Commit graph

2752 commits

Author SHA1 Message Date
Patryk Wychowaniec 183d9abdaf
lxd: s/sha256/hash 2020-09-09 20:07:17 +02:00
Patryk Wychowaniec 93b8435915
lxd: add wait_for_file() to ensure LXD is actually running 2020-09-09 19:46:21 +02:00
Patryk Wychowaniec 04111cb356
lxd: use stable URL for Alpine's image 2020-09-09 19:30:02 +02:00
Ryan Mulligan a38ffcc20e
Merge pull request #95752 from misuzu/3proxy-test-fix
nixosTests.3proxy: fix flakiness
2020-09-08 20:33:20 -07:00
Oleksii Filonenko 45d7f59da8
Merge pull request #97217 from sephii/nixos-caddy-v2-migration 2020-09-08 11:17:55 +03:00
Linus Heckemann ef4e81d756
Merge pull request #96830 from mayflower/unifi-poller
unifi-poller: add service and prometheus-exporter
2020-09-08 09:53:07 +02:00
Sylvain Fankhauser b8bfe941fa
caddy: address remaining MR comments for v2 2020-09-08 09:29:04 +02:00
Robert Scott 61525137fd
Merge pull request #96958 from servalcatty/v2ray
v2ray: 4.26.0 -> 4.27.5 and add tests
2020-09-07 21:29:51 +01:00
Vladimír Čunát 85afe9cbe9
nixos/tests/installer: increase RAM in the VM
1G apparently isn't sufficient anymore, at least in swraid case:
https://hydra.nixos.org/build/126561574
2020-09-07 15:43:37 +02:00
Vladimír Čunát c1c85b9bad
Merge #97146: 'staging-next' branch
This is the last planned iteration before forking 20.09.
2020-09-07 15:43:36 +02:00
Jörg Thalheim d9ccdd860c
Merge pull request #96885 from bbigras/sssd-ldap
nixos/tests/sssd-ldap: init
2020-09-06 20:29:36 +01:00
Florian Klink d7046947e5
Merge pull request #91121 from m1cr0man/master
Restructure acme module
2020-09-06 18:26:22 +02:00
elseym aaf0002f68
prometheus-unifi-poller-exporter: init module 2020-09-06 17:48:19 +02:00
elseym 8c49e5a78c
tests/prometheus-exporters: allow overriding test-node-name
allows the prometheus-exporters test abstraction to work with e.g. hyphenated exporter-names
2020-09-06 17:48:00 +02:00
Lucas Savva 34b5c5c1a4
nixos/acme: More features and fixes
- Allow for key reuse when domains are the only thing that
  were changed.
- Fixed systemd service failure when preliminarySelfsigned
  was set to false
2020-09-06 01:28:19 +01:00
Vladimír Čunát 6eea644749
nixos/tests/installer swraid: increase partition size
We apparently didn't fit anymore.  I don't think this test is meant
to (also) check closure size.

Note: as of this commit, the test is blocked by a fontconfig problem,
so I tested with that merge temporarily reverted.
2020-09-05 19:29:38 +02:00
Oleksii Filonenko 06d2d84519
nixosTests.caddy: update to v2
- Update configuration syntax
- Add filalex77 as a maintainer
2020-09-05 14:09:17 +02:00
Lucas Savva f57824c915
nixos/acme: Update docs, use assert more effectively 2020-09-05 01:06:29 +01:00
Lucas Savva 67a5d660cb
nixos/acme: Run postRun script as root 2020-09-04 19:34:10 +01:00
Bruno Bigras 64ce52713c nixos/tests/sssd-ldap: init 2020-09-04 01:51:42 -04:00
Lucas Savva 1b6cfd9796
nixos/acme: Fix race condition, dont be smart with keys
Attempting to reuse keys on a basis different to the cert (AKA,
storing the key in a directory with a hashed name different to
the cert it is associated with) was ineffective since when
"lego run" is used it will ALWAYS generate a new key. This causes
issues when you revert changes since your "reused" key will not
be the one associated with the old cert. As such, I tore out the
whole keyDir implementation.

As for the race condition, checking the mtime of the cert file
was not sufficient to detect changes. In testing, selfsigned
and full certs could be generated/installed within 1 second of
each other. cmp is now used instead.

