nixos/tests/sourcehut.nix

   1 import ./make-test-python.nix ({ pkgs, lib, ... }:
   2 let
   3   domain = "sourcehut.localdomain";
   4
   5   # Note that wildcard certificates just under the TLD (eg. *.com)
   6   # would be rejected by clients like curl.
   7   tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
   8     openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 36500 \
   9       -subj '/CN=${domain}' -extensions v3_req \
  10       -addext 'subjectAltName = DNS:*.${domain}'
  11     install -D -t $out key.pem cert.pem
  12   '';
  13
  14   images = {
  15     nixos.unstable.x86_64 =
  16       let
  17         systemConfig = { pkgs, ... }: {
  18           # passwordless ssh server
  19           services.openssh = {
  20             enable = true;
  21             settings = {
  22               PermitRootLogin = "yes";
  23               PermitEmptyPasswords = true;
  24             };
  25           };
  26
  27           users = {
  28             mutableUsers = false;
  29             # build user
  30             extraUsers."build" = {
  31               isNormalUser = true;
  32               uid = 1000;
  33               extraGroups = [ "wheel" ];
  34               password = "";
  35             };
  36             users.root.password = "";
  37           };
  38
  39           security.sudo.wheelNeedsPassword = false;
  40           nix.settings.trusted-users = [ "root" "build" ];
  41           documentation.nixos.enable = false;
  42
  43           # builds.sr.ht-image-specific network settings
  44           networking = {
  45             hostName = "build";
  46             dhcpcd.enable = false;
  47             defaultGateway.address = "10.0.2.2";
  48             usePredictableInterfaceNames = false;
  49             interfaces."eth0".ipv4.addresses = [{
  50               address = "10.0.2.15";
  51               prefixLength = 25;
  52             }];
  53             enableIPv6 = false;
  54             nameservers = [
  55               # OpenNIC anycast
  56               "185.121.177.177"
  57               "169.239.202.202"
  58               # Google
  59               "8.8.8.8"
  60             ];
  61             firewall.allowedTCPPorts = [ 22 ];
  62           };
  63
  64           environment.systemPackages = [
  65             pkgs.gitMinimal
  66             #pkgs.mercurial
  67             pkgs.curl
  68             pkgs.gnupg
  69           ];
  70         };
  71         qemuConfig = { pkgs, ... }: {
  72           imports = [ systemConfig ];
  73           fileSystems."/".device = "/dev/disk/by-label/nixos";
  74           boot.initrd.availableKernelModules = [
  75             "ahci"
  76             "ehci_pci"
  77             "sd_mod"
  78             "usb_storage"
  79             "usbhid"
  80             "virtio_balloon"
  81             "virtio_blk"
  82             "virtio_pci"
  83             "virtio_ring"
  84             "xhci_pci"
  85           ];
  86           boot.loader = {
  87             grub = {
  88               version = 2;
  89               device = "/dev/vda";
  90             };
  91             timeout = 0;
  92           };
  93         };
  94         config = (import (pkgs.path + "/nixos/lib/eval-config.nix") {
  95           inherit pkgs; modules = [ qemuConfig ];
  96           system = "x86_64-linux";
  97         }).config;
  98       in
  99       import (pkgs.path + "/nixos/lib/make-disk-image.nix") {
 100         inherit pkgs lib config;
 101         diskSize = 16000;
 102         format = "qcow2-compressed";
 103         contents = [
 104           { source = pkgs.writeText "gitconfig" ''
 105               [user]
 106                 name = builds.sr.ht
 107                 email = build@sr.ht
 108             '';
 109             target = "/home/build/.gitconfig";
 110             user = "build";
 111             group = "users";
 112             mode = "644";
 113           }
 114         ];
 115       };
 116   };
 117
 118 in
 119 {
 120   name = "sourcehut";
 121
 122   meta.maintainers = [ pkgs.lib.maintainers.tomberek ];
 123
 124   nodes.machine = { config, pkgs, nodes, ... }: {
 125     # buildsrht needs space
 126     virtualisation.diskSize = 4 * 1024;
 127     virtualisation.memorySize = 2 * 1024;
 128     networking.domain = domain;
 129     networking.enableIPv6 = false;
 130     networking.extraHosts = ''
 131       ${config.networking.primaryIPAddress} builds.${domain}
 132       ${config.networking.primaryIPAddress} git.${domain}
 133       ${config.networking.primaryIPAddress} meta.${domain}
 134     '';
 135
 136     services.sourcehut = {
 137       enable = true;
 138       nginx.enable = true;
 139       nginx.virtualHost = {
 140         forceSSL = true;
 141         sslCertificate = "${tls-cert}/cert.pem";
 142         sslCertificateKey = "${tls-cert}/key.pem";
 143       };
 144       postgresql.enable = true;
 145       redis.enable = true;
 146
 147       meta.enable = true;
 148       builds = {
 149         enable = true;
 150         # FIXME: see why it does not seem to activate fully.
