From 8b44d8098b8d9e36eaccfa6ba1ea3e47de87fe11 Mon Sep 17 00:00:00 2001 From: Pierre Penninckx Date: Sun, 3 Mar 2024 23:01:05 -0800 Subject: [PATCH] Add more vm tests to nextcloud (#200) --- test/vm/nextcloud.nix | 247 ++++++++++++++++++++++++++++++------------ 1 file changed, 175 insertions(+), 72 deletions(-) diff --git a/test/vm/nextcloud.nix b/test/vm/nextcloud.nix index 7eee458..58ef84e 100644 --- a/test/vm/nextcloud.nix +++ b/test/vm/nextcloud.nix @@ -2,9 +2,126 @@ let adminUser = "root"; adminPass = "rootpw"; - subdomain = "n"; - domain = "example.com"; - fqdn = "${subdomain}.${domain}"; + + commonTestScript = { nodes, ... }: + let + hasSSL = !(isNull nodes.server.shb.nextcloud.ssl); + fqdn = if hasSSL then "https://n.example.com" else "http://n.example.com"; + in + '' + import json + import os + import pathlib + + start_all() + server.wait_for_unit("phpfpm-nextcloud.service") + server.wait_for_unit("nginx.service") + server.wait_for_open_unix_socket("${nodes.server.services.phpfpm.pools.nextcloud.socket}") + + if ${if hasSSL then "True" else "False"}: + server.copy_from_vm("/etc/ssl/certs/ca-certificates.crt") + client.succeed("rm -r /etc/ssl/certs") + client.copy_from_host(str(pathlib.Path(os.environ.get("out", os.getcwd())) / "ca-certificates.crt"), "/etc/ssl/certs/ca-certificates.crt") + + def find_in_logs(unit, text): + return server.systemctl("status {}".format(unit))[1].find(text) != -1 + + def curl(target, format, endpoint, succeed=True): + return json.loads(target.succeed( + "curl --fail-with-body --silent --show-error --output /dev/null --location" + + " --connect-to n.example.com:443:server:443" + + " --connect-to n.example.com:80:server:80" + + f" --write-out '{format}'" + + " " + endpoint + )) + + with subtest("access"): + response = curl(client, """{"code":%{response_code}}""", "${fqdn}") + + if response['code'] != 200: + raise Exception(f"Code is {response['code']}") + + with subtest("cron job succeeds"): + # This calls blocks until the service is done. + server.systemctl("start nextcloud-cron.service") + + # If the service failed, then we're not happy. + server.require_unit_state("nextcloud-cron", "inactive") + + if not find_in_logs("nextcloud-cron", "nextcloud-cron.service: Deactivated successfully."): + raise Exception("Nextcloud cron job did not finish successfully.") + + with subtest("fails with incorrect authentication"): + client.fail( + "curl -f -s --location -X PROPFIND" + + """ -H "Depth: 1" """ + + """ -u ${adminUser}:other """ + + " --connect-to n.example.com:443:server:443" + + " --connect-to n.example.com:80:server:80" + + " ${fqdn}/remote.php/dav/files/${adminUser}/" + ) + + client.fail( + "curl -f -s --location -X PROPFIND" + + """ -H "Depth: 1" """ + + """ -u root:rootpw """ + + " --connect-to n.example.com:443:server:443" + + " --connect-to n.example.com:80:server:80" + + " ${fqdn}/remote.php/dav/files/other/" + ) + + with subtest("fails with incorrect path"): + client.fail( + "curl -f -s --location -X PROPFIND" + + """ -H "Depth: 1" """ + + """ -u ${adminUser}:${adminPass} """ + + " --connect-to n.example.com:443:server:443" + + " --connect-to n.example.com:80:server:80" + + " ${fqdn}/remote.php/dav/files/other/" + ) + + with subtest("can access webdav"): + client.succeed( + "curl -f -s --location -X PROPFIND" + + """ -H "Depth: 1" """ + + """ -u ${adminUser}:${adminPass} """ + + " --connect-to n.example.com:443:server:443" + + " --connect-to n.example.com:80:server:80" + + " ${fqdn}/remote.php/dav/files/${adminUser}/" + ) + + with subtest("can create and retrieve file"): + client.fail( + "curl -f -s --location -X GET" + + """ -H "Depth: 1" """ + + """ -u ${adminUser}:${adminPass} """ + + " --connect-to n.example.com:443:server:443" + + " --connect-to n.example.com:80:server:80" + + """ -T file """ + + " ${fqdn}/remote.php/dav/files/${adminUser}/file" + ) + client.succeed("echo 'hello' > file") + client.succeed( + "curl -f -s --location -X PUT" + + """ -H "Depth: 1" """ + + """ -u ${adminUser}:${adminPass} """ + + " --connect-to n.example.com:443:server:443" + + " --connect-to n.example.com:80:server:80" + + """ -T file """ + + " ${fqdn}/remote.php/dav/files/${adminUser}/" + ) + content = client.succeed( + "curl -f -s --location -X GET" + + """ -H "Depth: 1" """ + + """ -u ${adminUser}:${adminPass} """ + + " --connect-to n.example.com:443:server:443" + + " --connect-to