nixos/tests/headscale.nix

   1 import ./make-test-python.nix ({ pkgs, lib, ... }:
   2   let
   3     tls-cert =
   4       pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
   5         openssl req \
   6           -x509 -newkey rsa:4096 -sha256 -days 365 \
   7           -nodes -out cert.pem -keyout key.pem \
   8           -subj '/CN=headscale' -addext "subjectAltName=DNS:headscale"
   9
  10         mkdir -p $out
  11         cp key.pem cert.pem $out
  12       '';
  13   in {
  14     name = "headscale";
  15     meta.maintainers = with lib.maintainers; [ misterio77 ];
  16
  17     nodes = let
  18       headscalePort = 8080;
  19       stunPort = 3478;
  20       peer = {
  21         services.tailscale.enable = true;
  22         security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
  23       };
  24     in {
  25       peer1 = peer;
  26       peer2 = peer;
  27
  28       headscale = {
  29         services = {
  30           headscale = {
  31             enable = true;
  32             port = headscalePort;
  33             settings = {
  34               server_url = "https://headscale";
  35               ip_prefixes = [ "100.64.0.0/10" ];
  36               derp.server = {
  37                 enabled = true;
  38                 region_id = 999;
  39                 stun_listen_addr = "0.0.0.0:${toString stunPort}";
  40               };
  41             };
  42           };
  43           nginx = {
  44             enable = true;
  45             virtualHosts.headscale = {
  46               addSSL = true;
  47               sslCertificate = "${tls-cert}/cert.pem";
  48               sslCertificateKey = "${tls-cert}/key.pem";
  49               locations."/" = {
  50                 proxyPass = "http://127.0.0.1:${toString headscalePort}";
  51                 proxyWebsockets = true;
  52               };
  53             };
  54           };
  55         };
  56         networking.firewall = {
  57           allowedTCPPorts = [ 80 443 ];
  58           allowedUDPPorts = [ stunPort ];
  59         };
  60         environment.systemPackages = [ pkgs.headscale ];
  61       };
  62     };
  63
  64     testScript = ''
  65       start_all()
  66       headscale.wait_for_unit("headscale")
  67       headscale.wait_for_open_port(443)
  68
  69       # Create headscale user and preauth-key
  70       headscale.succeed("headscale users create test")
  71       authkey = headscale.succeed("headscale preauthkeys -u test create --reusable")
  72
  73       # Connect peers
  74       up_cmd = f"tailscale up --login-server 'https://headscale' --auth-key {authkey}"
  75       peer1.execute(up_cmd)
  76       peer2.execute(up_cmd)
  77
  78       # Check that they are reachable from the tailnet
  79       peer1.wait_until_succeeds("tailscale ping peer2")
  80       peer2.wait_until_succeeds("tailscale ping peer1")
  81     '';
  82   })