nixos/tests/sourcehut.nix

   1 import ./make-test-python.nix ({ pkgs, lib, ... }:
   2 let
   3   domain = "sourcehut.localdomain";
   4
   5   # Note that wildcard certificates just under the TLD (eg. *.com)
   6   # would be rejected by clients like curl.
   7   tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
   8     openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 36500 \
   9       -subj '/CN=${domain}' -extensions v3_req \
  10       -addext 'subjectAltName = DNS:*.${domain}'
  11     install -D -t $out key.pem cert.pem
  12   '';
  13
  14   images = {
  15     nixos.unstable.x86_64 =
  16       let
  17         systemConfig = { pkgs, ... }: {
  18           # passwordless ssh server
  19           services.openssh = {
  20             enable = true;
  21             permitRootLogin = "yes";
  22             extraConfig = "PermitEmptyPasswords yes";
  23           };
  24
  25           users = {
  26             mutableUsers = false;
  27             # build user
  28             extraUsers."build" = {
  29               isNormalUser = true;
  30               uid = 1000;
  31               extraGroups = [ "wheel" ];
  32               password = "";
  33             };
  34             users.root.password = "";
  35           };
  36
  37           security.sudo.wheelNeedsPassword = false;
  38           nix.trustedUsers = [ "root" "build" ];
  39           documentation.nixos.enable = false;
  40
  41           # builds.sr.ht-image-specific network settings
  42           networking = {
  43             hostName = "build";
  44             dhcpcd.enable = false;
  45             defaultGateway.address = "10.0.2.2";
  46             usePredictableInterfaceNames = false;
  47             interfaces."eth0".ipv4.addresses = [{
  48               address = "10.0.2.15";
  49               prefixLength = 25;
  50             }];
  51             enableIPv6 = false;
  52             nameservers = [
  53               # OpenNIC anycast
  54               "185.121.177.177"
  55               "169.239.202.202"
  56               # Google
  57               "8.8.8.8"
  58             ];
  59             firewall.allowedTCPPorts = [ 22 ];
  60           };
  61
  62           environment.systemPackages = [
  63             pkgs.gitMinimal
  64             #pkgs.mercurial
  65             pkgs.curl
  66             pkgs.gnupg
  67           ];
  68         };
  69         qemuConfig = { pkgs, ... }: {
  70           imports = [ systemConfig ];
  71           fileSystems."/".device = "/dev/disk/by-label/nixos";
  72           boot.initrd.availableKernelModules = [
  73             "ahci"
  74             "ehci_pci"
  75             "sd_mod"
  76             "usb_storage"
  77             "usbhid"
  78             "virtio_balloon"
  79             "virtio_blk"
  80             "virtio_pci"
  81             "virtio_ring"
  82             "xhci_pci"
  83           ];
  84           boot.loader = {
  85             grub = {
  86               version = 2;
  87               device = "/dev/vda";
  88             };
  89             timeout = 0;
  90           };
  91         };
  92         config = (import (pkgs.path + "/nixos/lib/eval-config.nix") {
  93           inherit pkgs; modules = [ qemuConfig ];
  94           system = "x86_64-linux";
  95         }).config;
  96       in
  97       import (pkgs.path + "/nixos/lib/make-disk-image.nix") {
  98         inherit pkgs lib config;
  99         diskSize = 16000;
 100         format = "qcow2-compressed";
 101         contents = [
 102           { source = pkgs.writeText "gitconfig" ''
 103               [user]
 104                 name = builds.sr.ht
 105                 email = build@sr.ht
 106             '';
 107             target = "/home/build/.gitconfig";
 108             user = "build";
 109             group = "users";
 110             mode = "644";
 111           }
 112         ];
 113       };
 114   };
 115
 116 in
 117 {
 118   name = "sourcehut";
 119
 120   meta.maintainers = [ pkgs.lib.maintainers.tomberek ];
 121
 122   nodes.machine = { config, pkgs, nodes, ... }: {
 123     # buildsrht needs space
 124     virtualisation.diskSize = 4 * 1024;
 125     virtualisation.memorySize = 2 * 1024;
 126     networking.domain = domain;
 127     networking.extraHosts = ''
 128       ${config.networking.primaryIPAddress} builds.${domain}
 129       ${config.networking.primaryIPAddress} git.${domain}
 130       ${config.networking.primaryIPAddress} meta.${domain}
 131     '';
 132
 133     services.sourcehut = {
 134       enable = true;
 135       services = [
 136         "builds"
 137         "git"
 138         "meta"
 139       ];
 140       nginx.enable = true;
 141       nginx.virtualHost = {
 142         forceSSL = true;
 143         sslCertificate = "${tls-cert}/cert.pem";
 144         sslCertificateKey = "${tls-cert}/key.pem";
 145       };
 146       postgresql.enable = true;
 147       redis.enable = true;
 148
 149       meta.enable = true;
 150       builds = {
 151         enable = true;
 152         # FIXME: see why it does not seem to activate fully.
