92 lines
2.4 KiB
Nix
92 lines
2.4 KiB
Nix
import ./make-test-python.nix (
|
|
{ pkgs, lib, ... }:
|
|
let
|
|
caCert = builtins.readFile ./common/acme/server/ca.cert.pem;
|
|
certPath = ./common/acme/server/acme.test.cert.pem;
|
|
keyPath = ./common/acme/server/acme.test.key.pem;
|
|
hosts = ''
|
|
192.168.2.101 acme.test
|
|
'';
|
|
in
|
|
{
|
|
name = "rustls-libssl";
|
|
meta.maintainers = with pkgs.lib.maintainers; [
|
|
stephank
|
|
cpu
|
|
];
|
|
|
|
nodes = {
|
|
server =
|
|
{ lib, pkgs, ... }:
|
|
{
|
|
networking = {
|
|
interfaces.eth1 = {
|
|
ipv4.addresses = [
|
|
{
|
|
address = "192.168.2.101";
|
|
prefixLength = 24;
|
|
}
|
|
];
|
|
};
|
|
extraHosts = hosts;
|
|
firewall.allowedTCPPorts = [ 443 ];
|
|
};
|
|
|
|
security.pki.certificates = [ caCert ];
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
package = pkgs.nginxMainline.override {
|
|
openssl = pkgs.rustls-libssl;
|
|
modules = [ ]; # slightly reduces the size of the build
|
|
};
|
|
|
|
# Hardcoded sole input accepted by rustls-libssl.
|
|
sslCiphers = "HIGH:!aNULL:!MD5";
|
|
|
|
virtualHosts."acme.test" = {
|
|
onlySSL = true;
|
|
sslCertificate = certPath;
|
|
sslCertificateKey = keyPath;
|
|
http2 = true;
|
|
reuseport = true;
|
|
root = lib.mkForce (
|
|
pkgs.runCommandLocal "testdir" { } ''
|
|
mkdir "$out"
|
|
cat > "$out/index.html" <<EOF
|
|
<html><body>Hello World!</body></html>
|
|
EOF
|
|
''
|
|
);
|
|
};
|
|
};
|
|
};
|
|
|
|
client =
|
|
{ pkgs, ... }:
|
|
{
|
|
environment.systemPackages = [ pkgs.curlHTTP3 ];
|
|
networking = {
|
|
interfaces.eth1 = {
|
|
ipv4.addresses = [
|
|
{
|
|
address = "192.168.2.201";
|
|
prefixLength = 24;
|
|
}
|
|
];
|
|
};
|
|
extraHosts = hosts;
|
|
};
|
|
|
|
security.pki.certificates = [ caCert ];
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
server.wait_for_open_port(443)
|
|
client.succeed("curl --verbose --http1.1 https://acme.test | grep 'Hello World!'")
|
|
client.succeed("curl --verbose --http2-prior-knowledge https://acme.test | grep 'Hello World!'")
|
|
'';
|
|
}
|
|
)
|