nixos/tests/kanidm.nix

   1 import ./make-test-python.nix ({ pkgs, ... }:
   2   let
   3     certs = import ./common/acme/server/snakeoil-certs.nix;
   4     serverDomain = certs.domain;
   5   in
   6   {
   7     name = "kanidm";
   8     meta.maintainers = with pkgs.lib.maintainers; [ erictapen Flakebi ];
   9
  10     nodes.server = { config, pkgs, lib, ... }: {
  11       services.kanidm = {
  12         enableServer = true;
  13         serverSettings = {
  14           origin = "https://${serverDomain}";
  15           domain = serverDomain;
  16           bindaddress = "[::1]:8443";
  17           ldapbindaddress = "[::1]:636";
  18         };
  19       };
  20
  21       services.nginx = {
  22         enable = true;
  23         recommendedProxySettings = true;
  24         virtualHosts."${serverDomain}" = {
  25           forceSSL = true;
  26           sslCertificate = certs."${serverDomain}".cert;
  27           sslCertificateKey = certs."${serverDomain}".key;
  28           locations."/".proxyPass = "http://[::1]:8443";
  29         };
  30       };
  31
  32       security.pki.certificateFiles = [ certs.ca.cert ];
  33
  34       networking.hosts."::1" = [ serverDomain ];
  35       networking.firewall.allowedTCPPorts = [ 80 443 ];
  36
  37       users.users.kanidm.shell = pkgs.bashInteractive;
  38
  39       environment.systemPackages = with pkgs; [ kanidm openldap ripgrep ];
  40     };
  41
  42     nodes.client = { pkgs, nodes, ... }: {
  43       services.kanidm = {
  44         enableClient = true;
  45         clientSettings = {
  46           uri = "https://${serverDomain}";
  47           verify_ca = true;
  48           verify_hostnames = true;
  49         };
  50         enablePam = true;
  51         unixSettings = {
  52           pam_allowed_login_groups = [ "shell" ];
  53         };
  54       };
  55
  56       networking.hosts."${nodes.server.config.networking.primaryIPAddress}" = [ serverDomain ];
  57
  58       security.pki.certificateFiles = [ certs.ca.cert ];
  59     };
  60
  61     testScript = { nodes, ... }:
  62       let
  63         ldapBaseDN = builtins.concatStringsSep "," (map (s: "dc=" + s) (pkgs.lib.splitString "." serverDomain));
  64
  65         # We need access to the config file in the test script.
  66         filteredConfig = pkgs.lib.converge
  67           (pkgs.lib.filterAttrsRecursive (_: v: v != null))
  68           nodes.server.config.services.kanidm.serverSettings;
  69         serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;
  70
  71       in
  72       ''
  73         start_all()
  74         server.wait_for_unit("kanidm.service")
  75         server.wait_until_succeeds("curl -sf https://${serverDomain} | grep Kanidm")
  76         server.succeed("ldapsearch -H ldap://[::1]:636 -b '${ldapBaseDN}' -x '(name=test)'")
  77         client.succeed("kanidm login -D anonymous && kanidm self whoami | grep anonymous@${serverDomain}")
  78         rv, result = server.execute("kanidmd recover_account -c ${serverConfigFile} idm_admin 2>&1 | rg -o '[A-Za-z0-9]{48}'")
  79         assert rv == 0
  80         client.wait_for_unit("kanidm-unixd.service")
  81         client.succeed("kanidm_unixd_status | grep working!")
  82       '';
  83   })