Also, I removed the nginx/httpd reload waiters in favour of
simple retry logic for the curl-based tests
2020-09-04 01:09:43 +01:00
Anders Kaseorg f4b2c9dfe7 cryptsetup, lvm2, systemd: Break cyclic dependency at a different point
The cyclic dependency of systemd → cryptsetup → lvm2 → udev=systemd
needs to be broken somewhere.  The previous strategy of building
cryptsetup with an lvm2 built without udev (#66856) caused the
installer.luksroot test to fail.  Instead, build lvm2 with a udev built
without cryptsetup.

Fixes #96479.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2020-09-03 12:35:56 -07:00
Jörg Thalheim 02a2649220
Merge pull request #89748 from heinic/krb5-lists 2020-09-03 07:31:22 +01:00
Lucas Savva 61dbf4bf89
nixos/acme: Add proper nginx/httpd config reload checks
Testing of certs failed randomly when the web server was still
returning old certs even after the reload was "complete". This was
because the reload commands send process signals and do not wait
for the worker processes to restart. This commit adds log watchers
which wait for the worker processes to be restarted.
2020-09-02 19:25:30 +01:00
Lucas Savva 982c5a1f0e
nixos/acme: Restructure module
- Use an acme user and group, allow group override only
- Use hashes to determine when certs actually need to regenerate
- Avoid running lego more than necessary
- Harden permissions
- Support "systemctl clean" for cert regeneration
- Support reuse of keys between some configuration changes
- Permissions fix services solves for previously root owned certs
- Add a note about multiple account creation and emails
- Migrate extraDomains to a list
- Deprecate user option
- Use minica for self-signed certs
- Rewrite all tests

I thought of a few more cases where things may go wrong,
and added tests to cover them. In particular, the web server
reload services were depending on the target - which stays alive,
meaning that the renewal timer wouldn't be triggering a reload
and old certs would stay on the web servers.

I encountered some problems ensuring that the reload took place
without accidently triggering it as part of the test. The sync
commands I added ended up being essential and I'm not sure why,
it seems like either node.succeed ends too early or there's an
oddity of the vm's filesystem I'm not aware of.

- Fix duplicate systemd rules on reload services

Since useACMEHost is not unique to every vhost, if one cert
was reused many times it would create duplicate entries in
${server}-config-reload.service for wants, before and
ConditionPathExists
2020-09-02 19:22:43 +01:00
Serval 4ac99e76bc
nixos/tests/v2ray: init 2020-09-02 22:18:52 +08:00
misuzu 0c688868e7 nixosTests.3proxy: fix flakiness 2020-09-01 14:31:52 +03:00
Lassulus a081e99e41
Merge pull request #83780 from hax404/robustirc-bridge
robustirc-bridge: init at 1.8
2020-08-31 18:14:45 +02:00
Georg Haas 2bd6f0744f
nixos/tests/robustirc-bridge: init 2020-08-31 15:22:50 +02:00
Arian van Putten 882ed6759a
Merge pull request #96149 from JJJollyjim/acme-test-go-15
nixos/acme: fix subjectAltName in test snakeoil certs
2020-08-31 13:54:19 +02:00
Félix Baylac-Jacqué f63c842f1e
nixosTests.systemd-networkd: fix test flakiness
The original idea for this test was, on top of providing a networkd
test, to provide newcomers with a sample configuration they could use
to get started with networkd.

That's precisely why we were doing this systemd tmpfile dance in the
first place. It was a convenient way to create a runtime file with a
specific mode and owner.

Sadly, this tmpfile rule made the test flaky. There's a race condition
between the wireguard interface configured by systemd-networkd and
systemd-tmpfiles-setup.

Sometimes, networkd is going to try loading the wireguard private key
file *before* the said file gets created by systemd-tmpfiles.

A perfect solution here would be to create a "After" dependency
between wg0.netdev and systemd-tmpfiles-setup.service. Sadly, it is
currently impossible to create such a dependency between a
networkd-specific unit and a service.

We're removing this tmp file in favor of pointing networkd directly to
the Nix store. This is clearly something that shouldn't be done in the
real world for a private file: the store is world-readable. However,
this is the only way I found to fix this test flakiness for now.
2020-08-30 21:03:27 +02:00
Maximilian Bosch d416facd39
nixos/tests/systemd-networkd: fix eval
In `systemd-243` the option `FwMark` in the `[WireGuard]` section of
a `.netdev`-unit has been renamed to `FirewallMark`[1]. Due to the
removal of deprecated options in our `networkd` module[2] the evaluation
of this test doesn't work.

