1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
{ nixpkgs ? <nixpkgs> } @ args:
let
check = lib: config: {
rootSecretExists =
let p = config.seacrit.secrets.root.path;
in lib.stringAfter [ "seacrit-root" ] ''
(
set -x;
[ "$(cat ${p})" = root ] && \
[ $(stat -c %u:%g ${p}) = 0:0 ] && \
[ $(stat -c %a ${p}) = 400 ] && \
touch /run/root-sec-succeeded
)
'';
users.deps = [ "rootSecretExists" ];
groups.deps = [ "rootSecretExists" ];
userSecretExists =
let p = config.seacrit.secrets."user/sec".path;
in lib.stringAfter [ "users" "groups" "seacrit" ] ''
(
set -x;
[ "$(cat ${p})" = user ] && \
[ $(stat -c %U:%G ${p}) = user:user ] && \
[ $(stat -c %a ${p}) = 204 ] && \
touch /run/user-sec-succeeded
)
'';
};
in
import "${nixpkgs}/nixos/tests/make-test-python.nix" ({ pkgs, ... }: rec {
name = "seacrit-simple";
nodes.main = { pkgs, config, lib, ... }: {
imports = [
../modules
];
seacrit = {
storePath = ./simple;
hostKeys = [ (pkgs.runCommand "" { key = ./simple/main.key; } "cp $key $out") ];
secrets = {
root = { };
"user/sec" = { owner = "user"; group = "user"; mode = "u=w,o=r"; };
};
};
users = {
mutableUsers = false;
users.user = { isNormalUser = true; };
groups.user = {};
};
system.activationScripts = check lib config;
};
nodes.other = args@{ pkgs, config, lib, ... }: lib.recursiveUpdate (nodes.main args) {
seacrit.hostID = "main";
};
nodes.aux = args@{ pkgs, config, lib, ... }: lib.recursiveUpdate (nodes.main args) {
seacrit.hostKeys = [ (pkgs.runCommand "" { key = ./simple/aux.key; } "cp $key $out") ];
};
testScript = ''
for m in [ main, other, aux ]:
m.wait_for_unit("multi-user.target")
m.succeed('[ -f /run/root-sec-succeeded ]')
m.succeed('[ -f /run/user-sec-succeeded ]')
'';
}) args
|
