mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-12-27 08:04:14 +00:00
4f0dadbf38
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build a08b3a4d19.tar.gz \
--argstr baseRev b32a094368
result/bin/apply-formatting $NIXPKGS_PATH
283 lines
10 KiB
Nix
283 lines
10 KiB
Nix
/*
|
|
Pleroma E2E VM test.
|
|
|
|
Abstract:
|
|
=========
|
|
Using pleroma, postgresql, a local CA cert, a nginx reverse proxy
|
|
and a toot-based client, we're going to:
|
|
|
|
1. Provision a pleroma service from scratch (pleroma config + postgres db).
|
|
2. Create a "jamy" admin user.
|
|
3. Send a toot from this user.
|
|
4. Send a upload from this user.
|
|
5. Check the toot is part of the server public timeline
|
|
|
|
Notes:
|
|
- We need a fully functional TLS setup without having any access to
|
|
the internet. We do that by issuing a self-signed cert, add this
|
|
self-cert to the hosts pki trust store and finally spoof the
|
|
hostnames using /etc/hosts.
|
|
- For this NixOS test, we *had* to store some DB-related and
|
|
pleroma-related secrets to the store. Keep in mind the store is
|
|
world-readable, it's the worst place possible to store *any*
|
|
secret. **DO NOT DO THIS IN A REAL WORLD DEPLOYMENT**.
|
|
*/
|
|
|
|
import ./make-test-python.nix (
|
|
{ pkgs, ... }:
|
|
let
|
|
send-toot = pkgs.writeScriptBin "send-toot" ''
|
|
set -eux
|
|
# toot is using the requests library internally. This library
|
|
# sadly embed its own certificate store instead of relying on the
|
|
# system one. Overriding this pretty bad default behaviour.
|
|
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
|
|
|
|
toot login_cli -i "pleroma.nixos.test" -e "jamy@nixos.test" -p 'jamy-password'
|
|
echo "Login OK"
|
|
|
|
# Send a toot then verify it's part of the public timeline
|
|
toot post "hello world Jamy here"
|
|
echo "Send toot OK"
|
|
toot timeline -1 | grep -F -q "hello world Jamy here"
|
|
echo "Get toot from timeline OK"
|
|
|
|
# Test file upload
|
|
echo "y" | ${pkgs.toot}/bin/toot upload <(dd if=/dev/zero bs=1024 count=1024 status=none) \
|
|
| grep -F -q "https://pleroma.nixos.test/media"
|
|
|
|
echo "====================================================="
|
|
echo "= SUCCESS ="
|
|
echo "= ="
|
|
echo "= We were able to sent a toot + a upload and ="
|
|
echo "= retrieve both of them in the public timeline. ="
|
|
echo "====================================================="
|
|
'';
|
|
|
|
provision-db = pkgs.writeScriptBin "provision-db" ''
|
|
set -eux
|
|
sudo -u postgres psql -f ${db-seed}
|
|
'';
|
|
|
|
test-db-passwd = "SccZOvTGM//BMrpoQj68JJkjDkMGb4pHv2cECWiI+XhVe3uGJTLI0vFV/gDlZ5jJ";
|
|
|
|
/*
|
|
For this NixOS test, we *had* to store this secret to the store.
|
|
Keep in mind the store is world-readable, it's the worst place
|
|
possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD
|
|
DEPLOYMENT**.
