{ system ? builtins.currentSystem, config ? {}, pkgs ? import ../.. { inherit system config; } }: with import ../lib/testing-python.nix { inherit system pkgs; }; let mkSpec = { host, service ? null, action }: { inherit action; authority = { file = { group = "nginx"; owner = "nginx"; path = "/tmp/${host}-ca.pem"; }; label = "www_ca"; profile = "three-month"; remote = "localhost:8888"; }; certificate = { group = "nginx"; owner = "nginx"; path = "/tmp/${host}-cert.pem"; }; private_key = { group = "nginx"; mode = "0600"; owner = "nginx"; path = "/tmp/${host}-key.pem"; }; request = { CN = host; hosts = [ host "www.${host}" ]; key = { algo = "rsa"; size = 2048; }; names = [ { C = "US"; L = "San Francisco"; O = "Example, LLC"; ST = "CA"; } ]; }; inherit service; }; mkCertmgrTest = { svcManager, specs, testScript }: makeTest { name = "certmgr-" + svcManager; nodes = { machine = { config, lib, pkgs, ... }: { networking.firewall.allowedTCPPorts = with config.services; [ cfssl.port certmgr.metricsPort ]; networking.extraHosts = "127.0.0.1 imp.example.org decl.example.org"; services.cfssl.enable = true; systemd.services.cfssl.after = [ "cfssl-init.service" "networking.target" ]; systemd.services.cfssl-init = { description = "Initialize the cfssl CA"; wantedBy = [ "multi-user.target" ]; serviceConfig = { User = "cfssl"; Type = "oneshot"; WorkingDirectory = config.services.cfssl.dataDir; }; script = '' ${pkgs.cfssl}/bin/cfssl genkey -initca ${pkgs.writeText "ca.json" (builtins.toJSON { hosts = [ "ca.example.com" ]; key = { algo = "rsa"; size = 4096; }; names = [ { C = "US"; L = "San Francisco"; O = "Internet Widgets, LLC"; OU = "Certificate Authority"; ST = "California"; } ]; })} | ${pkgs.cfssl}/bin/cfssljson -bare ca ''; }; services.nginx = { enable = true; virtualHosts = lib.mkMerge (map (host: { ${host} = { sslCertificate = "/tmp/${host}-cert.pem"; sslCertificateKey = "/tmp/${host}-key.pem"; extraConfig = '' ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ''; onlySSL = true; serverName = host; root = pkgs.writeTextDir "index.html" "It works!"; }; }) [ "imp.example.org" "decl.example.org" ]); }; systemd.services.nginx.wantedBy = lib.mkForce []; systemd.services.certmgr.after = [ "cfssl.service" ]; services.certmgr = { enable = true; inherit svcManager; inherit specs; }; }; }; inherit testScript; }; in { systemd = mkCertmgrTest { svcManager = "systemd"; specs = { decl = mkSpec { host = "decl.example.org"; service = "nginx"; action ="restart"; }; imp = toString (pkgs.writeText "test.json" (builtins.toJSON ( mkSpec { host = "imp.example.org"; service = "nginx"; action = "restart"; } ))); }; testScript = '' machine.wait_for_unit("cfssl.service") machine.wait_until_succeeds("ls /tmp/decl.example.org-ca.pem") machine.wait_until_succeeds("ls /tmp/decl.example.org-key.pem") machine.wait_until_succeeds("ls /tmp/decl.example.org-cert.pem") machine.wait_until_succeeds("ls /tmp/imp.example.org-ca.pem") machine.wait_until_succeeds("ls /tmp/imp.example.org-key.pem") machine.wait_until_succeeds("ls /tmp/imp.example.org-cert.pem") machine.wait_for_unit("nginx.service") assert 1 < int(machine.succeed('journalctl -u nginx | grep "Starting Nginx" | wc -l')) machine.succeed("curl --cacert /tmp/imp.example.org-ca.pem https://imp.example.org") machine.succeed("curl --cacert /tmp/decl.example.org-ca.pem https://decl.example.org") ''; }; command = mkCertmgrTest { svcManager = "command"; specs = { test = mkSpec { host = "command.example.org"; action = "touch /tmp/command.executed"; }; }; testScript = '' machine.wait_for_unit("cfssl.service") machine.wait_until_succeeds("stat /tmp/command.executed") ''; }; }