138 lines
5.1 KiB
Nix
138 lines
5.1 KiB
Nix
import ./make-test-python.nix ({ pkgs, ...}:
|
|
|
|
let
|
|
adminPrivateKey = pkgs.writeText "id_ed25519" ''
|
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
|
QyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3gAAAJBJiYxDSYmM
|
|
QwAAAAtzc2gtZWQyNTUxOQAAACDu7qxYQAPdAU6RrhB3llk2N1v4PTwcVzcX1oX265uC3g
|
|
AAAEDE1W6vMwSEUcF1r7Hyypm/+sCOoDmKZgPxi3WOa1mD2u7urFhAA90BTpGuEHeWWTY3
|
|
W/g9PBxXNxfWhfbrm4LeAAAACGJmb0BtaW5pAQIDBAU=
|
|
-----END OPENSSH PRIVATE KEY-----
|
|
'';
|
|
|
|
adminPublicKey = ''
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7urFhAA90BTpGuEHeWWTY3W/g9PBxXNxfWhfbrm4Le root@client
|
|
'';
|
|
|
|
alicePrivateKey = pkgs.writeText "id_ed25519" ''
|
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
|
QyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQAAAJAwVQ5VMFUO
|
|
VQAAAAtzc2gtZWQyNTUxOQAAACBbeWvHh/AWGWI6EIc1xlSihyXtacNQ9KeztlW/VUy8wQ
|
|
AAAEB7lbfkkdkJoE+4TKHPdPQWBKLSx+J54Eg8DaTr+3KoSlt5a8eH8BYZYjoQhzXGVKKH
|
|
Je1pw1D0p7O2Vb9VTLzBAAAACGJmb0BtaW5pAQIDBAU=
|
|
-----END OPENSSH PRIVATE KEY-----
|
|
'';
|
|
|
|
alicePublicKey = pkgs.writeText "id_ed25519.pub" ''
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFt5a8eH8BYZYjoQhzXGVKKHJe1pw1D0p7O2Vb9VTLzB alice@client
|
|
'';
|
|
|
|
bobPrivateKey = pkgs.writeText "id_ed25519" ''
|
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
|
QyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMAAAAJDQBmNV0AZj
|
|
VQAAAAtzc2gtZWQyNTUxOQAAACCWTaJ1D9Xjxy6759FvQ9oXTes1lmWBciXPkEeqTikBMA
|
|
AAAEDM1IYYFUwk/IVxauha9kuR6bbRtT3gZ6ZA0GLb9txb/pZNonUP1ePHLrvn0W9D2hdN
|
|
6zWWZYFyJc+QR6pOKQEwAAAACGJmb0BtaW5pAQIDBAU=
|
|
-----END OPENSSH PRIVATE KEY-----
|
|
'';
|
|
|
|
bobPublicKey = pkgs.writeText "id_ed25519.pub" ''
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZNonUP1ePHLrvn0W9D2hdN6zWWZYFyJc+QR6pOKQEw bob@client
|
|
'';
|
|
|
|
gitoliteAdminConfSnippet = pkgs.writeText "gitolite-admin-conf-snippet" ''
|
|
repo alice-project
|
|
RW+ = alice
|
|
'';
|
|
in
|
|
{
|
|
name = "gitolite";
|
|
|
|
meta = with pkgs.lib.maintainers; {
|
|
maintainers = [ bjornfor ];
|
|
};
|
|
|
|
nodes = {
|
|
|
|
server =
|
|
{ ... }:
|
|
{
|
|
services.gitolite = {
|
|
enable = true;
|
|
adminPubkey = adminPublicKey;
|
|
};
|
|
services.openssh.enable = true;
|
|
};
|
|
|
|
client =
|
|
{ pkgs, ... }:
|
|
{
|
|
environment.systemPackages = [ pkgs.git ];
|
|
programs.ssh.extraConfig = ''
|
|
Host *
|
|
UserKnownHostsFile /dev/null
|
|
StrictHostKeyChecking no
|
|
# there's nobody around that can input password
|
|
PreferredAuthentications publickey
|
|
'';
|
|
users.users.alice = { isNormalUser = true; };
|
|
users.users.bob = { isNormalUser = true; };
|
|
};
|
|
|
|
};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
|
|
with subtest("can setup ssh keys on system"):
|
|
client.succeed(
|
|
"mkdir -p ~root/.ssh",
|
|
"cp ${adminPrivateKey} ~root/.ssh/id_ed25519",
|
|
"chmod 600 ~root/.ssh/id_ed25519",
|
|
)
|
|
client.succeed(
|
|
"sudo -u alice mkdir -p ~alice/.ssh",
|
|
"sudo -u alice cp ${alicePrivateKey} ~alice/.ssh/id_ed25519",
|
|
"sudo -u alice chmod 600 ~alice/.ssh/id_ed25519",
|
|
)
|
|
client.succeed(
|
|
"sudo -u bob mkdir -p ~bob/.ssh",
|
|
"sudo -u bob cp ${bobPrivateKey} ~bob/.ssh/id_ed25519",
|
|
"sudo -u bob chmod 600 ~bob/.ssh/id_ed25519",
|
|
)
|
|
|
|
with subtest("gitolite server starts"):
|
|
server.wait_for_unit("gitolite-init.service")
|
|
server.wait_for_unit("sshd.service")
|
|
client.succeed("ssh gitolite@server info")
|
|
|
|
with subtest("admin can clone and configure gitolite-admin.git"):
|
|
client.succeed(
|
|
"git clone gitolite@server:gitolite-admin.git",
|
|
"git config --global user.name 'System Administrator'",
|
|
"git config --global user.email root\@domain.example",
|
|
"cp ${alicePublicKey} gitolite-admin/keydir/alice.pub",
|
|
"cp ${bobPublicKey} gitolite-admin/keydir/bob.pub",
|
|
"(cd gitolite-admin && git add . && git commit -m 'Add keys for alice, bob' && git push)",
|
|
"cat ${gitoliteAdminConfSnippet} >> gitolite-admin/conf/gitolite.conf",
|
|
"(cd gitolite-admin && git add . && git commit -m 'Add repo for alice' && git push)",
|
|
)
|
|
|
|
with subtest("non-admins cannot clone gitolite-admin.git"):
|
|
client.fail("sudo -i -u alice git clone gitolite@server:gitolite-admin.git")
|
|
client.fail("sudo -i -u bob git clone gitolite@server:gitolite-admin.git")
|
|
|
|
with subtest("non-admins can clone testing.git"):
|
|
client.succeed("sudo -i -u alice git clone gitolite@server:testing.git")
|
|
client.succeed("sudo -i -u bob git clone gitolite@server:testing.git")
|
|
|
|
with subtest("alice can clone alice-project.git"):
|
|
client.succeed("sudo -i -u alice git clone gitolite@server:alice-project.git")
|
|
|
|
with subtest("bob cannot clone alice-project.git"):
|
|
client.fail("sudo -i -u bob git clone gitolite@server:alice-project.git")
|
|
'';
|
|
})
|