 151         #enableWorker = true;
 152         inherit images;
 153       };
 154       git.enable = true;
 155
 156       settings."sr.ht" = {
 157         global-domain = config.networking.domain;
 158         service-key = pkgs.writeText "service-key" "8b327279b77e32a3620e2fc9aabce491cc46e7d821fd6713b2a2e650ce114d01";
 159         network-key = pkgs.writeText "network-key" "cEEmc30BRBGkgQZcHFksiG7hjc6_dK1XR2Oo5Jb9_nQ=";
 160       };
 161       settings."builds.sr.ht" = {
 162         oauth-client-secret = pkgs.writeText "buildsrht-oauth-client-secret" "2260e9c4d9b8dcedcef642860e0504bc";
 163         oauth-client-id = "299db9f9c2013170";
 164       };
 165       settings."git.sr.ht" = {
 166         oauth-client-secret = pkgs.writeText "gitsrht-oauth-client-secret" "3597288dc2c716e567db5384f493b09d";
 167         oauth-client-id = "d07cb713d920702e";
 168       };
 169       settings.webhooks.private-key = pkgs.writeText "webhook-key" "Ra3IjxgFiwG9jxgp4WALQIZw/BMYt30xWiOsqD0J7EA=";
 170       settings.mail = {
 171         smtp-from = "root+hut@${domain}";
 172         # WARNING: take care to keep pgp-privkey outside the Nix store in production,
 173         # or use LoadCredentialEncrypted=
 174         pgp-privkey = toString (pkgs.writeText "sourcehut.pgp-privkey" ''
 175           -----BEGIN PGP PRIVATE KEY BLOCK-----
 176
 177           lFgEYqDRORYJKwYBBAHaRw8BAQdAehGoy36FUx2OesYm07be2rtLyvR5Pb/ltstd
 178           Gk7hYQoAAP9X4oPmxxrHN8LewBpWITdBomNqlHoiP7mI0nz/BOPJHxEktDZuaXhv
 179           cy90ZXN0cy9zb3VyY2VodXQgPHJvb3QraHV0QHNvdXJjZWh1dC5sb2NhbGRvbWFp
 180           bj6IlwQTFgoAPxYhBPqjgjnL8RHN4JnADNicgXaYm0jJBQJioNE5AhsDBQkDwmcA
 181           BgsJCAcDCgUVCgkICwUWAwIBAAIeBQIXgAAKCRDYnIF2mJtIySVCAP9e2nHsVHSi
 182           2B1YGZpVG7Xf36vxljmMkbroQy+0gBPwRwEAq+jaiQqlbGhQ7R/HMFcAxBIVsq8h
 183           Aw1rngsUd0o3dAicXQRioNE5EgorBgEEAZdVAQUBAQdAXZV2Sd5ZNBVTBbTGavMv
 184           D6ORrUh8z7TI/3CsxCE7+yADAQgHAAD/c1RU9xH+V/uI1fE7HIn/zL0LUPpsuce2
 185           cH++g4u3kBgTOYh+BBgWCgAmFiEE+qOCOcvxEc3gmcAM2JyBdpibSMkFAmKg0TkC
 186           GwwFCQPCZwAACgkQ2JyBdpibSMlKagD/cTre6p1m8QuJ7kwmCFRSz5tBzIuYMMgN
 187           xtT7dmS91csA/35fWsOykSiFRojQ7ccCSUTHL7ApF2EbL968tP/D2hIG
 188           =Hjoc
 189           -----END PGP PRIVATE KEY BLOCK-----
 190         '');
 191         pgp-pubkey = pkgs.writeText "sourcehut.pgp-pubkey" ''
 192           -----BEGIN PGP PUBLIC KEY BLOCK-----
 193
 194           mDMEYqDRORYJKwYBBAHaRw8BAQdAehGoy36FUx2OesYm07be2rtLyvR5Pb/ltstd
