nixos/tests/taskserver.nix

   1 import ./make-test-python.nix ({ pkgs, ... }: let
   2   snakeOil = pkgs.runCommand "snakeoil-certs" {
   3     outputs = [ "out" "cacert" "cert" "key" "crl" ];
   4     buildInputs = [ pkgs.gnutls.bin ];
   5     caTemplate = pkgs.writeText "snakeoil-ca.template" ''
   6       cn = server
   7       expiration_days = -1
   8       cert_signing_key
   9       ca
  10     '';
  11     certTemplate = pkgs.writeText "snakeoil-cert.template" ''
  12       cn = server
  13       expiration_days = -1
  14       tls_www_server
  15       encryption_key
  16       signing_key
  17     '';
  18     crlTemplate = pkgs.writeText "snakeoil-crl.template" ''
  19       expiration_days = -1
  20     '';
  21     userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
  22       organization = snakeoil
  23       cn = server
  24       expiration_days = -1
  25       tls_www_client
  26       encryption_key
  27       signing_key
  28     '';
  29   } ''
  30     certtool -p --bits 4096 --outfile ca.key
  31     certtool -s --template "$caTemplate" --load-privkey ca.key \
  32                 --outfile "$cacert"
  33     certtool -p --bits 4096 --outfile "$key"
  34     certtool -c --template "$certTemplate" \
  35                 --load-ca-privkey ca.key \
  36                 --load-ca-certificate "$cacert" \
  37                 --load-privkey "$key" \
  38                 --outfile "$cert"
  39     certtool --generate-crl --template "$crlTemplate" \
  40                             --load-ca-privkey ca.key \
  41                             --load-ca-certificate "$cacert" \
  42                             --outfile "$crl"
  43
  44     mkdir "$out"
  45
  46     # Stripping key information before the actual PEM-encoded values is solely
  47     # to make test output a bit less verbose when copying the client key to the
  48     # actual client.
  49     certtool -p --bits 4096 | sed -n \
  50       -e '/^----* *BEGIN/,/^----* *END/p' > "$out/alice.key"
  51
  52     certtool -c --template "$userCertTemplate" \
  53                 --load-privkey "$out/alice.key" \
  54                 --load-ca-privkey ca.key \
  55                 --load-ca-certificate "$cacert" \
  56                 --outfile "$out/alice.cert"
  57   '';
  58
  59 in {
  60   name = "taskserver";
  61
  62   nodes = rec {
  63     server = {
  64       services.taskserver.enable = true;
  65       services.taskserver.listenHost = "::";
  66       services.taskserver.openFirewall = true;
  67       services.taskserver.fqdn = "server";
  68       services.taskserver.organisations = {
  69         testOrganisation.users = [ "alice" "foo" ];
  70         anotherOrganisation.users = [ "bob" ];
  71       };
  72
  73       specialisation.manual_config.configuration = {
  74         services.taskserver.pki.manual = {
  75           ca.cert = snakeOil.cacert;
  76           server.cert = snakeOil.cert;
  77           server.key = snakeOil.key;
  78           server.crl = snakeOil.crl;
  79         };
  80       };
  81     };
  82
  83     client1 = { pkgs, ... }: {
  84       environment.systemPackages = [ pkgs.taskwarrior2 pkgs.gnutls ];
  85       users.users.alice.isNormalUser = true;
  86       users.users.bob.isNormalUser = true;
  87       users.users.foo.isNormalUser = true;
  88       users.users.bar.isNormalUser = true;
  89     };
  90
  91     client2 = client1;
  92   };
  93
  94   testScript = { nodes, ... }: let
  95     cfg = nodes.server.config.services.taskserver;
  96     portStr = toString cfg.listenPort;
  97     specialisations = "${nodes.server.system.build.toplevel}/specialisation";
  98     newServerSystem = "${specialisations}/manual_config";
  99     switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
 100   in ''
 101     from shlex import quote
 102
 103
 104     def su(user, cmd):
 105         return f"su - {user} -c {quote(cmd)}"
 106
 107
 108     def no_extra_init(client, org, user):
 109         pass
 110
 111
 112     def setup_clients_for(org, user, extra_init=no_extra_init):
 113         for client in [client1, client2]:
 114             with client.nested(f"initialize client for user {user}"):
 115                 client.succeed(
 116                     su(user, f"rm -rf /home/{user}/.task"),
 117                     su(user, "task rc.confirmation=no config confirmation no"),
 118                 )
 119
 120                 exportinfo = server.succeed(f"nixos-taskserver user export {org} {user}")
 121
 122                 with client.nested("importing taskwarrior configuration"):
 123                     client.succeed(su(user, f"eval {quote(exportinfo)} >&2"))
 124
 125                 extra_init(client, org, user)
 126
 127                 client.succeed(su(user, "task config taskd.server server:${portStr} >&2"))
 128
 129                 client.succeed(su(user, "task sync init >&2"))
 130
 131
 132     def restart_server():
 133         server.systemctl("restart taskserver.service")
 134         server.wait_for_open_port(${portStr})
 135
 136
 137     def re_add_imperative_user():
