nixos/tests/taskserver.nix

   1 import ./make-test-python.nix ({ pkgs, ... }: let
   2   snakeOil = pkgs.runCommand "snakeoil-certs" {
   3     outputs = [ "out" "cacert" "cert" "key" "crl" ];
   4     buildInputs = [ pkgs.gnutls.bin ];
   5     caTemplate = pkgs.writeText "snakeoil-ca.template" ''
   6       cn = server
   7       expiration_days = -1
   8       cert_signing_key
   9       ca
  10     '';
  11     certTemplate = pkgs.writeText "snakeoil-cert.template" ''
  12       cn = server
  13       expiration_days = -1
  14       tls_www_server
  15       encryption_key
  16       signing_key
  17     '';
  18     crlTemplate = pkgs.writeText "snakeoil-crl.template" ''
  19       expiration_days = -1
  20     '';
  21     userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
  22       organization = snakeoil
  23       cn = server
  24       expiration_days = -1
  25       tls_www_client
  26       encryption_key
  27       signing_key
  28     '';
  29   } ''
  30     certtool -p --bits 4096 --outfile ca.key
  31     certtool -s --template "$caTemplate" --load-privkey ca.key \
  32                 --outfile "$cacert"
  33     certtool -p --bits 4096 --outfile "$key"
  34     certtool -c --template "$certTemplate" \
  35                 --load-ca-privkey ca.key \
  36                 --load-ca-certificate "$cacert" \
  37                 --load-privkey "$key" \
  38                 --outfile "$cert"
  39     certtool --generate-crl --template "$crlTemplate" \
  40                             --load-ca-privkey ca.key \
  41                             --load-ca-certificate "$cacert" \
  42                             --outfile "$crl"
  43
  44     mkdir "$out"
  45
  46     # Stripping key information before the actual PEM-encoded values is solely
  47     # to make test output a bit less verbose when copying the client key to the
  48     # actual client.
  49     certtool -p --bits 4096 | sed -n \
  50       -e '/^----* *BEGIN/,/^----* *END/p' > "$out/alice.key"
  51
  52     certtool -c --template "$userCertTemplate" \
  53                 --load-privkey "$out/alice.key" \
  54                 --load-ca-privkey ca.key \
  55                 --load-ca-certificate "$cacert" \
  56                 --outfile "$out/alice.cert"
  57   '';
  58
  59 in {
  60   name = "taskserver";
  61
  62   nodes = rec {
  63     server = {
  64       services.taskserver.enable = true;
  65       services.taskserver.listenHost = "::";
  66       services.taskserver.openFirewall = true;
  67       services.taskserver.fqdn = "server";
  68       services.taskserver.organisations = {
  69         testOrganisation.users = [ "alice" "foo" ];
  70         anotherOrganisation.users = [ "bob" ];
  71       };
  72     };
  73
  74     # New generation of the server with manual config
  75     newServer = { lib, nodes, ... }: {
  76       imports = [ server ];
  77       services.taskserver.pki.manual = {
  78         ca.cert = snakeOil.cacert;
  79         server.cert = snakeOil.cert;
  80         server.key = snakeOil.key;
  81         server.crl = snakeOil.crl;
  82       };
  83       # This is to avoid assigning a different network address to the new
  84       # generation.
  85       networking = lib.mapAttrs (lib.const lib.mkForce) {
  86         interfaces.eth1.ipv4 = nodes.server.config.networking.interfaces.eth1.ipv4;
  87         inherit (nodes.server.config.networking)
  88           hostName primaryIPAddress extraHosts;
  89       };
  90     };
  91
  92     client1 = { pkgs, ... }: {
  93       environment.systemPackages = [ pkgs.taskwarrior pkgs.gnutls ];
  94       users.users.alice.isNormalUser = true;
  95       users.users.bob.isNormalUser = true;
  96       users.users.foo.isNormalUser = true;
  97       users.users.bar.isNormalUser = true;
  98     };
  99
 100     client2 = client1;
 101   };
 102
 103   testScript = { nodes, ... }: let
 104     cfg = nodes.server.config.services.taskserver;
 105     portStr = toString cfg.listenPort;
 106     newServerSystem = nodes.newServer.config.system.build.toplevel;
 107     switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";
 108   in ''
 109     from shlex import quote
 110
 111
 112     def su(user, cmd):
 113         return f"su - {user} -c {quote(cmd)}"
 114
 115
 116     def no_extra_init(client, org, user):
 117         pass
 118
 119
 120     def setup_clients_for(org, user, extra_init=no_extra_init):
 121         for client in [client1, client2]:
 122             with client.nested(f"initialize client for user {user}"):
 123                 client.succeed(
 124                     su(user, f"rm -rf /home/{user}/.task"),
 125                     su(user, "task rc.confirmation=no config confirmation no"),
 126                 )
 127
 128                 exportinfo = server.succeed(f"nixos-taskserver user export {org} {user}")
 129
 130                 with client.nested("importing taskwarrior configuration"):
 131                     client.succeed(su(user, f"eval {quote(exportinfo)} >&2"))
 132
 133                 extra_init(client, org, user)
 134
 135                 client.succeed(su(user, "task config taskd.server server:${portStr} >&2"))
 136
 137                 client.succeed(su(user, "task sync init >&2"))
 138
 139
 140     def restart_server():
