}/root_ca.crt"; |
||||
crt = "${test-certificates}/intermediate_ca.crt"; |
||||
key = "${test-certificates}/intermediate_ca.key"; |
||||
db = { |
||||
type = "badger"; |
||||
dataSource = "/var/lib/step-ca/db"; |
||||
}; |
||||
authority = { |
||||
provisioners = [ |
||||
{ |
||||
type = "ACME"; |
||||
name = "acme"; |
||||
} |
||||
]; |
||||
}; |
||||
}; |
||||
}; |
||||
}; |
||||
|
||||
server = { pkgs, ... }: { |
||||
networking = { |
||||
interfaces.eth1 = { |
||||
ipv4.addresses = [ |
||||
{ address = "192.168.2.11"; prefixLength = 24; } |
||||
]; |
||||
}; |
||||
extraHosts = hosts; |
||||
firewall.allowedTCPPorts = [ 80 443 ]; |
||||
}; |
||||
|
||||
security = { |
||||
acme = { |
||||
acceptTerms = true; |
||||
defaults.server = "https://ca.local:8443/acme/acme/directory"; |
||||
defaults.email = "mastodon@mastodon.local"; |
||||
}; |
||||
pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ]; |
||||
}; |
||||
|
||||
services.redis.servers.mastodon = { |
||||
enable = true; |
||||
bind = "127.0.0.1"; |
||||
port = 31637; |
||||
}; |
||||
|
||||
services.mastodon = { |
||||
enable = true; |
||||
configureNginx = true; |
||||
localDomain = "mastodon.local"; |
||||
enableUnixSocket = false; |
||||
redis = { |
||||
createLocally = true; |
||||
host = "127.0.0.1"; |
||||
port = 31637; |
||||
}; |
||||
database = { |
||||
createLocally = true; |
||||
host = "/run/postgresql"; |
||||
port = 5432; |
||||
}; |
||||
smtp = { |
||||
createLocally = false; |
||||
fromAddress = "mastodon@mastodon.local"; |
||||
}; |
||||
extraConfig = { |
||||
EMAIL_DOMAIN_ALLOWLIST = "example.com"; |
||||
}; |
||||
}; |
||||
}; |
||||
|
||||
client = { pkgs, ... }: { |
||||
environment.systemPackages = [ pkgs.jq ]; |
||||
networking = { |
||||
interfaces.eth1 = { |
||||
ipv4.addresses = [ |
||||
{ address = "192.168.2.12"; prefixLength = 24; } |
||||
]; |
||||
}; |
||||
extraHosts = hosts; |
||||
}; |
||||
|
||||
security = { |
||||
pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ]; |
||||
}; |
||||
}; |
||||
}; |
||||
|
||||
testScript = '' |
||||
start_all() |
||||
|
||||
ca.wait_for_unit("step-ca.service") |
||||
ca.wait_for_open_port(8443) |
||||
|
||||
server.wait_for_unit("nginx.service") |
||||
server.wait_for_unit("redis-mastodon.service") |
||||
server.wait_for_unit("postgresql.service") |
||||
server.wait_for_unit("mastodon-sidekiq.service") |
||||
server.wait_for_unit("mastodon-streaming.service") |
||||
server.wait_for_unit("mastodon-web.service") |
||||
server.wait_for_open_port(55000) |
||||
server.wait_for_open_port(55001) |
||||
|
||||
# Check Mastodon version from remote client |
||||
client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'") |
||||
|
||||
# Check using admin CLI |
||||
# Check Mastodon version |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl version' | grep '${pkgs.mastodon.version}'") |
||||
|
||||
# Manage accounts |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks add example.com'") |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks list' | grep 'example.com'") |
||||
server.fail("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks list' | grep 'mastodon.local'") |
||||
server.fail("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts create alice --email=alice@example.com'") |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks remove example.com'") |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts create bob --email=bob@example.com'") |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts approve bob'") |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts delete bob'") |
||||
|
||||
# Manage IP access |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl ip_blocks add 192.168.0.0/16 --severity=no_access'") |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl ip_blocks export' | grep '192.168.0.0/16'") |
||||
server.fail("su - mastodon -s /bin/sh -c 'mastodon-env tootctl p_blocks export' | grep '172.16.0.0/16'") |
||||
client.fail("curl --fail https://mastodon.local/about") |
||||
server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl ip_blocks remove 192.168.0.0/16'") |
||||
client.succeed("curl --fail https://mastodon.local/about") |
||||
|
||||
ca.shutdown() |
||||
server.shutdown() |
||||
client.shutdown() |
||||
''; |
||||
}) |
Loading…
Reference in new issue