n.example.com:80:server:80" + + """ -T file """ + + " ${fqdn}/remote.php/dav/files/${adminUser}/file" + ) + if content != "hello\n": + raise Exception("Got incorrect content for file, expected 'hello\n' but got:\n{}".format(content)) + ''; in { basic = pkgs.nixosTest { @@ -14,13 +131,10 @@ in imports = [ { options = { - shb.ssl.enable = lib.mkEnableOption "ssl"; shb.backup = lib.mkOption { type = lib.types.anything; }; shb.authelia = lib.mkOption { type = lib.types.anything; }; }; } - # ../../modules/blocks/authelia.nix - # ../../modules/blocks/ldap.nix ../../modules/services/nextcloud-server.nix ]; @@ -47,79 +161,68 @@ in nodes.client = {}; - testScript = { nodes, ... }: '' - start_all() - server.wait_for_unit("phpfpm-nextcloud.service") - server.wait_for_unit("nginx.service") + testScript = commonTestScript; + }; - def find_in_logs(unit, text): - return server.systemctl("status {}".format(unit))[1].find(text) != -1 + cert = pkgs.nixosTest { + name = "nextcloud-cert"; - with subtest("cron job succeeds"): - # This calls blocks until the service is done. - server.systemctl("start nextcloud-cron.service") + nodes.server = { config, pkgs, ... }: { + imports = [ + { + options = { + shb.backup = lib.mkOption { type = lib.types.anything; }; + shb.authelia = lib.mkOption { type = lib.types.anything; }; + }; + } + ../../modules/blocks/nginx.nix + # ../../modules/blocks/postgresql.nix + ../../modules/blocks/ssl.nix + ../../modules/services/nextcloud-server.nix + ]; - # If the service failed, then we're not happy. - server.require_unit_state("nextcloud-cron", "inactive") + shb.certs = { + cas.selfsigned.myca = { + name = "My CA"; + }; + certs.selfsigned = { + n = { + ca = config.shb.certs.cas.selfsigned.myca; + domain = "*.example.com"; + group = "nginx"; + }; + }; + }; - if not find_in_logs("nextcloud-cron", "nextcloud-cron.service: Deactivated successfully."): - raise Exception("Nextcloud cron job did not finish successfully.") + systemd.services.nginx.after = [ config.shb.certs.certs.selfsigned.n.systemdService ]; + systemd.services.nginx.requires = [ config.shb.certs.certs.selfsigned.n.systemdService ]; - with subtest("fails with incorrect authentication"): - client.fail( - "curl -f -s -X PROPFIND" - + """ -H "Depth: 1" """ - + """ -u ${adminUser}:other """ - + """ -H "Host: ${fqdn}" """ - + " http://server/remote.php/dav/files/${adminUser}/" - ) + shb.nextcloud = { + enable = true; + domain = "example.com"; + subdomain = "n"; + dataDir = "/var/lib/nextcloud"; + tracing = null; + defaultPhoneRegion = "US"; - with subtest("fails with incorrect path"): - client.fail( - "curl -f -s -X PROPFIND" - + """ -H "Depth: 1" """ - + """ -u ${adminUser}:${adminPass} """ - + """ -H "Host: ${fqdn}" """ - + " http://server/remote.php/dav/files/other/" - ) + ssl = config.shb.certs.certs.selfsigned.n; - with subtest("can access webdav"): - client.succeed( - "curl -f -s -X PROPFIND" - + """ -H "Depth: 1" """ - + """ -u ${adminUser}:${adminPass} """ - + """ -H "Host: ${fqdn}" """ - + " http://server/remote.php/dav/files/${adminUser}/" - ) + # This option is only needed because we do not access Nextcloud at the default port in the VM. + externalFqdn = "n.example.com:8080"; - with subtest("can create and retrieve file"): - client.fail( - "curl -f -s -X GET" - + """ -H "Depth: 1" """ - + """ -u ${adminUser}:${adminPass} """ - + """ -H "Host: ${fqdn}" """ - + """ -T file """ - + " http://server/remote.php/dav/files/${adminUser}/file" - ) - client.succeed("echo 'hello' > file") - client.succeed( - "curl -f -s -X PUT" - + """ -H "Depth: 1" """ - + """ -u ${adminUser}:${adminPass} """ - + """ -H "Host: ${fqdn}" """ - + """ -T file """ - + " http://server/remote.php/dav/files/${adminUser}/" - ) - content = client.succeed( - "curl -f -s -X GET" - + """ -H "Depth: 1" """ - + """ -u ${adminUser}:${adminPass} """ - + """ -H "Host: ${fqdn}" """ - + """ -T file """ - + " http://server/remote.php/dav/files/${adminUser}/file" - ) - if content != "hello\n": - raise Exception("Got incorrect content for file, expected 'hello\n' but got:\n{}".format(content)) - ''; + adminUser = adminUser; + adminPassFile = pkgs.writeText "adminPassFile" adminPass; + debug = true; + }; + # Nginx port. + networking.firewall.allowedTCPPorts = [ 80 443 ]; + + shb.nginx.accessLog = true; + }; + + nodes.client = {}; + + # TODO: Test login + testScript = commonTestScript; }; }