From e2cebf2134ff2128b312bf018d450b1ba9b1f30b Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 15 Feb 2021 18:44:38 +0300 Subject: [PATCH 1/4] nixos/mastodon: fix init db on remote postgresql --- nixos/modules/services/web-apps/mastodon.nix | 22 ++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix index a6cd7432db24..fcfaf3bb57c1 100644 --- a/nixos/modules/services/web-apps/mastodon.nix +++ b/nixos/modules/services/web-apps/mastodon.nix @@ -530,7 +530,16 @@ in { }; systemd.services.mastodon-init-db = lib.mkIf cfg.automaticMigrations { - script = '' + script = lib.optionalString (!databaseActuallyCreateLocally) '' + umask 077 + + export PGPASSFILE + PGPASSFILE=$(mktemp) + cat > $PGPASSFILE < Date: Tue, 22 Mar 2022 22:21:47 +0300 Subject: [PATCH 2/4] nixos/mastodon: update database configuration --- .../from_md/release-notes/rl-2305.section.xml | 17 +++++++ .../manual/release-notes/rl-2305.section.md | 4 ++ nixos/modules/services/web-apps/mastodon.nix | 50 ++++++++++++------- 3 files changed, 54 insertions(+), 17 deletions(-) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml index b73aa325bbf7..27c09f6629e7 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml @@ -144,6 +144,17 @@ updated manually. + + + In mastodon it is now necessary to specify + location of file with PostgreSQL database + password. In + services.mastodon.database.passwordFile + parameter default value + /var/lib/mastodon/secrets/db-password has + been changed to null. + + The nix.readOnlyStore option has been @@ -208,6 +219,12 @@ nixos/modules/profiles/minimal.nix profile. + + + mastodon now supports connection to a + remote PostgreSQL database. + + A new virtualisation.rosetta module was diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index 84216758bad5..c9dfd0582c28 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -43,6 +43,8 @@ In addition to numerous new and upgraded packages, this release has the followin - Qt 5.12 and 5.14 have been removed, as the corresponding branches have been EOL upstream for a long time. This affected under 10 packages in nixpkgs, largely unmaintained upstream as well, however, out-of-tree package expressions may need to be updated manually. +- In `mastodon` it is now necessary to specify location of file with `PostgreSQL` database password. In `services.mastodon.database.passwordFile` parameter default value `/var/lib/mastodon/secrets/db-password` has been changed to `null`. + - The `nix.readOnlyStore` option has been renamed to `boot.readOnlyNixStore` to clarify that it configures the NixOS boot process, not the Nix daemon. ## Other Notable Changes {#sec-release-23.05-notable-changes} @@ -64,6 +66,8 @@ In addition to numerous new and upgraded packages, this release has the followin - The minimal ISO image now uses the `nixos/modules/profiles/minimal.nix` profile. +- `mastodon` now supports connection to a remote `PostgreSQL` database. + - A new `virtualisation.rosetta` module was added to allow running `x86_64` binaries through [Rosetta](https://developer.apple.com/documentation/apple-silicon/about-the-rosetta-translation-environment) inside virtualised NixOS guests on Apple silicon. This feature works by default with the [UTM](https://docs.getutm.app/) virtualisation [package](https://search.nixos.org/packages?channel=unstable&show=utm&from=0&size=1&sort=relevance&type=packages&query=utm). - Resilio sync secret keys can now be provided using a secrets file at runtime, preventing these secrets from ending up in the Nix store. diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix index fcfaf3bb57c1..b6e2309555f2 100644 --- a/nixos/modules/services/web-apps/mastodon.nix +++ b/nixos/modules/services/web-apps/mastodon.nix @@ -1,7 +1,9 @@ -{ config, lib, pkgs, ... }: +{ lib, pkgs, config, options, ... }: let cfg = config.services.mastodon; + opt = options.services.mastodon; + # We only want to create a database if we're actually going to connect to it. databaseActuallyCreateLocally = cfg.database.createLocally && cfg.database.host == "/run/postgresql"; @@ -23,7 +25,6 @@ let REDIS_HOST = cfg.redis.host; REDIS_PORT = toString(cfg.redis.port); DB_HOST = cfg.database.host; - DB_PORT = toString(cfg.database.port); DB_NAME = cfg.database.name; LOCAL_DOMAIN = cfg.localDomain; SMTP_SERVER = cfg.smtp.host; @@ -37,7 +38,8 @@ let TRUSTED_PROXY_IP = cfg.trustedProxy; } - // (if cfg.smtp.authenticate then { SMTP_LOGIN = cfg.smtp.user; } else {}) + // lib.optionalAttrs (cfg.database.host != "/run/postgresql" && cfg.database.port != null) { DB_PORT = toString cfg.database.port; } + // lib.optionalAttrs cfg.smtp.authenticate { SMTP_LOGIN = cfg.smtp.user; } // cfg.extraConfig; systemCallsList = [ "@cpu-emulation" "@debug" "@keyring" "@ipc" "@mount" "@obsolete" "@privileged" "@setuid" ]; @@ -314,8 +316,13 @@ in { }; port = lib.mkOption { - type = lib.types.port; - default = 5432; + type = lib.types.nullOr lib.types.port; + default = if cfg.database.createLocally then null else 5432; + defaultText = lib.literalExpression '' + if config.${opt.database.createLocally} + then null + else 5432 + ''; description = lib.mdDoc "Database host port."; }; @@ -333,8 +340,8 @@ in { passwordFile = lib.mkOption { type = lib.types.nullOr lib.types.path; - default = "/var/lib/mastodon/secrets/db-password"; - example = "/run/keys/mastodon-db-password"; + default = null; + example = "/var/lib/mastodon/secrets/db-password"; description = lib.mdDoc '' A file containing the password corresponding to {option}`database.user`. @@ -468,7 +475,18 @@ in { assertions = [ { assertion = databaseActuallyCreateLocally -> (cfg.user == cfg.database.user); - message = ''For local automatic database provisioning (services.mastodon.database.createLocally == true) with peer authentication (services.mastodon.database.host == "/run/postgresql") to work services.mastodon.user and services.mastodon.database.user must be identical.''; + message = '' + For local automatic database provisioning (services.mastodon.database.createLocally == true) with peer + authentication (services.mastodon.database.host == "/run/postgresql") to work services.mastodon.user + and services.mastodon.database.user must be identical. + ''; + } + { + assertion = !databaseActuallyCreateLocally -> (cfg.database.host != "/run/postgresql"); + message = '' + needs to be set if + is not enabled. + ''; } { assertion = cfg.smtp.authenticate -> (cfg.smtp.user != null); @@ -512,10 +530,11 @@ in { OTP_SECRET="$(cat ${cfg.otpSecretFile})" VAPID_PRIVATE_KEY="$(cat ${cfg.vapidPrivateKeyFile})" VAPID_PUBLIC_KEY="$(cat ${cfg.vapidPublicKeyFile})" + '' + lib.optionalString (cfg.database.passwordFile != null) '' DB_PASS="$(cat ${cfg.database.passwordFile})" - '' + (if cfg.smtp.authenticate then '' + '' + lib.optionalString cfg.smtp.authenticate '' SMTP_PASSWORD="$(cat ${cfg.smtp.passwordFile})" - '' else "") + '' + '' + '' EOF ''; environment = env; @@ -555,13 +574,10 @@ in { unset PGPASSFILE ''; path = [ cfg.package pkgs.postgresql ]; - environment = env // (if (!databaseActuallyCreateLocally) - then { - PGHOST = cfg.database.host; - PGUSER = cfg.database.user; - } - else {} - ); + environment = env // lib.optionalAttrs (!databaseActuallyCreateLocally) { + PGHOST = cfg.database.host; + PGUSER = cfg.database.user; + }; serviceConfig = { Type = "oneshot"; EnvironmentFile = [ "/var/lib/mastodon/.secrets_env" ]; From 883a56c0cc44a25407bbacab66027e8f4ab54fcc Mon Sep 17 00:00:00 2001 From: Izorkin Date: Tue, 22 Mar 2022 10:52:13 +0300 Subject: [PATCH 3/4] nixos/tests/mastodon: add test with external services --- nixos/tests/all-tests.nix | 2 +- nixos/tests/web-apps/mastodon/default.nix | 9 + .../web-apps/mastodon/remote-postgresql.nix | 197 ++++++++++++++++++ .../{mastodon.nix => mastodon/standard.nix} | 4 +- 4 files changed, 209 insertions(+), 3 deletions(-) create mode 100644 nixos/tests/web-apps/mastodon/default.nix create mode 100644 nixos/tests/web-apps/mastodon/remote-postgresql.nix rename