 138         with server.nested("(re-)add imperative user bar"):
 139             server.execute("nixos-taskserver org remove imperativeOrg")
 140             server.succeed(
 141                 "nixos-taskserver org add imperativeOrg",
 142                 "nixos-taskserver user add imperativeOrg bar",
 143             )
 144             setup_clients_for("imperativeOrg", "bar")
 145
 146
 147     def test_sync(user):
 148         with subtest(f"sync for user {user}"):
 149             client1.succeed(su(user, "task add foo >&2"))
 150             client1.succeed(su(user, "task sync >&2"))
 151             client2.fail(su(user, "task list >&2"))
 152             client2.succeed(su(user, "task sync >&2"))
 153             client2.succeed(su(user, "task list >&2"))
 154
 155
 156     def check_client_cert(user):
 157         # debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040
 158         cmd = (
 159             f"gnutls-cli -d 3"
 160             f" --x509cafile=/home/{user}/.task/keys/ca.cert"
 161             f" --x509keyfile=/home/{user}/.task/keys/private.key"
 162             f" --x509certfile=/home/{user}/.task/keys/public.cert"
 163             f" --port=${portStr} server < /dev/null"
 164         )
 165         return su(user, cmd)
 166
 167
 168     # Explicitly start the VMs so that we don't accidentally start newServer
 169     server.start()
 170     client1.start()
 171     client2.start()
 172
 173     server.wait_for_unit("taskserver.service")
 174
 175     server.succeed(
 176         "nixos-taskserver user list testOrganisation | grep -qxF alice",
 177         "nixos-taskserver user list testOrganisation | grep -qxF foo",
 178         "nixos-taskserver user list anotherOrganisation | grep -qxF bob",
 179     )
 180
 181     server.wait_for_open_port(${portStr})
 182
 183     client1.wait_for_unit("multi-user.target")
 184     client2.wait_for_unit("multi-user.target")
 185
 186     setup_clients_for("testOrganisation", "alice")
 187     setup_clients_for("testOrganisation", "foo")
 188     setup_clients_for("anotherOrganisation", "bob")
 189
 190     for user in ["alice", "bob", "foo"]:
 191         test_sync(user)
 192
 193     server.fail("nixos-taskserver user add imperativeOrg bar")
 194     re_add_imperative_user()
 195
 196     test_sync("bar")
 197
 198     with subtest("checking certificate revocation of user bar"):
 199         client1.succeed(check_client_cert("bar"))
 200
 201         server.succeed("nixos-taskserver user remove imperativeOrg bar")
 202         restart_server()
 203
 204         client1.fail(check_client_cert("bar"))
 205
 206         client1.succeed(su("bar", "task add destroy everything >&2"))
 207         client1.fail(su("bar", "task sync >&2"))
 208
 209     re_add_imperative_user()
 210
 211     with subtest("checking certificate revocation of org imperativeOrg"):
 212         client1.succeed(check_client_cert("bar"))
 213
 214         server.succeed("nixos-taskserver org remove imperativeOrg")
 215         restart_server()
 216
 217         client1.fail(check_client_cert("bar"))
 218
 219         client1.succeed(su("bar", "task add destroy even more >&2"))
 220         client1.fail(su("bar", "task sync >&2"))
 221
 222     re_add_imperative_user()
 223
 224     with subtest("check whether declarative config overrides user bar"):
 225         restart_server()
 226         test_sync("bar")
 227
 228
 229     def init_manual_config(client, org, user):
 230         cfgpath = f"/home/{user}/.task"
 231
 232         client.copy_from_host(
 233             "${snakeOil.cacert}",
 234             f"{cfgpath}/ca.cert",
 235         )
 236         for file in ["alice.key", "alice.cert"]:
 237             client.copy_from_host(
 238                 f"${snakeOil}/{file}",
 239                 f"{cfgpath}/{file}",
 240             )
 241
 242         for file in [f"{user}.key", f"{user}.cert"]:
 243             client.copy_from_host(
 244                 f"${snakeOil}/{file}",
 245                 f"{cfgpath}/{file}",
 246             )
 247
 248         client.succeed(
 249             su("alice", f"task config taskd.ca {cfgpath}/ca.cert"),
 250             su("alice", f"task config taskd.key {cfgpath}/{user}.key"),
 251             su(user, f"task config taskd.certificate {cfgpath}/{user}.cert"),
 252         )
 253
 254
 255     with subtest("check manual configuration"):
 256         # Remove the keys from automatic CA creation, to make sure the new
 257         # generation doesn't use keys from before.
 258         server.succeed("rm -rf ${cfg.dataDir}/keys/* >&2")
 259
 260         server.succeed(
 261             "${switchToNewServer} >&2"
 262         )
 263         server.wait_for_unit("taskserver.service")
 264         server.wait_for_open_port(${portStr})
 265
 266         server.succeed(
 267             "nixos-taskserver org add manualOrg",
 268             "nixos-taskserver user add manualOrg alice",
 269         )
 270
 271         setup_clients_for("manualOrg", "alice", init_manual_config)
 272
 273         test_sync("alice")
 274   '';
 275 })