 195           Gk7hYQq0Nm5peG9zL3Rlc3RzL3NvdXJjZWh1dCA8cm9vdCtodXRAc291cmNlaHV0
 196           LmxvY2FsZG9tYWluPoiXBBMWCgA/FiEE+qOCOcvxEc3gmcAM2JyBdpibSMkFAmKg
 197           0TkCGwMFCQPCZwAGCwkIBwMKBRUKCQgLBRYDAgEAAh4FAheAAAoJENicgXaYm0jJ
 198           JUIA/17acexUdKLYHVgZmlUbtd/fq/GWOYyRuuhDL7SAE/BHAQCr6NqJCqVsaFDt
 199           H8cwVwDEEhWyryEDDWueCxR3Sjd0CLg4BGKg0TkSCisGAQQBl1UBBQEBB0BdlXZJ
 200           3lk0FVMFtMZq8y8Po5GtSHzPtMj/cKzEITv7IAMBCAeIfgQYFgoAJhYhBPqjgjnL
 201           8RHN4JnADNicgXaYm0jJBQJioNE5AhsMBQkDwmcAAAoJENicgXaYm0jJSmoA/3E6
 202           3uqdZvELie5MJghUUs+bQcyLmDDIDcbU+3ZkvdXLAP9+X1rDspEohUaI0O3HAklE
 203           xy+wKRdhGy/evLT/w9oSBg==
 204           =pJD7
 205           -----END PGP PUBLIC KEY BLOCK-----
 206         '';
 207         pgp-key-id = "0xFAA38239CBF111CDE099C00CD89C8176989B48C9";
 208       };
 209     };
 210
 211     networking.firewall.allowedTCPPorts = [ 443 ];
 212     security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
 213     services.nginx = {
 214       enable = true;
 215       recommendedGzipSettings = true;
 216       recommendedOptimisation = true;
 217       recommendedTlsSettings = true;
 218       recommendedProxySettings = true;
 219     };
 220
 221     services.postgresql = {
 222       enable = true;
 223       enableTCPIP = false;
 224       settings.unix_socket_permissions = "0770";
 225     };
 226   };
 227
 228   testScript = ''
 229     start_all()
 230     machine.wait_for_unit("multi-user.target")
 231
 232     # Testing metasrht
 233     machine.wait_for_unit("metasrht-api.service")
 234     machine.wait_for_unit("metasrht.service")
 235     machine.wait_for_unit("metasrht-webhooks.service")
 236     machine.wait_for_open_port(5000)
 237     machine.succeed("curl -sL http://localhost:5000 | grep meta.${domain}")
 238     machine.succeed("curl -sL http://meta.${domain} | grep meta.${domain}")
 239
 240     # Testing buildsrht
 241     machine.wait_for_unit("buildsrht.service")
 242     machine.wait_for_open_port(5002)
 243     machine.succeed("curl -sL http://localhost:5002 | grep builds.${domain}")
 244     #machine.wait_for_unit("buildsrht-worker.service")
 245
 246     # Testing gitsrht
 247     machine.wait_for_unit("gitsrht-api.service")
 248     machine.wait_for_unit("gitsrht.service")
 249     machine.wait_for_unit("gitsrht-webhooks.service")
 250     machine.succeed("curl -sL http://git.${domain} | grep git.${domain}")
 251   '';
 252 })