 141         server.systemctl("restart taskserver.service")
 142         server.wait_for_open_port(${portStr})
 143
 144
 145     def re_add_imperative_user():
 146         with server.nested("(re-)add imperative user bar"):
 147             server.execute("nixos-taskserver org remove imperativeOrg")
 148             server.succeed(
 149                 "nixos-taskserver org add imperativeOrg",
 150                 "nixos-taskserver user add imperativeOrg bar",
 151             )
 152             setup_clients_for("imperativeOrg", "bar")
 153
 154
 155     def test_sync(user):
 156         with subtest(f"sync for user {user}"):
 157             client1.succeed(su(user, "task add foo >&2"))
 158             client1.succeed(su(user, "task sync >&2"))
 159             client2.fail(su(user, "task list >&2"))
 160             client2.succeed(su(user, "task sync >&2"))
 161             client2.succeed(su(user, "task list >&2"))
 162
 163
 164     def check_client_cert(user):
 165         # debug level 3 is a workaround for gnutls issue https://gitlab.com/gnutls/gnutls/-/issues/1040
 166         cmd = (
 167             f"gnutls-cli -d 3"
 168             f" --x509cafile=/home/{user}/.task/keys/ca.cert"
 169             f" --x509keyfile=/home/{user}/.task/keys/private.key"
 170             f" --x509certfile=/home/{user}/.task/keys/public.cert"
 171             f" --port=${portStr} server < /dev/null"
 172         )
 173         return su(user, cmd)
 174
 175
 176     # Explicitly start the VMs so that we don't accidentally start newServer
 177     server.start()
 178     client1.start()
 179     client2.start()
 180
 181     server.wait_for_unit("taskserver.service")
 182
 183     server.succeed(
 184         "nixos-taskserver user list testOrganisation | grep -qxF alice",
 185         "nixos-taskserver user list testOrganisation | grep -qxF foo",
 186         "nixos-taskserver user list anotherOrganisation | grep -qxF bob",
 187     )
 188
 189     server.wait_for_open_port(${portStr})
 190
 191     client1.wait_for_unit("multi-user.target")
 192     client2.wait_for_unit("multi-user.target")
 193
 194     setup_clients_for("testOrganisation", "alice")
 195     setup_clients_for("testOrganisation", "foo")
 196     setup_clients_for("anotherOrganisation", "bob")
 197
 198     for user in ["alice", "bob", "foo"]:
 199         test_sync(user)
 200
 201     server.fail("nixos-taskserver user add imperativeOrg bar")
 202     re_add_imperative_user()
 203
 204     test_sync("bar")
 205
 206     with subtest("checking certificate revocation of user bar"):
 207         client1.succeed(check_client_cert("bar"))
 208
 209         server.succeed("nixos-taskserver user remove imperativeOrg bar")
 210         restart_server()
 211
 212         client1.fail(check_client_cert("bar"))
 213
 214         client1.succeed(su("bar", "task add destroy everything >&2"))
 215         client1.fail(su("bar", "task sync >&2"))
 216
 217     re_add_imperative_user()
 218
 219     with subtest("checking certificate revocation of org imperativeOrg"):
 220         client1.succeed(check_client_cert("bar"))
 221
 222         server.succeed("nixos-taskserver org remove imperativeOrg")
 223         restart_server()
 224
 225         client1.fail(check_client_cert("bar"))
 226
 227         client1.succeed(su("bar", "task add destroy even more >&2"))
 228         client1.fail(su("bar", "task sync >&2"))
 229
 230     re_add_imperative_user()
 231
 232     with subtest("check whether declarative config overrides user bar"):
 233         restart_server()
 234         test_sync("bar")
 235
 236
 237     def init_manual_config(client, org, user):
 238         cfgpath = f"/home/{user}/.task"
 239
 240         client.copy_from_host(
 241             "${snakeOil.cacert}",
 242             f"{cfgpath}/ca.cert",
 243         )
 244         for file in ["alice.key", "alice.cert"]:
 245             client.copy_from_host(
 246                 f"${snakeOil}/{file}",
 247                 f"{cfgpath}/{file}",
 248             )
 249
 250         for file in [f"{user}.key", f"{user}.cert"]:
 251             client.copy_from_host(
 252                 f"${snakeOil}/{file}",
 253                 f"{cfgpath}/{file}",
 254             )
 255
 256         client.succeed(
 257             su("alice", f"task config taskd.ca {cfgpath}/ca.cert"),
 258             su("alice", f"task config taskd.key {cfgpath}/{user}.key"),
 259             su(user, f"task config taskd.certificate {cfgpath}/{user}.cert"),
 260         )
 261
 262
 263     with subtest("check manual configuration"):
 264         # Remove the keys from automatic CA creation, to make sure the new
 265         # generation doesn't use keys from before.
 266         server.succeed("rm -rf ${cfg.dataDir}/keys/* >&2")
 267
 268         server.succeed(
 269             "${switchToNewServer} >&2"
 270         )
 271         server.wait_for_unit("taskserver.service")
 272         server.wait_for_open_port(${portStr})
 273
 274         server.succeed(
 275             "nixos-taskserver org add manualOrg",
 276             "nixos-taskserver user add manualOrg alice",
 277         )
 278
 279         setup_clients_for("manualOrg", "alice", init_manual_config)
 280
 281         test_sync("alice")
 282   '';
 283 })