 153         #enableWorker = true;
 154         inherit images;
 155       };
 156       git.enable = true;
 157
 158       settings."sr.ht" = {
 159         global-domain = config.networking.domain;
 160         service-key = pkgs.writeText "service-key" "8b327279b77e32a3620e2fc9aabce491cc46e7d821fd6713b2a2e650ce114d01";
 161         network-key = pkgs.writeText "network-key" "cEEmc30BRBGkgQZcHFksiG7hjc6_dK1XR2Oo5Jb9_nQ=";
 162       };
 163       settings."builds.sr.ht" = {
 164         oauth-client-secret = pkgs.writeText "buildsrht-oauth-client-secret" "2260e9c4d9b8dcedcef642860e0504bc";
 165         oauth-client-id = "299db9f9c2013170";
 166       };
 167       settings."git.sr.ht" = {
 168         oauth-client-secret = pkgs.writeText "gitsrht-oauth-client-secret" "3597288dc2c716e567db5384f493b09d";
 169         oauth-client-id = "d07cb713d920702e";
 170       };
 171       settings.webhooks.private-key = pkgs.writeText "webhook-key" "Ra3IjxgFiwG9jxgp4WALQIZw/BMYt30xWiOsqD0J7EA=";
 172       settings.mail = {
 173         smtp-from = "root+hut@${domain}";
 174         # WARNING: take care to keep pgp-privkey outside the Nix store in production,
 175         # or use LoadCredentialEncrypted=
 176         pgp-privkey = toString (pkgs.writeText "sourcehut.pgp-privkey" ''
 177           -----BEGIN PGP PRIVATE KEY BLOCK-----
 178
 179           lFgEYqDRORYJKwYBBAHaRw8BAQdAehGoy36FUx2OesYm07be2rtLyvR5Pb/ltstd
 180           Gk7hYQoAAP9X4oPmxxrHN8LewBpWITdBomNqlHoiP7mI0nz/BOPJHxEktDZuaXhv
 181           cy90ZXN0cy9zb3VyY2VodXQgPHJvb3QraHV0QHNvdXJjZWh1dC5sb2NhbGRvbWFp
 182           bj6IlwQTFgoAPxYhBPqjgjnL8RHN4JnADNicgXaYm0jJBQJioNE5AhsDBQkDwmcA
 183           BgsJCAcDCgUVCgkICwUWAwIBAAIeBQIXgAAKCRDYnIF2mJtIySVCAP9e2nHsVHSi
 184           2B1YGZpVG7Xf36vxljmMkbroQy+0gBPwRwEAq+jaiQqlbGhQ7R/HMFcAxBIVsq8h
 185           Aw1rngsUd0o3dAicXQRioNE5EgorBgEEAZdVAQUBAQdAXZV2Sd5ZNBVTBbTGavMv
 186           D6ORrUh8z7TI/3CsxCE7+yADAQgHAAD/c1RU9xH+V/uI1fE7HIn/zL0LUPpsuce2
 187           cH++g4u3kBgTOYh+BBgWCgAmFiEE+qOCOcvxEc3gmcAM2JyBdpibSMkFAmKg0TkC
 188           GwwFCQPCZwAACgkQ2JyBdpibSMlKagD/cTre6p1m8QuJ7kwmCFRSz5tBzIuYMMgN
 189           xtT7dmS91csA/35fWsOykSiFRojQ7ccCSUTHL7ApF2EbL968tP/D2hIG
 190           =Hjoc
 191           -----END PGP PRIVATE KEY BLOCK-----
 192         '');
 193         pgp-pubkey = pkgs.writeText "sourcehut.pgp-pubkey" ''
 194           -----BEGIN PGP PUBLIC KEY BLOCK-----
 195
 196           mDMEYqDRORYJKwYBBAHaRw8BAQdAehGoy36FUx2OesYm07be2rtLyvR5Pb/ltstd
