nixpkgs/nixos/tests/systemd-timesyncd-nscd-dnssec.nix

# This test verifies that systemd-timesyncd can resolve the NTP server hostname when DNSSEC validation
# fails even though it is enforced in the systemd-resolved settings. It is required in order to solve
# the chicken-and-egg problem when DNSSEC validation needs the correct time to work, but to set the
# correct time, we need to connect to an NTP server, which usually requires resolving its hostname.
#
# This test does the following:
# - Sets up a DNS server (tinydns) listening on the eth1 ip addess, serving .ntp and fake.ntp records.
# - Configures that DNS server as a resolver and enables DNSSEC in systemd-resolved settings.
# - Configures systemd-timesyncd to use fake.ntp hostname as an NTP server.
# - Performs a regular DNS lookup, to ensure it fails due to broken DNSSEC.
# - Waits until systemd-timesyncd resolves fake.ntp by checking its debug output.
#   Here, we don't expect systemd-timesyncd to connect and synchronize time because there is no NTP
#   server running. For this test to succeed, we only need to ensure that systemd-timesyncd
#   resolves the IP address of the fake.ntp host.

import ./make-test-python.nix ({ pkgs, ... }:

let
  ntpHostname = "fake.ntp";
  ntpIP = "192.0.2.1";
in
{
  name = "systemd-timesyncd";
  nodes.machine = { pkgs, lib, config, ... }:
    let
      eth1IP = (lib.head config.networking.interfaces.eth1.ipv4.addresses).address;
    in
    {
      # Setup a local DNS server for the NTP domain on the eth1 IP address
      services.tinydns = {
        enable = true;
        ip = eth1IP;
        data = ''
          .ntp:${eth1IP}
          +.${ntpHostname}:${ntpIP}
        '';
      };

      # Enable systemd-resolved with DNSSEC and use the local DNS as a name server
      services.resolved.enable = true;
      services.resolved.dnssec = "true";
      networking.nameservers = [ eth1IP ];

      # Configure systemd-timesyncd to use our NTP hostname
      services.timesyncd.enable = lib.mkForce true;
      services.timesyncd.servers = [ ntpHostname ];
      services.timesyncd.extraConfig = ''
        FallbackNTP=${ntpHostname}
      '';

      # The debug output is necessary to determine whether systemd-timesyncd successfully resolves our NTP hostname or not
      systemd.services.systemd-timesyncd.environment.SYSTEMD_LOG_LEVEL = "debug";
    };

  testScript = ''
    machine.wait_for_unit("tinydns.service")
    machine.wait_for_unit("systemd-timesyncd.service")
    machine.fail("resolvectl query ${ntpHostname}")
    machine.wait_until_succeeds("journalctl -u systemd-timesyncd.service --grep='Resolved address ${ntpIP}:123 for ${ntpHostname}'")
  '';
})