|
|
*/
|
|
db-seed = pkgs.writeText "provision.psql" ''
|
|
CREATE USER pleroma WITH ENCRYPTED PASSWORD '${test-db-passwd}';
|
|
CREATE DATABASE pleroma OWNER pleroma;
|
|
\c pleroma;
|
|
--Extensions made by ecto.migrate that need superuser access
|
|
CREATE EXTENSION IF NOT EXISTS citext;
|
|
CREATE EXTENSION IF NOT EXISTS pg_trgm;
|
|
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
|
|
'';
|
|
|
|
pleroma-conf = ''
|
|
import Config
|
|
|
|
config :pleroma, Pleroma.Web.Endpoint,
|
|
url: [host: "pleroma.nixos.test", scheme: "https", port: 443],
|
|
http: [ip: {127, 0, 0, 1}, port: 4000]
|
|
|
|
config :pleroma, :instance,
|
|
name: "NixOS test pleroma server",
|
|
email: "pleroma@nixos.test",
|
|
notify_email: "pleroma@nixos.test",
|
|
limit: 5000,
|
|
registrations_open: true
|
|
|
|
config :pleroma, :media_proxy,
|
|
enabled: false,
|
|
redirect_on_failure: true
|
|
#base_url: "https://cache.pleroma.social"
|
|
|
|
config :pleroma, Pleroma.Repo,
|
|
adapter: Ecto.Adapters.Postgres,
|
|
username: "pleroma",
|
|
password: "${test-db-passwd}",
|
|
database: "pleroma",
|
|
hostname: "localhost",
|
|
pool_size: 10,
|
|
prepare: :named,
|
|
parameters: [
|
|
plan_cache_mode: "force_custom_plan"
|
|
]
|
|
|
|
config :pleroma, :database, rum_enabled: false
|
|
config :pleroma, :instance, static_dir: "/var/lib/pleroma/static"
|
|
config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads"
|
|
config :pleroma, configurable_from_database: false
|
|
'';
|
|
|
|
/*
|
|
For this NixOS test, we *had* to store this secret to the store.
|
|
Keep in mind the store is world-readable, it's the worst place
|
|
possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD
|
|
DEPLOYMENT**.
|
|
In a real-word deployment, you'd handle this either by:
|
|
- manually upload your pleroma secrets to /var/lib/pleroma/secrets.exs
|
|
- use a deployment tool such as morph or NixOps to deploy your secrets.
|
|
*/
|
|
pleroma-conf-secret = pkgs.writeText "secrets.exs" ''
|
|
import Config
|
|
|
|
config :joken, default_signer: "PS69/wMW7X6FIQPABt9lwvlZvgrJIncfiAMrK9J5mjVus/7/NJJi1DsDA1OghBE5"
|
|
|
|
config :pleroma, Pleroma.Web.Endpoint,
|
|
secret_key_base: "NvfmU7lYaQrmmxt4NACm0AaAfN9t6WxsrX0NCB4awkGHvr1S7jyshlEmrjaPFhhq",
|
|
signing_salt: "3L41+BuJ"
|
|
|
|
config :web_push_encryption, :vapid_details,
|
|
subject: "mailto:pleroma@nixos.test",
|
|
public_key: "BKjfNX9-UqAcncaNqERQtF7n9pKrB0-MO-juv6U5E5XQr_Tg5D-f8AlRjduAguDpyAngeDzG8MdrTejMSL4VF30",
|
|
private_key: "k7o9onKMQrgMjMb6l4fsxSaXO0BTNAer5MVSje3q60k"
|
|
'';
|
|
|
|
/*
|
|
For this NixOS test, we *had* to store this secret to the store.
|
|
Keep in mind the store is world-readable, it's the worst place
|
|
possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD
|
|
DEPLOYMENT**.
|
|
In a real-word deployment, you'd handle this either by:
|
|
- manually upload your pleroma secrets to /var/lib/pleroma/secrets.exs
|
|
- use a deployment tool such as morph or NixOps to deploy your secrets.
|
|
*/
|
|
provision-secrets = pkgs.writeScriptBin "provision-secrets" ''
|
|
set -eux
|
|
cp "${pleroma-conf-secret}" "/var/lib/pleroma/secrets.exs"
|
|
chown pleroma:pleroma /var/lib/pleroma/secrets.exs
|
|
'';
|
|
|
|
/*
|
|
For this NixOS test, we *had* to store this secret to the store.
|
|
Keep in mind the store is world-readable, it's the worst place
|
|
possible to store *any* secret. **DO NOT DO THIS IN A REAL WORLD
|
|
DEPLOYMENT**.
