initial commit

2026-08-31 08:41:45 -05:00
commit 76fa38e34c
54 changed files with 6747 additions and 0 deletions
@@ -0,0 +1,190 @@
+{
+  lib,
+  host,
+  dsl,
+  commonModule,
+}:
+pkgs:
+let
+  inherit (host.specialArgs.hostInfo) paths;
+  serverDataDir = paths.data;
+  serverSecretsDir = paths.secrets;
+
+  testContainers = dsl.filterDeployments (c: c.includedInTests) host.containers;
+
+  it = dsl.mkIntegrationTest { inherit host testContainers pkgs; };
+
+  nginxAcmeDomains = [
+    "devenv.floweytf.com"
+    "maven.floweytf.com"
+    "git.floweytf.com"
+    "utils.floweytf.com"
+    "mail.floweytf.com"
+  ];
+
+  nginxAcmeDir = domain: "${serverDataDir}/core/nginx/acme/${domain}";
+
+  fakeCert =
+    domain:
+    pkgs.runCommand "fake-cert-${domain}"
+      {
+        nativeBuildInputs = [ pkgs.openssl ];
+      }
+      ''
+        mkdir -p "$out"
+        openssl req -x509 -newkey rsa:2048 -nodes -days 1 \
+          -subj "/CN=${domain}" \
+          -keyout "$out/key.pem" -out "$out/fullchain.pem" 2>/dev/null
+      '';
+
+  mkdirAcmeDirs = lib.concatMapStrings (
+    domain: ''mkdir -p "${nginxAcmeDir domain}"'' + "\n"
+  ) nginxAcmeDomains;
+
+  installFakeCerts = lib.concatMapStrings (
+    domain:
+    let
+      dir = nginxAcmeDir domain;
+      cert = fakeCert domain;
+    in
+    ''
+      if [[ ! -f "${dir}/fullchain.pem" ]]; then
+        install -m 644 ${cert}/fullchain.pem "${dir}/fullchain.pem"
+        install -m 600 ${cert}/key.pem "${dir}/key.pem"
+      fi
+    ''
+  ) nginxAcmeDomains;
+
+  # used in ssh-admin
+  testSshKey =
+    pkgs.runCommand "test-ssh-key"
+      {
+        nativeBuildInputs = [ pkgs.openssh ];
+      }
+      ''
+        mkdir -p "$out"
+        ssh-keygen -q -t ed25519 -N "" -f "$out/key" -C test
+      '';
+  sshpiperTestUser = "admin";
+
+  hostExporterPort = 9100;
+  hostCadvisorPort = 9200;
+  hostSshdPort = 5952;
+in
+{
+  name = "integration-${host.hostName}";
+
+  nodes = {
+    internet = it.internetNode;
+
+    server =
+      { pkgs, lib, ... }:
+      {
+        imports = [
+          commonModule
+          host.specialArgs.inputs.microvm.nixosModules.host
+          (dsl.mkHostFromContainers {
+            containers = testContainers;
+            inherit (host) ctx;
+          })
+          it.serverModule
+        ];
+
+        containers.nginx.config = {
+          systemd.services = lib.genAttrs (map (d: "acme-order-renew-${d}") nginxAcmeDomains) (_: {
+            enable = lib.mkForce false;
+          });
+        };
+
+        system.activationScripts.test-secrets =
+          # bash
+          ''
+            mkdir -p /nix/var/nix/db /nix/var/nix/daemon-socket
+
+            mkdir -p /var/log/journal
+
+            ${mkdirAcmeDirs}
+            mkdir -p "${serverSecretsDir}" \
+              "${serverDataDir}/core/sshpiper" \
+              "${serverDataDir}/core/mail" \
+              "${serverDataDir}/overseer/loki/data" \
+              "${serverDataDir}/overseer/prometheus/data" \
+              "${serverDataDir}/overseer/grafana" \
+              "${serverDataDir}/web/git" \
+              "${serverDataDir}/web/git-ci-runner/nix-rw-store" \
+              "${serverDataDir}/web/git-ci-runner/docker" \
+              "${serverDataDir}/web/git-ci-runner/runner-state" \
+              "${serverSecretsDir}/ci-runner" \
+              "${serverDataDir}/web/reposilite" \
+              "${serverDataDir}/web/devenv/config" \
+              "${serverDataDir}/web/devenv/workspace" \
+              "${serverDataDir}/ssh/generic" \
+              "${serverDataDir}/ssh/nyaa" \
+              "${serverDataDir}/mc/botm" \
+              "${serverDataDir}/mc/rogule-dev" \
+              "${serverDataDir}/mc/rogule-build" \
+              "${serverDataDir}/mc/starwalker" \
+              "${serverDataDir}/mc/tl"
+
+            chown -R 1000:1000 \
+              "${serverDataDir}/web/git" \
+              "${serverDataDir}/web/reposilite" \
+              "${serverDataDir}/web/devenv/config" \
+              "${serverDataDir}/web/devenv/workspace" \
+              "${serverDataDir}/core/mail" \
+              "${serverDataDir}/ssh/generic" \
+              "${serverDataDir}/mc/botm" \
+              "${serverDataDir}/mc/rogule-dev" \
+              "${serverDataDir}/mc/rogule-build" \
+              "${serverDataDir}/mc/starwalker" \
+              "${serverDataDir}/mc/tl"
+
+            for keytype in ed25519 rsa ecdsa; do
+              keyfile="${serverSecretsDir}/ssh_host_''${keytype}_key"
+              if [[ ! -f "$keyfile" ]]; then
+                ${lib.getExe' pkgs.openssh "ssh-keygen"} -q -t "$keytype" -f "$keyfile" -N ""
+              fi
+            done
+
+            # stalwart rejects weak/dictionary passwords
+            for f in mail-admin-password mail-account-password; do
+              target="${serverSecretsDir}/$f"
+              if [[ ! -f "$target" ]]; then
+                head -c 32 /dev/urandom | base64 | tr -d '\n' > "$target"
+                chmod 600 "$target"
+              fi
+            done
+
+            if [[ ! -f "${serverSecretsDir}/ci-runner/token" ]]; then
+              echo "TOKEN=test-registration-token" > "${serverSecretsDir}/ci-runner/token"
+              chmod 600 "${serverSecretsDir}/ci-runner/token"
+            fi
+
+            if [[ ! -f "${serverSecretsDir}/code-server-env" ]]; then
+              echo "test-secret" > "${serverSecretsDir}/code-server-env"
+              chmod 600 "${serverSecretsDir}/code-server-env"
+            fi
+
+            ${installFakeCerts}
+            mkdir -p "${serverDataDir}/core/sshpiper/user_${sshpiperTestUser}"
+            install -m 644 ${testSshKey}/key.pub \
+              "${serverDataDir}/core/sshpiper/user_${sshpiperTestUser}/authorized_keys"
+          '';
+      };
+  };
+
+  testScript =
+    it.testScriptPreamble
+    + ''
+      # store paths are world-readable; ssh refuses a key with those permissions
+      SSH_KEY = "/root/test-ssh-key"
+      SSH_OPTS = f"-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5 -i {SSH_KEY}"
+      TEST_SSH_KEY_STORE = "${testSshKey}/key"
+
+      SSHPIPER_TEST_USER = "${sshpiperTestUser}"
+      HOST_EXPORTER_PORT = ${toString hostExporterPort}
+      HOST_CADVISOR_PORT = ${toString hostCadvisorPort}
+      HOST_SSHD_PORT = ${toString hostSshdPort}
+    ''
+    + builtins.readFile ./integration.py;
+}