 197           Gk7hYQq0Nm5peG9zL3Rlc3RzL3NvdXJjZWh1dCA8cm9vdCtodXRAc291cmNlaHV0
 198           LmxvY2FsZG9tYWluPoiXBBMWCgA/FiEE+qOCOcvxEc3gmcAM2JyBdpibSMkFAmKg
 199           0TkCGwMFCQPCZwAGCwkIBwMKBRUKCQgLBRYDAgEAAh4FAheAAAoJENicgXaYm0jJ
 200           JUIA/17acexUdKLYHVgZmlUbtd/fq/GWOYyRuuhDL7SAE/BHAQCr6NqJCqVsaFDt
 201           H8cwVwDEEhWyryEDDWueCxR3Sjd0CLg4BGKg0TkSCisGAQQBl1UBBQEBB0BdlXZJ
 202           3lk0FVMFtMZq8y8Po5GtSHzPtMj/cKzEITv7IAMBCAeIfgQYFgoAJhYhBPqjgjnL
 203           8RHN4JnADNicgXaYm0jJBQJioNE5AhsMBQkDwmcAAAoJENicgXaYm0jJSmoA/3E6
 204           3uqdZvELie5MJghUUs+bQcyLmDDIDcbU+3ZkvdXLAP9+X1rDspEohUaI0O3HAklE
 205           xy+wKRdhGy/evLT/w9oSBg==
 206           =pJD7
 207           -----END PGP PUBLIC KEY BLOCK-----
 208         '';
 209         pgp-key-id = "0xFAA38239CBF111CDE099C00CD89C8176989B48C9";
 210       };
 211     };
 212
 213     networking.firewall.allowedTCPPorts = [ 443 ];
 214     security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
 215     services.nginx = {
 216       enable = true;
 217       recommendedGzipSettings = true;
 218       recommendedOptimisation = true;
 219       recommendedTlsSettings = true;
 220       recommendedProxySettings = true;
 221     };
 222
 223     services.postgresql = {
 224       enable = true;
 225       enableTCPIP = false;
 226       settings.unix_socket_permissions = "0770";
 227     };
 228   };
 229
 230   testScript = ''
 231     start_all()
 232     machine.wait_for_unit("multi-user.target")
 233
 234     # Testing metasrht
 235     machine.wait_for_unit("metasrht-api.service")
 236     machine.wait_for_unit("metasrht.service")
 237     machine.wait_for_unit("metasrht-webhooks.service")
 238     machine.wait_for_open_port(5000)
 239     machine.succeed("curl -sL http://localhost:5000 | grep meta.${domain}")
 240     machine.succeed("curl -sL http://meta.${domain} | grep meta.${domain}")
 241
 242     # Testing buildsrht
 243     machine.wait_for_unit("buildsrht.service")
 244     machine.wait_for_open_port(5002)
 245     machine.succeed("curl -sL http://localhost:5002 | grep builds.${domain}")
 246     #machine.wait_for_unit("buildsrht-worker.service")
 247
 248     # Testing gitsrht
 249     machine.wait_for_unit("gitsrht-api.service")
 250     machine.wait_for_unit("gitsrht.service")
 251     machine.wait_for_unit("gitsrht-webhooks.service")
 252     machine.succeed("curl -sL http://git.${domain} | grep git.${domain}")
 253   '';
 254 })