142 lines
4.5 KiB
Nix
142 lines
4.5 KiB
Nix
|
{ system ? builtins.currentSystem
|
||
|
, config ? { }
|
||
|
, pkgs ? import ../.. { inherit system config; }
|
||
|
, package ? null
|
||
|
}:
|
||
|
|
||
|
with import ../lib/testing-python.nix { inherit system pkgs; };
|
||
|
|
||
|
let
|
||
|
lib = pkgs.lib;
|
||
|
|
||
|
# Makes a test for a PostgreSQL package, given by name and looked up from `pkgs`.
|
||
|
makeTestAttribute = name:
|
||
|
{
|
||
|
inherit name;
|
||
|
value = makePostgresqlTlsClientCertTest pkgs."${name}";
|
||
|
};
|
||
|
|
||
|
makePostgresqlTlsClientCertTest = pkg:
|
||
|
let
|
||
|
runWithOpenSSL = file: cmd: pkgs.runCommand file
|
||
|
{
|
||
|
buildInputs = [ pkgs.openssl ];
|
||
|
}
|
||
|
cmd;
|
||
|
caKey = runWithOpenSSL "ca.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
|
||
|
caCert = runWithOpenSSL
|
||
|
"ca.crt"
|
||
|
''
|
||
|
openssl req -new -x509 -sha256 -key ${caKey} -out $out -subj "/CN=test.example" -days 36500
|
||
|
'';
|
||
|
serverKey =
|
||
|
runWithOpenSSL "server.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
|
||
|
serverKeyPath = "/var/lib/postgresql";
|
||
|
serverCert =
|
||
|
runWithOpenSSL "server.crt" ''
|
||
|
openssl req -new -sha256 -key ${serverKey} -out server.csr -subj "/CN=db.test.example"
|
||
|
openssl x509 -req -in server.csr -CA ${caCert} -CAkey ${caKey} \
|
||
|
-CAcreateserial -out $out -days 36500 -sha256
|
||
|
'';
|
||
|
clientKey =
|
||
|
runWithOpenSSL "client.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
|
||
|
clientCert =
|
||
|
runWithOpenSSL "client.crt" ''
|
||
|
openssl req -new -sha256 -key ${clientKey} -out client.csr -subj "/CN=test"
|
||
|
openssl x509 -req -in client.csr -CA ${caCert} -CAkey ${caKey} \
|
||
|
-CAcreateserial -out $out -days 36500 -sha256
|
||
|
'';
|
||
|
clientKeyPath = "/root";
|
||
|
|
||
|
in
|
||
|
makeTest {
|
||
|
name = "postgresql-tls-client-cert-${pkg.name}";
|
||
|
meta.maintainers = with lib.maintainers; [ erictapen ];
|
||
|
|
||
|
nodes.server = { ... }: {
|
||
|
system.activationScripts = {
|
||
|
keyPlacement.text = ''
|
||
|
mkdir -p '${serverKeyPath}'
|
||
|
cp '${serverKey}' '${serverKeyPath}/server.key'
|
||
|
chown postgres:postgres '${serverKeyPath}/server.key'
|
||
|
chmod 600 '${serverKeyPath}/server.key'
|
||
|
'';
|
||
|
};
|
||
|
services.postgresql = {
|
||
|
package = pkg;
|
||
|
enable = true;
|
||
|
enableTCPIP = true;
|
||
|
ensureUsers = [
|
||
|
{
|
||
|
name = "test";
|
||
|
ensureDBOwnership = true;
|
||
|
}
|
||
|
];
|
||
|
ensureDatabases = [ "test" ];
|
||
|
settings = {
|
||
|
ssl = "on";
|
||
|
ssl_ca_file = toString caCert;
|
||
|
ssl_cert_file = toString serverCert;
|
||
|
ssl_key_file = "${serverKeyPath}/server.key";
|
||
|
};
|
||
|
authentication = ''
|
||
|
hostssl test test ::/0 cert clientcert=verify-full
|
||
|
'';
|
||
|
};
|
||
|
networking = {
|
||
|
interfaces.eth1 = {
|
||
|
ipv6.addresses = [
|
||
|
{ address = "fc00::1"; prefixLength = 120; }
|
||
|
];
|
||
|
};
|
||
|
firewall.allowedTCPPorts = [ 5432 ];
|
||
|
};
|
||
|
};
|
||
|
|
||
|
nodes.client = { ... }: {
|
||
|
system.activationScripts = {
|
||
|
keyPlacement.text = ''
|
||
|
mkdir -p '${clientKeyPath}'
|
||
|
cp '${clientKey}' '${clientKeyPath}/client.key'
|
||
|
chown root:root '${clientKeyPath}/client.key'
|
||
|
chmod 600 '${clientKeyPath}/client.key'
|
||
|
'';
|
||
|
};
|
||
|
environment = {
|
||
|
variables = {
|
||
|
PGHOST = "db.test.example";
|
||
|
PGPORT = "5432";
|
||
|
PGDATABASE = "test";
|
||
|
PGUSER = "test";
|
||
|
PGSSLMODE = "verify-full";
|
||
|
PGSSLCERT = clientCert;
|
||
|
PGSSLKEY = "${clientKeyPath}/client.key";
|
||
|
PGSSLROOTCERT = caCert;
|
||
|
};
|
||
|
systemPackages = [ pkg ];
|
||
|
};
|
||
|
networking = {
|
||
|
interfaces.eth1 = {
|
||
|
ipv6.addresses = [
|
||
|
{ address = "fc00::2"; prefixLength = 120; }
|
||
|
];
|
||
|
};
|
||
|
hosts = { "fc00::1" = [ "db.test.example" ]; };
|
||
|
};
|
||
|
};
|
||
|
|
||
|
testScript = ''
|
||
|
server.wait_for_unit("multi-user.target")
|
||
|
client.wait_for_unit("multi-user.target")
|
||
|
client.succeed("psql -c \"SELECT 1;\"")
|
||
|
'';
|
||
|
};
|
||
|
|
||
|
in
|
||
|
if package == null then
|
||
|
# all-tests.nix: Maps the generic function over all attributes of PostgreSQL packages
|
||
|
builtins.listToAttrs (map makeTestAttribute (builtins.attrNames (import ../../pkgs/servers/sql/postgresql pkgs)))
|
||
|
else
|
||
|
# Called directly from <package>.tests
|
||
|
makePostgresqlTlsClientCertTest package
|