nixos/tests/nixos-rebuild-target-host.nix

   1 import ./make-test-python.nix ({ pkgs, ... }: {
   2   name = "nixos-rebuild-target-host";
   3
   4   nodes = {
   5     deployer = { lib, ... }: let
   6       inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
   7     in {
   8       imports = [ ../modules/profiles/installation-device.nix ];
   9
  10       nix.settings = {
  11         substituters = lib.mkForce [ ];
  12         hashed-mirrors = null;
  13         connect-timeout = 1;
  14       };
  15
  16       environment.systemPackages = [ pkgs.passh ];
  17
  18       system.includeBuildDependencies = true;
  19
  20       virtualisation = {
  21         cores = 2;
  22         memorySize = 2048;
  23       };
  24
  25       system.build.privateKey = snakeOilPrivateKey;
  26       system.build.publicKey = snakeOilPublicKey;
  27     };
  28
  29     target = { nodes, lib, ... }: let
  30       targetConfig = {
  31         documentation.enable = false;
  32         services.openssh.enable = true;
  33
  34         users.users.root.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
  35         users.users.alice.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
  36         users.users.bob.openssh.authorizedKeys.keys = [ nodes.deployer.system.build.publicKey ];
  37
  38         users.users.alice.extraGroups = [ "wheel" ];
  39         users.users.bob.extraGroups = [ "wheel" ];
  40
  41         # Disable sudo for root to ensure sudo isn't called without `--use-remote-sudo`
  42         security.sudo.extraRules = lib.mkForce [
  43           { groups = [ "wheel" ]; commands = [ { command = "ALL"; } ]; }
  44           { users = [ "alice" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
  45         ];
  46
  47         nix.settings.trusted-users = [ "@wheel" ];
  48       };
  49     in {
  50       imports = [ ./common/user-account.nix ];
  51
  52       config = lib.mkMerge [
  53         targetConfig
  54         {
  55           system.build = {
  56             inherit targetConfig;
  57           };
  58
  59           networking.hostName = "target";
  60         }
  61       ];
  62     };
  63   };
  64
  65   testScript = { nodes, ... }:
  66     let
  67       sshConfig = builtins.toFile "ssh.conf" ''
  68         UserKnownHostsFile=/dev/null
  69         StrictHostKeyChecking=no
  70       '';
  71
  72       targetConfigJSON = pkgs.writeText "target-configuration.json"
  73         (builtins.toJSON nodes.target.system.build.targetConfig);
  74
  75       targetNetworkJSON = pkgs.writeText "target-network.json"
  76         (builtins.toJSON nodes.target.system.build.networkConfig);
  77
  78       configFile = hostname: pkgs.writeText "configuration.nix" ''
  79         { lib, modulesPath, ... }: {
  80           imports = [
  81             (modulesPath + "/virtualisation/qemu-vm.nix")
  82             (modulesPath + "/testing/test-instrumentation.nix")
  83             (modulesPath + "/../tests/common/user-account.nix")
  84             (lib.modules.importJSON ./target-configuration.json)
  85             (lib.modules.importJSON ./target-network.json)
  86             ./hardware-configuration.nix
  87           ];
  88
  89           boot.loader.grub = {
  90             enable = true;
  91             device = "/dev/vda";
  92             forceInstall = true;
  93           };
  94
  95           # this will be asserted
  96           networking.hostName = "${hostname}";
  97         }
  98       '';
  99     in
 100     ''
 101       start_all()
 102       target.wait_for_open_port(22)
 103
 104       deployer.wait_until_succeeds("ping -c1 target")
 105       deployer.succeed("install -Dm 600 ${nodes.deployer.system.build.privateKey} ~root/.ssh/id_ecdsa")
 106       deployer.succeed("install ${sshConfig} ~root/.ssh/config")
 107
 108       target.succeed("nixos-generate-config")
 109       deployer.succeed("scp alice@target:/etc/nixos/hardware-configuration.nix /root/hardware-configuration.nix")
 110
 111       deployer.copy_from_host("${configFile "config-1-deployed"}", "/root/configuration-1.nix")
 112       deployer.copy_from_host("${configFile "config-2-deployed"}", "/root/configuration-2.nix")
 113       deployer.copy_from_host("${configFile "config-3-deployed"}", "/root/configuration-3.nix")
 114       deployer.copy_from_host("${targetNetworkJSON}", "/root/target-network.json")
 115       deployer.copy_from_host("${targetConfigJSON}", "/root/target-configuration.json")
 116
 117       # Ensure sudo is disabled for root
 118       target.fail("sudo true")
 119
 120       # This test also ensures that sudo is not called without --use-remote-sudo
 121       with subtest("Deploy to root@target"):
 122         deployer.succeed("nixos-rebuild switch -I nixos-config=/root/configuration-1.nix --target-host root@target &>/dev/console")
 123         target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
 124         assert target_hostname == "config-1-deployed", f"{target_hostname=}"
 125
 126       with subtest("Deploy to alice@target with passwordless sudo"):
 127         deployer.succeed("nixos-rebuild switch -I nixos-config=/root/configuration-2.nix --target-host alice@target --use-remote-sudo &>/dev/console")
 128         target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
 129         assert target_hostname == "config-2-deployed", f"{target_hostname=}"
 130
 131       with subtest("Deploy to bob@target with password based sudo"):
 132         deployer.succeed("passh -c 3 -C -p ${nodes.target.users.users.bob.password} -P \"\[sudo\] password\" nixos-rebuild switch -I nixos-config=/root/configuration-3.nix --target-host bob@target --use-remote-sudo &>/dev/console")
 133         target_hostname = deployer.succeed("ssh alice@target cat /etc/hostname").rstrip()
 134         assert target_hostname == "config-3-deployed", f"{target_hostname=}"
 135
 136       with subtest("Deploy works with very long TMPDIR"):
 137         tmp_dir = "/var/folder/veryveryveryveryverylongpathnamethatdoesnotworkwithcontrolpath"
 138         deployer.succeed(f"mkdir -p {tmp_dir}")
 139         deployer.succeed(f"TMPDIR={tmp_dir} nixos-rebuild switch -I nixos-config=/root/configuration-1.nix --target-host root@target &>/dev/console")
 140     '';
 141 })