|
|
*/
|
|
provision-user = pkgs.writeScriptBin "provision-user" ''
|
|
set -eux
|
|
|
|
# Waiting for pleroma to be up.
|
|
timeout 5m bash -c 'while [[ "$(curl -s -o /dev/null -w '%{http_code}' https://pleroma.nixos.test/api/v1/instance)" != "200" ]]; do sleep 2; done'
|
|
# Toremove the RELEASE_COOKIE bit when https://github.com/NixOS/nixpkgs/issues/166229 gets fixed.
|
|
RELEASE_COOKIE="/var/lib/pleroma/.cookie" \
|
|
pleroma_ctl user new jamy jamy@nixos.test --password 'jamy-password' --moderator --admin -y
|
|
'';
|
|
|
|
tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
|
|
mkdir -p $out
|
|
openssl req -x509 \
|
|
-subj '/CN=pleroma.nixos.test/' -days 49710 \
|
|
-addext 'subjectAltName = DNS:pleroma.nixos.test' \
|
|
-keyout "$out/key.pem" -newkey ed25519 \
|
|
-out "$out/cert.pem" -noenc
|
|
'';
|
|
|
|
hosts = nodes: ''
|
|
${nodes.pleroma.networking.primaryIPAddress} pleroma.nixos.test
|
|
${nodes.client.networking.primaryIPAddress} client.nixos.test
|
|
'';
|
|
in
|
|
{
|
|
name = "pleroma";
|
|
nodes = {
|
|
client =
|
|
{
|
|
nodes,
|
|
pkgs,
|
|
config,
|
|
...
|
|
}:
|
|
{
|
|
security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
|
|
networking.extraHosts = hosts nodes;
|
|
environment.systemPackages = [
|
|
pkgs.toot
|
|
send-toot
|
|
];
|
|
};
|
|
pleroma =
|
|
{
|
|
nodes,
|
|
pkgs,
|
|
config,
|
|
...
|
|
}:
|
|
{
|
|
security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
|
|
networking.extraHosts = hosts nodes;
|
|
networking.firewall.enable = false;
|
|
environment.systemPackages = [
|
|
provision-db
|
|
provision-secrets
|
|
provision-user
|
|
];
|
|
services = {
|
|
pleroma = {
|
|
enable = true;
|
|
configs = [
|
|
pleroma-conf
|
|
];
|
|
};
|
|
postgresql = {
|
|
enable = true;
|
|
package = pkgs.postgresql_13;
|
|
};
|
|
nginx = {
|
|
enable = true;
|
|
virtualHosts."pleroma.nixos.test" = {
|
|
addSSL = true;
|
|
sslCertificate = "${tls-cert}/cert.pem";
|
|
sslCertificateKey = "${tls-cert}/key.pem";
|
|
locations."/" = {
|
|
proxyPass = "http://127.0.0.1:4000";
|
|
extraConfig = ''
|
|
add_header 'Access-Control-Allow-Origin' '*' always;
|
|
add_header 'Access-Control-Allow-Methods' 'POST, PUT, DELETE, GET, PATCH, OPTIONS' always;
|
|
add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, Idempotency-Key' always;
|
|
add_header 'Access-Control-Expose-Headers' 'Link, X-RateLimit-Reset, X-RateLimit-Limit, X-RateLimit-Remaining, X-Request-Id' always;
|
|
if ($request_method = OPTIONS) {
|
|
return 204;
|
|
}
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
add_header X-Permitted-Cross-Domain-Policies none;
|
|
add_header X-Frame-Options DENY;
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header Referrer-Policy same-origin;
|
|
add_header X-Download-Options noopen;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
client_max_body_size 16m;
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
testScript =
|
|
{ nodes, ... }:
|
|
''
|
|
pleroma.wait_for_unit("postgresql.service")
|
|
pleroma.wait_until_succeeds("ls /var/lib/pleroma")
|
|
pleroma.succeed("provision-db")
|
|
pleroma.wait_for_file("/var/lib/pleroma")
|
|
pleroma.succeed("provision-secrets")
|
|
pleroma.systemctl("restart pleroma.service")
|
|
pleroma.wait_for_unit("pleroma.service")
|
|
pleroma.succeed("provision-user")
|
|
client.succeed("send-toot")
|
|
'';
|
|
|
|
meta.timeout = 600;
|
|
}
|
|
)
|