meow

tests/server-n0/integration.nix

@@ -14,13 +14,11 @@ let
 
   it = dsl.mkIntegrationTest { inherit host testContainers pkgs; };
 
-  nginxAcmeDomains = [
-    "devenv.floweytf.com"
-    "maven.floweytf.com"
-    "git.floweytf.com"
-    "utils.floweytf.com"
-    "mail.floweytf.com"
-  ];
+  nginxAcmeDomains =
+    if testContainers ? nginx && testContainers.nginx.miscProperties ? acmeDomains then
+      testContainers.nginx.miscProperties.acmeDomains
+    else
+      [ ];
 
   nginxAcmeDir = domain: "${serverDataDir}/core/nginx/acme/${domain}";
 
@@ -67,9 +65,44 @@ let
       '';
   sshpiperTestUser = "admin";
 
-  hostExporterPort = 9100;
-  hostCadvisorPort = 9200;
   hostSshdPort = 5952;
+
+  # derive data directories from container bind mounts
+  allDataDirs = lib.unique (
+    lib.concatMap (c: lib.filter (p: lib.hasPrefix serverDataDir p) c.bindMountHostPaths) (
+      lib.attrValues testContainers
+    )
+  );
+
+  mkdirAllDataDirs = lib.concatMapStrings (p: ''mkdir -p "${p}"'' + "\n") allDataDirs;
+
+  # writable data dirs need ownership set to 1000:1000 (the standard
+  # container user uid). services that run as a different user (loki,
+  # prometheus, grafana) fix ownership via StateDirectory on startup.
+  writableDataDirs = lib.unique (
+    lib.concatMap (
+      c:
+      if c.kind == "nspawn" then
+        lib.filter (p: lib.hasPrefix serverDataDir p) (
+          map (bm: bm.hostPath) (lib.attrValues (lib.filterAttrs (_: bm: !bm.isReadOnly) c.bindMounts))
+        )
+      else
+        [ ]
+    ) (lib.attrValues testContainers)
+  );
+
+  chownWritableDataDirs = lib.concatMapStrings (
+    p: ''chown -R 1000:1000 "${p}"'' + "\n"
+  ) writableDataDirs;
+
+  # secret paths needed by test containers
+  secretPaths = lib.unique (
+    lib.concatMap (c: lib.filter (p: lib.hasPrefix serverSecretsDir p) c.bindMountHostPaths) (
+      lib.attrValues testContainers
+    )
+  );
+
+  mkdirSecretParents = lib.concatMapStrings (p: ''mkdir -p "$(dirname '${p}')"'' + "\n") secretPaths;
 in
 {
   name = "integration-${host.hostName}";
@@ -90,63 +123,33 @@ in
           it.serverModule
         ];
 
-        containers.nginx.config = {
-          systemd.services = lib.genAttrs (map (d: "acme-order-renew-${d}") nginxAcmeDomains) (_: {
-            enable = lib.mkForce false;
-          });
-        };
-
         system.activationScripts.test-secrets =
           # bash
           ''
-            mkdir -p /nix/var/nix/db /nix/var/nix/daemon-socket
-
-            mkdir -p /var/log/journal
+              mkdir -p /nix/var/nix/db /nix/var/nix/daemon-socket
+              mkdir -p /var/log/journal
+              mkdir -p "${serverSecretsDir}"
 
+            ${mkdirAllDataDirs}
             ${mkdirAcmeDirs}
-            mkdir -p "${serverSecretsDir}" \
-              "${serverDataDir}/core/sshpiper" \
-              "${serverDataDir}/core/mail" \
-              "${serverDataDir}/overseer/loki/data" \
-              "${serverDataDir}/overseer/prometheus/data" \
-              "${serverDataDir}/overseer/grafana" \
-              "${serverDataDir}/web/git" \
-              "${serverDataDir}/web/git-ci-runner/nix-rw-store" \
-              "${serverDataDir}/web/git-ci-runner/docker" \
-              "${serverDataDir}/web/git-ci-runner/runner-state" \
-              "${serverSecretsDir}/ci-runner" \
-              "${serverDataDir}/web/reposilite" \
-              "${serverDataDir}/web/devenv/config" \
-              "${serverDataDir}/web/devenv/workspace" \
-              "${serverDataDir}/ssh/generic" \
-              "${serverDataDir}/ssh/nyaa" \
-              "${serverDataDir}/mc/botm" \
-              "${serverDataDir}/mc/rogule-dev" \
-              "${serverDataDir}/mc/rogule-build" \
-              "${serverDataDir}/mc/starwalker" \
-              "${serverDataDir}/mc/tl"
+            ${mkdirSecretParents}
+            ${chownWritableDataDirs}
 
