depot/nixos/tests/rosenpass.nix

import ./make-test-python.nix (
  { pkgs, ... }:
  let
    deviceName = "rp0";

    server = {
      ip = "fe80::1";
      wg = {
        public = "mQufmDFeQQuU/fIaB2hHgluhjjm1ypK4hJr1cW3WqAw=";
        secret = "4N5Y1dldqrpsbaEiY8O0XBUGUFf8vkvtBtm8AoOX7Eo=";
        listen = 10000;
      };
    };
    client = {
      ip = "fe80::2";
      wg = {
        public = "Mb3GOlT7oS+F3JntVKiaD7SpHxLxNdtEmWz/9FMnRFU=";
        secret = "uC5dfGMv7Oxf5UDfdPkj6rZiRZT2dRWp5x8IQxrNcUE=";
      };
    };
  in
  {
    name = "rosenpass";

    nodes =
      let
        shared =
          peer:
          { config, modulesPath, ... }:
          {
            imports = [ "${modulesPath}/services/networking/rosenpass.nix" ];

            boot.kernelModules = [ "wireguard" ];

            services.rosenpass = {
              enable = true;
              defaultDevice = deviceName;
              settings = {
                verbosity = "Verbose";
                public_key = "/etc/rosenpass/pqpk";
                secret_key = "/etc/rosenpass/pqsk";
              };
            };

            networking.firewall.allowedUDPPorts = [ 9999 ];

            systemd.network = {
              enable = true;
              networks."rosenpass" = {
                matchConfig.Name = deviceName;
                networkConfig.IPv4Forwarding = true;
                networkConfig.IPv6Forwarding = true;
                address = [ "${peer.ip}/64" ];
              };

              netdevs."10-rp0" = {
                netdevConfig = {
                  Kind = "wireguard";
                  Name = deviceName;
                };
                wireguardConfig.PrivateKeyFile = "/etc/wireguard/wgsk";
              };
            };

            environment.etc."wireguard/wgsk" = {
              text = peer.wg.secret;
              user = "systemd-network";
              group = "systemd-network";
            };
          };
      in
      {
        server = {
          imports = [ (shared server) ];

          networking.firewall.allowedUDPPorts = [ server.wg.listen ];

          systemd.network.netdevs."10-${deviceName}" = {
            wireguardConfig.ListenPort = server.wg.listen;
            wireguardPeers = [
              {
                AllowedIPs = [ "::/0" ];
                PublicKey = client.wg.public;
              }
            ];
          };

          services.rosenpass.settings = {
            listen = [ "0.0.0.0:9999" ];
            peers = [
              {
                public_key = "/etc/rosenpass/peers/client/pqpk";
                peer = client.wg.public;
              }
            ];
          };
        };
        client = {
          imports = [ (shared client) ];

          systemd.network.netdevs."10-${deviceName}".wireguardPeers = [
            {
              AllowedIPs = [ "::/0" ];
              PublicKey = server.wg.public;
              Endpoint = "server:${builtins.toString server.wg.listen}";
            }
          ];

          services.rosenpass.settings.peers = [
            {
              public_key = "/etc/rosenpass/peers/server/pqpk";
              endpoint = "server:9999";
              peer = server.wg.public;
            }
          ];
        };
      };

    testScript =
      { ... }:
      ''
        from os import system

        # Full path to rosenpass in the store, to avoid fiddling with `$PATH`.
        rosenpass = "${pkgs.rosenpass}/bin/rosenpass"

        # Path in `/etc` where keys will be placed.
        etc = "/etc/rosenpass"

        start_all()

        for machine in [server, client]:
            machine.wait_for_unit("multi-user.target")

        # Gently stop Rosenpass to avoid crashes during key generation/distribution.
        for machine in [server, client]:
            machine.execute("systemctl stop rosenpass.service")

        for (name, machine, remote) in [("server", server, client), ("client", client, server)]:
            pk, sk = f"{name}.pqpk", f"{name}.pqsk"
            system(f"{rosenpass} gen-keys --force --secret-key {sk} --public-key {pk}")
            machine.copy_from_host(sk, f"{etc}/pqsk")
            machine.copy_from_host(pk, f"{etc}/pqpk")
            remote.copy_from_host(pk, f"{etc}/peers/{name}/pqpk")

        for machine in [server, client]:
            machine.execute("systemctl start rosenpass.service")

        for machine in [server, client]:
            machine.wait_for_unit("rosenpass.service")

        with subtest("ping"):
            client.succeed("ping -c 2 -i 0.5 ${server.ip}%${deviceName}")

        with subtest("preshared-keys"):
            # Rosenpass works by setting the WireGuard preshared key at regular intervals.
            # Thus, if it is not active, then no key will be set, and the output of `wg show` will contain "none".
            # Otherwise, if it is active, then the key will be set and "none" will not be found in the output of `wg show`.
            for machine in [server, client]:
                machine.wait_until_succeeds("wg show all preshared-keys | grep --invert-match none", timeout=5)
      '';

    # NOTE: Below configuration is for "interactive" (=developing/debugging) only.
    interactive.nodes =
      let
        inherit (import ./ssh-keys.nix pkgs) snakeOilPublicKey snakeOilPrivateKey;

        sshAndKeyGeneration = {
          services.openssh.enable = true;
          users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
          environment.systemPackages = [
            (pkgs.writeShellApplication {
              name = "gen-keys";
              runtimeInputs = [ pkgs.rosenpass ];
              text = ''
                HOST="$(hostname)"
                if [ "$HOST" == "server" ]
                then
                  PEER="client"
                else
                  PEER="server"
                fi

                # Generate keypair.
                mkdir -vp /etc/rosenpass/peers/$PEER
                rosenpass gen-keys --force --secret-key /etc/rosenpass/pqsk --public-key /etc/rosenpass/pqpk

                # Set up SSH key.
                mkdir -p /root/.ssh
                cp ${snakeOilPrivateKey} /root/.ssh/id_ecdsa
                chmod 0400 /root/.ssh/id_ecdsa

                # Copy public key to other peer.
                # shellcheck disable=SC2029
                ssh -o StrictHostKeyChecking=no $PEER "mkdir -pv /etc/rosenpass/peers/$HOST"
                scp /etc/rosenpass/pqpk "$PEER:/etc/rosenpass/peers/$HOST/pqpk"
              '';
            })
          ];
        };

        # Use kmscon <https://www.freedesktop.org/wiki/Software/kmscon/>
        # to provide a slightly nicer console, and while we're at it,
        # also use a nice font.
        # With kmscon, we can for example zoom in/out using [Ctrl] + [+]
        # and [Ctrl] + [-]
        niceConsoleAndAutologin.services.kmscon = {
          enable = true;
          autologinUser = "root";
          fonts = [
            {
              name = "Fira Code";
              package = pkgs.fira-code;
            }
          ];
        };
      in
      {
        server = sshAndKeyGeneration // niceConsoleAndAutologin;
        client = sshAndKeyGeneration // niceConsoleAndAutologin;
      };
  }
)