nixos/tests/web-apps/{mastodon.nix => mastodon/standard.nix} (98%) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index b372ae20480b..65ae8b659061 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -365,7 +365,7 @@ in { mailhog = handleTest ./mailhog.nix {}; man = handleTest ./man.nix {}; mariadb-galera = handleTest ./mysql/mariadb-galera.nix {}; - mastodon = handleTestOn ["x86_64-linux" "i686-linux" "aarch64-linux"] ./web-apps/mastodon.nix {}; + mastodon = discoverTests (import ./web-apps/mastodon { inherit handleTestOn; }); matomo = handleTest ./matomo.nix {}; matrix-appservice-irc = handleTest ./matrix/appservice-irc.nix {}; matrix-conduit = handleTest ./matrix/conduit.nix {}; diff --git a/nixos/tests/web-apps/mastodon/default.nix b/nixos/tests/web-apps/mastodon/default.nix new file mode 100644 index 000000000000..411ebfcd731b --- /dev/null +++ b/nixos/tests/web-apps/mastodon/default.nix @@ -0,0 +1,9 @@ +{ system ? builtins.currentSystem, handleTestOn }: +let + supportedSystems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ]; + +in +{ + standard = handleTestOn supportedSystems ./standard.nix { inherit system; }; + remote-postgresql = handleTestOn supportedSystems ./remote-postgresql.nix { inherit system; }; +} diff --git a/nixos/tests/web-apps/mastodon/remote-postgresql.nix b/nixos/tests/web-apps/mastodon/remote-postgresql.nix new file mode 100644 index 000000000000..551b456ad435 --- /dev/null +++ b/nixos/tests/web-apps/mastodon/remote-postgresql.nix @@ -0,0 +1,197 @@ +import ../../make-test-python.nix ({pkgs, ...}: +let + cert = pkgs: pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } '' + openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=mastodon.local' -days 36500 + mkdir -p $out + cp key.pem cert.pem $out + ''; + + hosts = '' + 192.168.2.103 mastodon.local + ''; + +in +{ + name = "mastodon-remote-postgresql"; + meta.maintainers = with pkgs.lib.maintainers; [ erictapen izorkin turion ]; + + nodes = { + database = { + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.102"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + firewall.allowedTCPPorts = [ 5432 ]; + }; + + services.postgresql = { + enable = true; + enableTCPIP = true; + authentication = '' + hostnossl mastodon_local mastodon_test 192.168.2.201/32 md5 + ''; + initialScript = pkgs.writeText "postgresql_init.sql" '' + CREATE ROLE mastodon_test LOGIN PASSWORD 'SoDTZcISc3f1M1LJsRLT'; + CREATE DATABASE mastodon_local TEMPLATE template0 ENCODING UTF8; + GRANT ALL PRIVILEGES ON DATABASE mastodon_local TO mastodon_test; + ''; + }; + }; + + nginx = { + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.103"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + firewall.allowedTCPPorts = [ 80 443 ]; + }; + + security = { + pki.certificateFiles = [ "${cert pkgs}/cert.pem" ]; + }; + + services.nginx = { + enable = true; + recommendedProxySettings = true; + virtualHosts."mastodon.local" = { + root = "/var/empty"; + forceSSL = true; + enableACME = pkgs.lib.mkForce false; + sslCertificate = "${cert pkgs}/cert.pem"; + sslCertificateKey = "${cert pkgs}/key.pem"; + locations."/" = { + tryFiles = "$uri @proxy"; + }; + locations."@proxy" = { + proxyPass = "http://192.168.2.201:55001"; + proxyWebsockets = true; + }; + locations."/api/v1/streaming/" = { + proxyPass = "http://192.168.2.201:55002"; + proxyWebsockets = true; + }; + }; + }; + }; + + server = { pkgs, ... }: { + virtualisation.memorySize = 2048; + + environment = { + etc = { + "mastodon/password-posgressql-db".text = '' + SoDTZcISc3f1M1LJsRLT + ''; + }; + }; + + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.201"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + firewall.allowedTCPPorts = [ 55001 55002 ]; + }; + + services.mastodon = { + enable = true; + configureNginx = false; + localDomain = "mastodon.local"; + enableUnixSocket = false; + database = { + createLocally = false; + host = "192.168.2.102"; + port = 5432; + name = "mastodon_local"; + user = "mastodon_test"; + passwordFile = "/etc/mastodon/password-posgressql-db"; + }; + smtp = { + createLocally = false; + fromAddress = "mastodon@mastodon.local"; + }; + extraConfig = { + BIND = "0.0.0.0"; + EMAIL_DOMAIN_ALLOWLIST = "example.com"; + RAILS_SERVE_STATIC_FILES = "true"; + TRUSTED_PROXY_IP = "192.168.2.103"; + }; + }; + }; + + client = { pkgs, ... }: { + environment.systemPackages = [ pkgs.jq ]; + networking = { + interfaces.eth1 = { + ipv4.addresses = [ + { address = "192.168.2.202"; prefixLength = 24; } + ]; + }; + extraHosts = hosts; + }; + + security = { + pki.certificateFiles = [ "${cert pkgs}/cert.pem" ]; + }; + }; + }; + + testScript = '' + start_all() + + database.wait_for_unit("postgresql.service") + database.wait_for_open_port(5432) + + server.wait_for_unit("redis-mastodon.service") + server.wait_for_unit("mastodon-sidekiq.service") + server.wait_for_unit("mastodon-streaming.service") + server.wait_for_unit("mastodon-web.service") + server.wait_for_open_port(55000) + server.wait_for_open_port(55001) + + # Check that mastodon-media-auto-remove is scheduled + server.succeed("systemctl status mastodon-media-auto-remove.timer") + + # Check Mastodon version from remote client + client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'") + + # Check access from remote client + client.succeed("curl --fail https://mastodon.local/about | grep 'Mastodon hosted on mastodon.local'") + client.succeed("curl --fail $(curl https://mastodon.local/api/v1/instance 2> /dev/null | jq -r .thumbnail) --output /dev/null") + + # Simple check tootctl commands + # Check Mastodon version + server.succeed("mastodon-tootctl version | grep '${pkgs.mastodon.version}") + + # Manage accounts + server.succeed("mastodon-tootctl email_domain_blocks add example.com") + server.succeed("mastodon-tootctl email_domain_blocks list | grep example.com") + server.fail("mastodon-tootctl email_domain_blocks list | grep mastodon.local") + server.fail("mastodon-tootctl accounts create alice --email=alice@example.com") + server.succeed("mastodon-tootctl email_domain_blocks remove example.com") + server.succeed("mastodon-tootctl accounts create bob --email=bob@example.com") + server.succeed("mastodon-tootctl accounts approve bob") + server.succeed("mastodon-tootctl accounts delete bob") + + # Manage IP access + server.succeed("mastodon-tootctl ip_blocks add 192.168.0.0/16 --severity=no_access") + server.succeed("mastodon-tootctl ip_blocks export | grep 192.168.0.0/16") + server.fail("mastodon-tootctl ip_blocks export | grep 172.16.0.0/16") + client.fail("curl --fail https://mastodon.local/about") + server.succeed("mastodon-tootctl ip_blocks remove 192.168.0.0/16") + client.succeed("curl --fail https://mastodon.local/about") + + server.shutdown() + client.shutdown() + database.shutdown() + nginx.shutdown() + ''; +}) diff --git a/nixos/tests/web-apps/mastodon.nix b/nixos/tests/web-apps/mastodon/standard.nix similarity index 98% rename from nixos/tests/web-apps/mastodon.nix rename to nixos/tests/web-apps/mastodon/standard.nix index f10cb8cdc677..50ed5e5dc6dd 100644 --- a/nixos/tests/web-apps/mastodon.nix +++ b/nixos/tests/web-apps/mastodon/standard.nix @@ -1,4 +1,4 @@ -import ../make-test-python.nix ({pkgs, ...}: +import ../../make-test-python.nix ({pkgs, ...}: let cert = pkgs: pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } '' openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=mastodon.local' -days 36500 @@ -12,7 +12,7 @@ let in { - name = "mastodon"; + name = "mastodon-standard"; meta.maintainers = with pkgs.lib.maintainers; [ erictapen izorkin turion ]; nodes = { From 3479b871826978c4c7ac1bf87a890aa9ddad8fc0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20B=C3=A4renz?