depot/third_party/nixpkgs/nixos/tests/authelia.nix

# Test Authelia as an auth server for Traefik as a reverse proxy of a local web service
import ./make-test-python.nix (
  { lib, ... }:
  {
    name = "authelia";
    meta.maintainers = with lib.maintainers; [ jk ];

    nodes = {
      authelia =
        {
          config,
          pkgs,
          lib,
          ...
        }:
        {
          services.authelia.instances.testing = {
            enable = true;
            secrets.storageEncryptionKeyFile = "/etc/authelia/storageEncryptionKeyFile";
            secrets.jwtSecretFile = "/etc/authelia/jwtSecretFile";
            settings = {
              authentication_backend.file.path = "/etc/authelia/users_database.yml";
              access_control.default_policy = "one_factor";
              session.domain = "example.com";
              storage.local.path = "/tmp/db.sqlite3";
              notifier.filesystem.filename = "/tmp/notifications.txt";
            };
          };

          # These should not be set from nix but through other means to not leak the secret!
          # This is purely for testing purposes!
          environment.etc."authelia/storageEncryptionKeyFile" = {
            mode = "0400";
            user = "authelia-testing";
            text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
          };
          environment.etc."authelia/jwtSecretFile" = {
            mode = "0400";
            user = "authelia-testing";
            text = "a_very_important_secret";
          };
          environment.etc."authelia/users_database.yml" = {
            mode = "0400";
            user = "authelia-testing";
            text = ''
              users:
                bob:
                  disabled: false
                  displayname: bob
                  # password of password
                  password: $argon2id$v=19$m=65536,t=3,p=4$2ohUAfh9yetl+utr4tLcCQ$AsXx0VlwjvNnCsa70u4HKZvFkC8Gwajr2pHGKcND/xs
                  email: bob@jim.com
                  groups:
                    - admin
                    - dev
            '';
          };

          services.traefik = {
            enable = true;

            dynamicConfigOptions = {
              tls.certificates =
                let
                  certDir = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
                    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=example.com/CN=auth.example.com/CN=static.example.com' -days 36500
                    mkdir -p $out
                    cp key.pem cert.pem $out
                  '';
                in
                [
                  {
                    certFile = "${certDir}/cert.pem";
                    keyFile = "${certDir}/key.pem";
                  }
                ];
              http.middlewares.authelia.forwardAuth = {
                address = "http://localhost:9091/api/verify?rd=https%3A%2F%2Fauth.example.com%2F";
                trustForwardHeader = true;
                authResponseHeaders = [
                  "Remote-User"
                  "Remote-Groups"
                  "Remote-Email"
                  "Remote-Name"
                ];
              };
              http.middlewares.authelia-basic.forwardAuth = {
                address = "http://localhost:9091/api/verify?auth=basic";
                trustForwardHeader = true;
                authResponseHeaders = [
                  "Remote-User"
                  "Remote-Groups"
                  "Remote-Email"
                  "Remote-Name"
                ];
              };

              http.routers.simplehttp = {
                rule = "Host(`static.example.com`)";
                tls = true;
                entryPoints = "web";
                service = "simplehttp";
              };
              http.routers.simplehttp-basic-auth = {
                rule = "Host(`static-basic-auth.example.com`)";
                tls = true;
                entryPoints = "web";
                service = "simplehttp";
                middlewares = [ "authelia-basic@file" ];
              };

              http.services.simplehttp = {
                loadBalancer.servers = [
                  {
                    url = "http://localhost:8000";
                  }
                ];
              };

              http.routers.authelia = {
                rule = "Host(`auth.example.com`)";
                tls = true;
                entryPoints = "web";
                service = "authelia@file";
              };

              http.services.authelia = {
                loadBalancer.servers = [
                  {
                    url = "http://localhost:9091";
                  }
                ];
              };
            };

            staticConfigOptions = {
              global = {
                checkNewVersion = false;
                sendAnonymousUsage = false;
              };

              entryPoints.web.address = ":443";
            };
          };

          systemd.services.simplehttp =
            let
              fakeWebPageDir = pkgs.writeTextDir "index.html" "hello";
            in
            {
              script = "${pkgs.python3}/bin/python -m http.server --directory ${fakeWebPageDir} 8000";
              serviceConfig.Type = "simple";
              wantedBy = [ "multi-user.target" ];
            };
        };
    };

    testScript = ''
      start_all()

      authelia.wait_for_unit("simplehttp.service")
      authelia.wait_for_unit("traefik.service")
      authelia.wait_for_unit("authelia-testing.service")
      authelia.wait_for_open_port(443)
      authelia.wait_for_unit("multi-user.target")

      with subtest("Check for authelia"):
        # expect the login page
        assert "Login - Authelia", "could not reach authelia" in \
          authelia.succeed("curl --insecure -sSf -H Host:auth.example.com https://authelia:443/")

      with subtest("Check contacting basic http server via traefik with https works"):
        assert "hello", "could not reach raw static site" in \
          authelia.succeed("curl --insecure -sSf -H Host:static.example.com https://authelia:443/")

      with subtest("Test traefik and authelia"):
        with subtest("No details fail"):
          authelia.fail("curl --insecure -sSf -H Host:static-basic-auth.example.com https://authelia:443/")
        with subtest("Incorrect details fail"):
          authelia.fail("curl --insecure -sSf -u 'bob:wordpass' -H Host:static-basic-auth.example.com https://authelia:443/")
          authelia.fail("curl --insecure -sSf -u 'alice:password' -H Host:static-basic-auth.example.com https://authelia:443/")
        with subtest("Correct details pass"):
          assert "hello", "could not reach authed static site with valid credentials" in \
            authelia.succeed("curl --insecure -sSf -u 'bob:password' -H Host:static-basic-auth.example.com https://authelia:443/")
    '';
  }
)