nixos/tests/nixos-rebuild-target-host.nix

   1 import ./make-test-python.nix ({ pkgs, ... }: {
   2   name = "nixos-rebuild-target-host";
   3
   4   nodes = {
   5     deployer = { lib, ... }: let
   6       inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
   7     in {
   8       imports = [ ../modules/profiles/installation-device.nix ];
   9
  10       nix.settings = {
  11         substituters = lib.mkForce [ ];
  12         hashed-mirrors = null;
  13         connect-timeout = 1;
  14       };
  15
  16       environment.systemPackages = [ pkgs.passh ];
  17
  18       system.includeBuildDependencies = true;
  19
  20       virtualisation = {
  21         cores = 2;
  22         memorySize = 2048;
  23       };
  24
  25       system.build.privateKey = snakeOilPrivateKey;
  26       system.build.publicKey = snakeOilPublicKey;
  27       # needed to provide STC implementation for target
  28       system.switch.enable = true;
  29     };
  30
  31     target = { nodes, lib, ... }: let
  32       targetConfig = {
  33         documentation.enable = false;
  34         services.openssh.enable = true;
  35
  36         users.users.root.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
  37         users.users.alice.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
  38         users.users.bob.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
  39
  40         users.users.alice.extraGroups = [ "wheel" ];
  41         users.users.bob.extraGroups = [ "wheel" ];
  42
  43         # Disable sudo for root to ensure sudo isn't called without `--use-remote-sudo`
  44         security.sudo.extraRules = lib.mkForce [
  45           { groups = [ "wheel" ]; commands = [ { command = "ALL"; } ]; }
  46           { users = [ "alice" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
  47         ];
  48
  49         nix.settings.trusted-users = [ "@wheel" ];
  50       };
  51     in {
  52       imports = [ ./common/user-account.nix ];
  53
  54       config = lib.mkMerge [
  55         targetConfig
  56         {
  57           system.build = {
  58             inherit targetConfig;
  59           };
  60
  61           networking.hostName = "target";
  62         }
  63       ];
  64     };
  65   };
  66
  67   testScript = { nodes, ... }:
  68     let
  69       sshConfig = builtins.toFile "ssh.conf" ''
  70         UserKnownHostsFile=/dev/null
  71         StrictHostKeyChecking=no
  72       '';
  73
  74       targetConfigJSON = pkgs.writeText "target-configuration.json"
  75         (builtins.toJSON nodes.target.system.build.targetConfig);
  76
  77       targetNetworkJSON = pkgs.writeText "target-network.json"
  78         (builtins.toJSON nodes.target.system.build.networkConfig);
  79
  80       configFile = hostname: pkgs.writeText "configuration.nix" ''
  81         { lib, modulesPath, ... }: {
  82           imports = [
  83             (modulesPath + "/virtualisation/qemu-vm.nix")
  84             (modulesPath + "/testing/test-instrumentation.nix")
  85             (modulesPath + "/../tests/common/user-account.nix")
  86             (lib.modules.importJSON ./target-configuration.json)
  87             (lib.modules.importJSON ./target-network.json)
  88             ./hardware-configuration.nix
  89           ];
  90
  91           boot.loader.grub = {
  92             enable = true;
  93             device = "/dev/vda";
  94             forceInstall = true;
  95           };
  96
  97           # this will be asserted
  98           networking.hostName = "${hostname}";
  99         }
 100       '';
 101     in
 102     ''
 103       start_all()
 104       target.wait_for_open_port(22)
 105
 106       deployer.wait_until_succeeds("ping -c1 target")
 107       deployer.succeed("install -Dm 600 ${nodes.deployer.system.build.privateKey} ~root/.ssh/id_ecdsa")
 108       deployer.succeed("install ${sshConfig} ~root/.ssh/config")
 109
 110       target.succeed("nixos-generate-config")
 111       deployer.succeed("scp alice@target:/etc/nixos/hardware-configuration.nix /root/hardware-configuration.nix")
 112
 113       deployer.copy_from_host("${configFile "config-1-deployed"}", "/root/configuration-1.nix")
 114       deployer.copy_from_host("${configFile "config-2-deployed"}", "/root/configuration-2.nix")
 115       deployer.copy_from_host("${configFile "config-3-deployed"}", "/root/configuration-3.nix")
 116       deployer.copy_from_host("${targetNetworkJSON}", "/root/target-network.json")
 117       deployer.copy_from_host("${targetConfigJSON}", "/root/target-configuration.json")
 118
 119       # Ensure sudo is disabled for root
 120       target.fail("sudo true")
 121
 122       # This test also ensures that sudo is not called without --use-remote-sudo
 123       with subtest("Deploy to root@target"):
 124         deployer.succeed("nixos-rebuild switch -I nixos-config=/root/configuration-1.nix --target-host root@target &>/dev/console")
 125         target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
 126         assert target_hostname == "config-1-deployed", f"{target_hostname=}"
 127
 128       with subtest("Deploy to alice@target with passwordless sudo"):
 129         deployer.succeed("nixos-rebuild switch -I nixos-config=/root/configuration-2.nix --target-host alice@target --use-remote-sudo &>/dev/console")
 130         target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
 131         assert target_hostname == "config-2-deployed", f"{target_hostname=}"
 132
 133       with subtest("Deploy to bob@target with password based sudo"):
 134         deployer.succeed("passh -c 3 -C -p ${nodes.target.users.users.bob.password} -P \"\[sudo\] password\" nixos-rebuild switch -I nixos-config=/root/configuration-3.nix --target-host bob@target --use-remote-sudo &>/dev/console")
 135         target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
 136         assert target_hostname == "config-3-deployed", f"{target_hostname=}"
 137
 138       with subtest("Deploy works with very long TMPDIR"):
 139         tmp_dir = "/var/folder/veryveryveryveryverylongpathnamethatdoesnotworkwithcontrolpath"
 140         deployer.succeed(f"mkdir -p {tmp_dir}")
 141         deployer.succeed(f"TMPDIR={tmp_dir} nixos-rebuild switch -I nixos-config=/root/configuration-1.nix --target-host root@target &>/dev/console")
 142     '';
 143 })