= Date: Fri, 25 Nov 2022 14:55:08 +0100 Subject: [PATCH 4/4] nixosTests.mastodon: Put script in separate file --- .../web-apps/mastodon/remote-postgresql.nix | 63 ++++--------------- nixos/tests/web-apps/mastodon/script.nix | 54 ++++++++++++++++ nixos/tests/web-apps/mastodon/standard.nix | 56 +++-------------- 3 files changed, 76 insertions(+), 97 deletions(-) create mode 100644 nixos/tests/web-apps/mastodon/script.nix diff --git a/nixos/tests/web-apps/mastodon/remote-postgresql.nix b/nixos/tests/web-apps/mastodon/remote-postgresql.nix index 551b456ad435..2fd3983e13ec 100644 --- a/nixos/tests/web-apps/mastodon/remote-postgresql.nix +++ b/nixos/tests/web-apps/mastodon/remote-postgresql.nix @@ -144,54 +144,17 @@ in }; }; - testScript = '' - start_all() - - database.wait_for_unit("postgresql.service") - database.wait_for_open_port(5432) - - server.wait_for_unit("redis-mastodon.service") - server.wait_for_unit("mastodon-sidekiq.service") - server.wait_for_unit("mastodon-streaming.service") - server.wait_for_unit("mastodon-web.service") - server.wait_for_open_port(55000) - server.wait_for_open_port(55001) - - # Check that mastodon-media-auto-remove is scheduled - server.succeed("systemctl status mastodon-media-auto-remove.timer") - - # Check Mastodon version from remote client - client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'") - - # Check access from remote client - client.succeed("curl --fail https://mastodon.local/about | grep 'Mastodon hosted on mastodon.local'") - client.succeed("curl --fail $(curl https://mastodon.local/api/v1/instance 2> /dev/null | jq -r .thumbnail) --output /dev/null") - - # Simple check tootctl commands - # Check Mastodon version - server.succeed("mastodon-tootctl version | grep '${pkgs.mastodon.version}") - - # Manage accounts - server.succeed("mastodon-tootctl email_domain_blocks add example.com") - server.succeed("mastodon-tootctl email_domain_blocks list | grep example.com") - server.fail("mastodon-tootctl email_domain_blocks list | grep mastodon.local") - server.fail("mastodon-tootctl accounts create alice --email=alice@example.com") - server.succeed("mastodon-tootctl email_domain_blocks remove example.com") - server.succeed("mastodon-tootctl accounts create bob --email=bob@example.com") - server.succeed("mastodon-tootctl accounts approve bob") - server.succeed("mastodon-tootctl accounts delete bob") - - # Manage IP access - server.succeed("mastodon-tootctl ip_blocks add 192.168.0.0/16 --severity=no_access") - server.succeed("mastodon-tootctl ip_blocks export | grep 192.168.0.0/16") - server.fail("mastodon-tootctl ip_blocks export | grep 172.16.0.0/16") - client.fail("curl --fail https://mastodon.local/about") - server.succeed("mastodon-tootctl ip_blocks remove 192.168.0.0/16") - client.succeed("curl --fail https://mastodon.local/about") - - server.shutdown() - client.shutdown() - database.shutdown() - nginx.shutdown() - ''; + testScript = import ./script.nix { + inherit pkgs; + extraInit = '' + nginx.wait_for_unit("nginx.service") + nginx.wait_for_open_port(443) + database.wait_for_unit("postgresql.service") + database.wait_for_open_port(5432) + ''; + extraShutdown = '' + nginx.shutdown() + database.shutdown() + ''; + }; }) diff --git a/nixos/tests/web-apps/mastodon/script.nix b/nixos/tests/web-apps/mastodon/script.nix new file mode 100644 index 000000000000..cdb1d4379b64 --- /dev/null +++ b/nixos/tests/web-apps/mastodon/script.nix @@ -0,0 +1,54 @@ +{ pkgs +, extraInit ? "" +, extraShutdown ? "" +}: + +'' + start_all() + + ${extraInit} + + server.wait_for_unit("redis-mastodon.service") + server.wait_for_unit("mastodon-sidekiq.service") + server.wait_for_unit("mastodon-streaming.service") + server.wait_for_unit("mastodon-web.service") + server.wait_for_open_port(55000) + server.wait_for_open_port(55001) + + # Check that mastodon-media-auto-remove is scheduled + server.succeed("systemctl status mastodon-media-auto-remove.timer") + + # Check Mastodon version from remote client + client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'") + + # Check access from remote client + client.succeed("curl --fail https://mastodon.local/about | grep 'Mastodon hosted on mastodon.local'") + client.succeed("curl --fail $(curl https://mastodon.local/api/v1/instance 