nixos/tests/podman/tls-ghostunnel.nix

   1 /*
   2   This test runs podman as a backend for the Docker CLI.
   3  */
   4 import ../make-test-python.nix (
   5   { pkgs, lib, ... }:
   6
   7   let gen-ca = pkgs.writeScript "gen-ca" ''
   8     # Create CA
   9     PATH="${pkgs.openssl}/bin:$PATH"
  10     openssl genrsa -out ca-key.pem 4096
  11     openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -subj '/C=NL/ST=Zuid-Holland/L=The Hague/O=Stevige Balken en Planken B.V./OU=OpSec/CN=Certificate Authority' -out ca.pem
  12
  13     # Create service
  14     openssl genrsa -out podman-key.pem 4096
  15     openssl req -subj '/CN=podman' -sha256 -new -key podman-key.pem -out service.csr
  16     echo subjectAltName = DNS:podman,IP:127.0.0.1 >> extfile.cnf
  17     echo extendedKeyUsage = serverAuth >> extfile.cnf
  18     openssl x509 -req -days 365 -sha256 -in service.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out podman-cert.pem -extfile extfile.cnf
  19
  20     # Create client
  21     openssl genrsa -out client-key.pem 4096
  22     openssl req -subj '/CN=client' -new -key client-key.pem -out client.csr
  23     echo extendedKeyUsage = clientAuth > extfile-client.cnf
  24     openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out client-cert.pem -extfile extfile-client.cnf
  25
  26     # Create CA 2
  27     PATH="${pkgs.openssl}/bin:$PATH"
  28     openssl genrsa -out ca-2-key.pem 4096
  29     openssl req -new -x509 -days 365 -key ca-2-key.pem -sha256 -subj '/C=NL/ST=Zuid-Holland/L=The Hague/O=Stevige Balken en Planken B.V./OU=OpSec/CN=Certificate Authority' -out ca-2.pem
  30
  31     # Create client signed by CA 2
  32     openssl genrsa -out client-2-key.pem 4096
  33     openssl req -subj '/CN=client' -new -key client-2-key.pem -out client-2.csr
  34     echo extendedKeyUsage = clientAuth > extfile-client.cnf
  35     openssl x509 -req -days 365 -sha256 -in client-2.csr -CA ca-2.pem -CAkey ca-2-key.pem -CAcreateserial -out client-2-cert.pem -extfile extfile-client.cnf
  36
  37     '';
  38   in
  39   {
  40     name = "podman-tls-ghostunnel";
  41     meta = {
  42       maintainers = lib.teams.podman.members ++ [ lib.maintainers.roberth ];
  43     };
  44
  45     nodes = {
  46       podman =
  47         { pkgs, ... }:
  48         {
  49           virtualisation.podman.enable = true;
  50           virtualisation.podman.dockerSocket.enable = true;
  51           virtualisation.podman.networkSocket = {
  52             enable = true;
  53             openFirewall = true;
  54             server = "ghostunnel";
  55             tls.cert = "/root/podman-cert.pem";
  56             tls.key = "/root/podman-key.pem";
  57             tls.cacert = "/root/ca.pem";
  58           };
  59
  60           environment.systemPackages = [
  61             pkgs.docker-client
  62           ];
  63
  64           users.users.alice = {
  65             isNormalUser = true;
  66             home = "/home/alice";
  67             description = "Alice Foobar";
  68             extraGroups = ["podman"];
  69           };
  70
  71         };
  72
  73       client = { ... }: {
  74         environment.systemPackages = [
  75           # Installs the docker _client_ only
  76           # Normally, you'd want `virtualisation.docker.enable = true;`.
  77           pkgs.docker-client
  78         ];
  79         environment.variables.DOCKER_HOST = "podman:2376";
  80         environment.variables.DOCKER_TLS_VERIFY = "1";
  81       };
  82     };
  83
  84     testScript = ''
  85       import shlex
  86
  87
  88       def su_cmd(user, cmd):
  89           cmd = shlex.quote(cmd)
  90           return f"su {user} -l -c {cmd}"
  91
  92       def cmd(command):
  93         print(f"+{command}")
  94         r = os.system(command)
  95         if r != 0:
  96           raise Exception(f"Command {command} failed with exit code {r}")
  97
  98       start_all()
  99       cmd("${gen-ca}")
 100
 101       podman.copy_from_host("ca.pem", "/root/ca.pem")
 102       podman.copy_from_host("podman-cert.pem", "/root/podman-cert.pem")
 103       podman.copy_from_host("podman-key.pem", "/root/podman-key.pem")
 104
 105       client.copy_from_host("ca.pem", "/root/.docker/ca.pem")
 106       # client.copy_from_host("podman-cert.pem", "/root/podman-cert.pem")
 107       client.copy_from_host("client-cert.pem", "/root/.docker/cert.pem")
 108       client.copy_from_host("client-key.pem", "/root/.docker/key.pem")
 109
 110       # TODO (ghostunnel): add file watchers so the restart isn't necessary
 111       podman.succeed("systemctl reset-failed && systemctl restart ghostunnel-server-podman-socket.service")
 112
 113       podman.wait_for_unit("sockets.target")
 114       podman.wait_for_unit("ghostunnel-server-podman-socket.service")
 115
 116       with subtest("Create default network"):
 117           podman.succeed("docker network create default")
 118
 119       with subtest("Root docker cli also works"):
 120           podman.succeed("docker version")
 121
 122       with subtest("A podman member can also still use the docker cli"):
 123           podman.succeed(su_cmd("alice", "docker version"))
 124
 125       with subtest("Run container remotely via docker cli"):
 126           client.succeed("docker version")
 127
 128           # via socket would be nicer
 129           podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
 130
 131           client.succeed(
 132             "docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin localhost/scratchimg /bin/sleep 10"
 133           )
 134           client.succeed("docker ps | grep sleeping")
 135           podman.succeed("docker ps | grep sleeping")
 136           client.succeed("docker stop sleeping")
 137           client.succeed("docker rm sleeping")
 138
 139       with subtest("Clients without cert will be denied"):
 140           client.succeed("rm /root/.docker/{cert,key}.pem")
 141           client.fail("docker version")
 142
 143       with subtest("Clients with wrong cert will be denied"):
 144           client.copy_from_host("client-2-cert.pem", "/root/.docker/cert.pem")
 145           client.copy_from_host("client-2-key.pem", "/root/.docker/key.pem")
 146           client.fail("docker version")
 147
 148     '';
 149   }
 150 )