91 lines
2.9 KiB
Nix
91 lines
2.9 KiB
Nix
|
import ./make-test-python.nix ({ lib, pkgs, ... }:
|
||
|
|
{
|
||
|
|
name = "systemd-journal-gateway";
|
||
|
|
meta = with pkgs.lib.maintainers; {
|
||
|
|
maintainers = [ minijackson raitobezarius ];
|
||
|
|
};
|
||
|
|
|
||
|
|
# Named client for coherence with the systemd-journal-upload test, and for
|
||
|
|
# certificate validation
|
||
|
|
nodes.client = {
|
||
|
|
services.journald.gateway = {
|
||
|
|
enable = true;
|
||
|
|
cert = "/run/secrets/client/cert.pem";
|
||
|
|
key = "/run/secrets/client/key.pem";
|
||
|
|
trust = "/run/secrets/ca.cert.pem";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
testScript = ''
|
||
|
|
import json
|
||
|
|
import subprocess
|
||
|
|
import tempfile
|
||
|
|
|
||
|
|
tmpdir_o = tempfile.TemporaryDirectory()
|
||
|
|
tmpdir = tmpdir_o.name
|
||
|
|
|
||
|
|
def generate_pems(domain: str):
|
||
|
|
subprocess.run(
|
||
|
|
[
|
||
|
|
"${pkgs.minica}/bin/minica",
|
||
|
|
"--ca-key=ca.key.pem",
|
||
|
|
"--ca-cert=ca.cert.pem",
|
||
|
|
f"--domains={domain}",
|
||
|
|
],
|
||
|
|
cwd=str(tmpdir),
|
||
|
|
)
|
||
|
|
|
||
|
|
with subtest("Creating keys and certificates"):
|
||
|
|
generate_pems("server")
|
||
|
|
generate_pems("client")
|
||
|
|
|
||
|
|
client.wait_for_unit("multi-user.target")
|
||
|
|
|
||
|
|
def copy_pem(file: str):
|
||
|
|
machine.copy_from_host(source=f"{tmpdir}/{file}", target=f"/run/secrets/{file}")
|
||
|
|
machine.succeed(f"chmod 644 /run/secrets/{file}")
|
||
|
|
|
||
|
|
with subtest("Copying keys and certificates"):
|
||
|
|
machine.succeed("mkdir -p /run/secrets/{client,server}")
|
||
|
|
copy_pem("server/cert.pem")
|
||
|
|
copy_pem("server/key.pem")
|
||
|
|
copy_pem("client/cert.pem")
|
||
|
|
copy_pem("client/key.pem")
|
||
|
|
copy_pem("ca.cert.pem")
|
||
|
|
|
||
|
|
client.wait_for_unit("multi-user.target")
|
||
|
|
|
||
|
|
curl = '${pkgs.curl}/bin/curl'
|
||
|
|
accept_json = '--header "Accept: application/json"'
|
||
|
|
cacert = '--cacert /run/secrets/ca.cert.pem'
|
||
|
|
cert = '--cert /run/secrets/server/cert.pem'
|
||
|
|
key = '--key /run/secrets/server/key.pem'
|
||
|
|
base_url = 'https://client:19531'
|
||
|
|
|
||
|
|
curl_cli = f"{curl} {accept_json} {cacert} {cert} {key} --fail"
|
||
|
|
|
||
|
|
machine_info = client.succeed(f"{curl_cli} {base_url}/machine")
|
||
|
|
assert json.loads(machine_info)["hostname"] == "client", "wrong machine name"
|
||
|
|
|
||
|
|
# The HTTP request should have started the gateway service, triggered by
|
||
|
|
# the .socket unit
|
||
|
|
client.wait_for_unit("systemd-journal-gatewayd.service")
|
||
|
|
|
||
|
|
identifier = "nixos-test"
|
||
|
|
message = "Hello from NixOS test infrastructure"
|
||
|
|
|
||
|
|
client.succeed(f"systemd-cat --identifier={identifier} <<< '{message}'")
|
||
|
|
|
||
|
|
# max-time is a workaround against a bug in systemd-journal-gatewayd where
|
||
|
|
# if TLS is enabled, the connection is never closed. Since it will timeout,
|
||
|
|
# we ignore the return code.
|
||
|
|
entries = client.succeed(
|
||
|
|
f"{curl_cli} --max-time 5 {base_url}/entries?SYSLOG_IDENTIFIER={identifier} || true"
|
||
|
|
)
|
||
|
|
|
||
|
|
# Number of entries should be only 1
|
||
|
|
added_entry = json.loads(entries)
|
||
|
|
assert added_entry["SYSLOG_IDENTIFIER"] == identifier and added_entry["MESSAGE"] == message, "journal entry does not correspond"
|
||
|
|
'';
|
||
|
|
})
|