2> /dev/null | jq -r .thumbnail) --output /dev/null") + + # Simple check tootctl commands + # Check Mastodon version + server.succeed("mastodon-tootctl version | grep '${pkgs.mastodon.version}'") + + # Manage accounts + server.succeed("mastodon-tootctl email_domain_blocks add example.com") + server.succeed("mastodon-tootctl email_domain_blocks list | grep example.com") + server.fail("mastodon-tootctl email_domain_blocks list | grep mastodon.local") + server.fail("mastodon-tootctl accounts create alice --email=alice@example.com") + server.succeed("mastodon-tootctl email_domain_blocks remove example.com") + server.succeed("mastodon-tootctl accounts create bob --email=bob@example.com") + server.succeed("mastodon-tootctl accounts approve bob") + server.succeed("mastodon-tootctl accounts delete bob") + + # Manage IP access + server.succeed("mastodon-tootctl ip_blocks add 192.168.0.0/16 --severity=no_access") + server.succeed("mastodon-tootctl ip_blocks export | grep 192.168.0.0/16") + server.fail("mastodon-tootctl ip_blocks export | grep 172.16.0.0/16") + client.fail("curl --fail https://mastodon.local/about") + server.succeed("mastodon-tootctl ip_blocks remove 192.168.0.0/16") + client.succeed("curl --fail https://mastodon.local/about") + + server.shutdown() + client.shutdown() + + ${extraShutdown} +'' diff --git a/nixos/tests/web-apps/mastodon/standard.nix b/nixos/tests/web-apps/mastodon/standard.nix index 50ed5e5dc6dd..14311afea3f7 100644 --- a/nixos/tests/web-apps/mastodon/standard.nix +++ b/nixos/tests/web-apps/mastodon/standard.nix @@ -80,51 +80,13 @@ in }; }; - testScript = '' - start_all() - - server.wait_for_unit("nginx.service") - server.wait_for_unit("redis-mastodon.service") - server.wait_for_unit("postgresql.service") - server.wait_for_unit("mastodon-sidekiq.service") - server.wait_for_unit("mastodon-streaming.service") - server.wait_for_unit("mastodon-web.service") - server.wait_for_open_port(55000) - server.wait_for_open_port(55001) - - # Check that mastodon-media-auto-remove is scheduled - server.succeed("systemctl status mastodon-media-auto-remove.timer") - - # Check Mastodon version from remote client - client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'") - - # Check access from remote client - client.succeed("curl --fail https://mastodon.local/about | grep 'Mastodon hosted on mastodon.local'") - client.succeed("curl --fail $(curl https://mastodon.local/api/v1/instance 2> /dev/null | jq -r .thumbnail) --output /dev/null") - - # Simple check tootctl commands - # Check Mastodon version - server.succeed("mastodon-tootctl version | grep '${pkgs.mastodon.version}'") - - # Manage accounts - server.succeed("mastodon-tootctl email_domain_blocks add example.com") - server.succeed("mastodon-tootctl email_domain_blocks list | grep example.com") - server.fail("mastodon-tootctl email_domain_blocks list | grep mastodon.local") - server.fail("mastodon-tootctl accounts create alice --email=alice@example.com") - server.succeed("mastodon-tootctl email_domain_blocks remove example.com") - server.succeed("mastodon-tootctl accounts create bob --email=bob@example.com") - server.succeed("mastodon-tootctl accounts approve bob") - server.succeed("mastodon-tootctl accounts delete bob") - - # Manage IP access - server.succeed("mastodon-tootctl ip_blocks add 192.168.0.0/16 --severity=no_access") - server.succeed("mastodon-tootctl ip_blocks export | grep 192.168.0.0/16") - server.fail("mastodon-tootctl ip_blocks export | grep 172.16.0.0/16") - client.fail("curl --fail https://mastodon.local/about") - server.succeed("mastodon-tootctl ip_blocks remove 192.168.0.0/16") - client.succeed("curl --fail https://mastodon.local/about") - - server.shutdown() - client.shutdown() - ''; + testScript = import ./script.nix { + inherit pkgs; + extraInit = '' + server.wait_for_unit("nginx.service") + server.wait_for_open_port(443) + server.wait_for_unit("postgresql.service") + server.wait_for_open_port(5432) + ''; + }; })