Renaming the option to its new name fixes the issue.

[1] 1c30b174ed
[2] e9d13d3751
2020-08-29 22:51:30 +02:00
Aaron Andersen bcdcd5d9fc
Merge pull request #95880 from aanderse/postgresql-settings
nixos/postgresql: replace extraConfig option with settings option
2020-08-29 09:12:54 -04:00
Frederik Rietdijk 7b56d26ae3 Merge master into staging-next 2020-08-29 13:30:25 +02:00
worldofpeace f2d0a68c21
Merge pull request #96396 from flokli/remove-perl-test-driver
nixos/lib/test*: remove perl test driver
2020-08-28 11:30:18 -04:00
Daniël de Kok 192ed0a00e
Merge pull request #95888 from bzizou/charliecloud18
charliecloud: 0.12 -> 0.18
2020-08-28 16:34:57 +02:00
Bruno Bzeznik 1601ff7dd4 charliecloud: 0.12 -> 0.18 (docker + ch-grow support) 2020-08-28 14:39:21 +02:00
Florian Klink 0620184f3f nixos/lib/test*: remove perl test driver
This has been deprecated in 20.03, and all tests have been migrated to
the python framework, effectively making this dead code.
2020-08-27 19:45:38 +02:00
Matthew Bauer 25ac498482
Merge pull request #96404 from matthewbauer/gcc-cross
Fix cycle detected in Darwin->Linux cross GCC
2020-08-26 16:17:14 -05:00
Aaron Andersen 2a44265608 nixos/postgresql: replace extraConfig option with settings option 2020-08-26 17:06:48 -04:00
Florian Klink 36e4ec8568
Merge pull request #96349 from helsinki-systems/feat/postgresql-wal-python
tests/postgresql-wal-receiver: Port to Python
2020-08-26 21:08:15 +02:00
Matthew Bauer ca3fa9c32a
Merge pull request #95956 from matthewbauer/qemu-cpu-max
runInLinuxVM, test-driver: use -cpu max instead of -cpu host
2020-08-26 12:59:57 -05:00
Vladimír Čunát e02793de2f
nixos installer tests: add a missing package
Tested it locally fixes #96361
nix-build nixos/release-combined.nix -A nixos.tests.installer.lvm.x86_64-linux -Q
2020-08-26 18:14:34 +02:00
Lassulus 12baef56e4
Merge pull request #96127 from hmenke/shadowsocks
shadowsocks service: support plugins
2020-08-26 16:49:55 +02:00
Janne Heß ead6de5d3d
tests/postgresql-wal-receiver: Port to Python
... and remove some weirdnesses.

- Port to Python
- Drop the extra pkgs, config, system args
- Drop all `with`
- Don't override the standard PostgreSQL directory
- Use pkgs and lib from the test runner

Tested with:
- postgresql_12
- postgresql_11
- postgresql_10
- postgresql_9_6
- postgresql_9_5

Closes #96347
cc @flokli
2020-08-26 16:37:24 +02:00
Florian Klink df2f22daa8
Merge pull request #94858 from liff/virtualbox-python-test
nixosTests.virtualbox: Port to python
2020-08-26 10:00:04 +02:00
Frederik Rietdijk 081bd762e5 Merge staging-next into staging 2020-08-26 08:43:29 +02:00
Henri Menke 27f281bc50
nixos/shadowsocks: add test 2020-08-26 15:15:27 +12:00
Rouven Czerwinski 7db58b93d0
nixos/tests: use ::1 instead of anycast address (#96250)
According to RFC4291[1], 2001:db8:: is the anycast address for the
prefix and will be answered by all routers responsible for this prefix.
This means that before the iputils bump, the ping from client to isp was
answered by the router and not by the ISP machine. Switching away from
the anycast address fixes this issue.

Credits for finding this go to @primeos.

[1]: https://tools.ietf.org/html/rfc4291#section-2.6.1

Fixes #96188
2020-08-25 22:29:22 +02:00
Anderson Torres fffabfaefd
Merge pull request #96179 from bbigras/sssd
nixos/sssd: fix the module
2020-08-25 16:59:11 -03:00