-            chown -R 1000:1000 \
-              "${serverDataDir}/web/git" \
-              "${serverDataDir}/web/reposilite" \
-              "${serverDataDir}/web/devenv/config" \
-              "${serverDataDir}/web/devenv/workspace" \
-              "${serverDataDir}/core/mail" \
-              "${serverDataDir}/ssh/generic" \
-              "${serverDataDir}/mc/botm" \
-              "${serverDataDir}/mc/rogule-dev" \
-              "${serverDataDir}/mc/rogule-build" \
-              "${serverDataDir}/mc/starwalker" \
-              "${serverDataDir}/mc/tl"
+              for keytype in ed25519 rsa ecdsa; do
+                keyfile="${serverSecretsDir}/ssh_host_''${keytype}_key"
+                if [[ ! -f "$keyfile" ]]; then
+                  ${lib.getExe' pkgs.openssh "ssh-keygen"} -q -t "$keytype" -f "$keyfile" -N ""
+                fi
+              done
 
-            for keytype in ed25519 rsa ecdsa; do
-              keyfile="${serverSecretsDir}/ssh_host_''${keytype}_key"
-              if [[ ! -f "$keyfile" ]]; then
-                ${lib.getExe' pkgs.openssh "ssh-keygen"} -q -t "$keytype" -f "$keyfile" -N ""
-              fi
-            done
-
-            # stalwart rejects weak/dictionary passwords
+            ${installFakeCerts}
+          ''
+          + lib.optionalString (testContainers ? sshpiper) ''
+            mkdir -p "${serverDataDir}/core/sshpiper/user_${sshpiperTestUser}"
+            install -m 644 ${testSshKey}/key.pub \
+              "${serverDataDir}/core/sshpiper/user_${sshpiperTestUser}/authorized_keys"
+          ''
+          + lib.optionalString (testContainers ? mail) ''
             for f in mail-admin-password mail-account-password; do
               target="${serverSecretsDir}/$f"
               if [[ ! -f "$target" ]]; then
@@ -154,22 +157,14 @@ in
                 chmod 600 "$target"
               fi
             done
-
-            if [[ ! -f "${serverSecretsDir}/ci-runner/token" ]]; then
-              echo "TOKEN=test-registration-token" > "${serverSecretsDir}/ci-runner/token"
-              chmod 600 "${serverSecretsDir}/ci-runner/token"
-            fi
-
-            if [[ ! -f "${serverSecretsDir}/code-server-env" ]]; then
-              echo "test-secret" > "${serverSecretsDir}/code-server-env"
-              chmod 600 "${serverSecretsDir}/code-server-env"
-            fi
-
-            ${installFakeCerts}
-            mkdir -p "${serverDataDir}/core/sshpiper/user_${sshpiperTestUser}"
-            install -m 644 ${testSshKey}/key.pub \
-              "${serverDataDir}/core/sshpiper/user_${sshpiperTestUser}/authorized_keys"
           '';
+      }
+      // lib.optionalAttrs (testContainers ? nginx && nginxAcmeDomains != [ ]) {
+        containers.nginx.config = {
+          systemd.services = lib.genAttrs (map (d: "acme-order-renew-${d}") nginxAcmeDomains) (_: {
+            enable = lib.mkForce false;
+          });
+        };
       };
   };
 
@@ -182,8 +177,6 @@ in
       TEST_SSH_KEY_STORE = "${testSshKey}/key"
 
       SSHPIPER_TEST_USER = "${sshpiperTestUser}"
-      HOST_EXPORTER_PORT = ${toString hostExporterPort}
-      HOST_CADVISOR_PORT = ${toString hostCadvisorPort}
       HOST_SSHD_PORT = ${toString hostSshdPort}
     ''
     + builtins.readFile ./integration.py;