nixpkgs-immich/nixos/tests/gitolite.nix

import ./make-test-python.nix ({ pkgs, ...}:

let
  adminPrivateKey = pkgs.writeText "id_ed25519" ''
    -----BEGIN OPENSSH PRIVATE KEY-----
    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
    QyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3gAAAJBJiYxDSYmM
    QwAAAAtzc2gtZWQyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3g
    AAAEDE1W6vMwSEUcF1r7Hyypm/+sCOoDmKZgPxi3WOa1mD2u7urFhAA90BTpGuEHeWWTY3
    W/g9PBxXNxfWhfbrm4LeAAAACGJmb0BtaW5pAQIDBAU=
    -----END OPENSSH PRIVATE KEY-----
  '';

  adminPublicKey = ''
    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7urFhAA90BTpGuEHeWWTY3W/g9PBxXNxfWhfbrm4Le root@client
  '';

  alicePrivateKey = pkgs.writeText "id_ed25519" ''
    -----BEGIN OPENSSH PRIVATE KEY-----
    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
    QyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQAAAJAwVQ5VMFUO
    VQAAAAtzc2gtZWQyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQ
    AAAEB7lbfkkdkJoE+4TKHPdPQWBKLSx+J54Eg8DaTr+3KoSlt5a8eH8BYZYjoQhzXGVKKH
    Je1pw1D0p7O2Vb9VTLzBAAAACGJmb0BtaW5pAQIDBAU=
    -----END OPENSSH PRIVATE KEY-----
  '';

  alicePublicKey = pkgs.writeText "id_ed25519.pub" ''
    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFt5a8eH8BYZYjoQhzXGVKKHJe1pw1D0p7O2Vb9VTLzB alice@client
  '';

  bobPrivateKey = pkgs.writeText "id_ed25519" ''
    -----BEGIN OPENSSH PRIVATE KEY-----
    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
    QyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMAAAAJDQBmNV0AZj
    VQAAAAtzc2gtZWQyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMA
    AAAEDM1IYYFUwk/IVxauha9kuR6bbRtT3gZ6ZA0GLb9txb/pZNonUP1ePHLrvn0W9D2hdN
    6zWWZYFyJc+QR6pOKQEwAAAACGJmb0BtaW5pAQIDBAU=
    -----END OPENSSH PRIVATE KEY-----
  '';

  bobPublicKey = pkgs.writeText "id_ed25519.pub" ''
    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZNonUP1ePHLrvn0W9D2hdN6zWWZYFyJc+QR6pOKQEw bob@client
  '';

  gitoliteAdminConfSnippet = pkgs.writeText "gitolite-admin-conf-snippet" ''
    repo alice-project
        RW+     =   alice
  '';
in
{
  name = "gitolite";

  meta = with pkgs.lib.maintainers; {
    maintainers = [ bjornfor ];
  };

  nodes = {

    server =
      { ... }:
      {
        services.gitolite = {
          enable = true;
          adminPubkey = adminPublicKey;
        };
        services.openssh.enable = true;
      };

    client =
      { pkgs, ... }:
      {
        environment.systemPackages = [ pkgs.git ];
        programs.ssh.extraConfig = ''
          Host *
            UserKnownHostsFile /dev/null
            StrictHostKeyChecking no
            # there's nobody around that can input password
            PreferredAuthentications publickey
        '';
        users.users.alice = { isNormalUser = true; };
        users.users.bob = { isNormalUser = true; };
      };

  };

  testScript = ''
    start_all()

    with subtest("can setup ssh keys on system"):
        client.succeed(
            "mkdir -p ~root/.ssh",
            "cp ${adminPrivateKey} ~root/.ssh/id_ed25519",
            "chmod 600 ~root/.ssh/id_ed25519",
        )
        client.succeed(
            "sudo -u alice mkdir -p ~alice/.ssh",
            "sudo -u alice cp ${alicePrivateKey} ~alice/.ssh/id_ed25519",
            "sudo -u alice chmod 600 ~alice/.ssh/id_ed25519",
        )
        client.succeed(
            "sudo -u bob mkdir -p ~bob/.ssh",
            "sudo -u bob cp ${bobPrivateKey} ~bob/.ssh/id_ed25519",
            "sudo -u bob chmod 600 ~bob/.ssh/id_ed25519",
        )

    with subtest("gitolite server starts"):
        server.wait_for_unit("gitolite-init.service")
        server.wait_for_unit("sshd.service")
        client.succeed("ssh -n gitolite@server info")

    with subtest("admin can clone and configure gitolite-admin.git"):
        client.succeed(
            "git clone gitolite@server:gitolite-admin.git",
            "git config --global user.name 'System Administrator'",
            "git config --global user.email root\@domain.example",
            "cp ${alicePublicKey} gitolite-admin/keydir/alice.pub",
            "cp ${bobPublicKey} gitolite-admin/keydir/bob.pub",
            "(cd gitolite-admin && git add . && git commit -m 'Add keys for alice, bob' && git push)",
            "cat ${gitoliteAdminConfSnippet} >> gitolite-admin/conf/gitolite.conf",
            "(cd gitolite-admin && git add . && git commit -m 'Add repo for alice' && git push)",
        )

    with subtest("non-admins cannot clone gitolite-admin.git"):
        client.fail("sudo -i -u alice git clone gitolite@server:gitolite-admin.git")
        client.fail("sudo -i -u bob git clone gitolite@server:gitolite-admin.git")

    with subtest("non-admins can clone testing.git"):
        client.succeed("sudo -i -u alice git clone gitolite@server:testing.git")
        client.succeed("sudo -i -u bob git clone gitolite@server:testing.git")

    with subtest("alice can clone alice-project.git"):
        client.succeed("sudo -i -u alice git clone gitolite@server:alice-project.git")

    with subtest("bob cannot clone alice-project.git"):
        client.fail("sudo -i -u bob git clone gitolite@server:alice-project.git")
  '';
})