about summary refs log tree commit diff
path: root/nixos/tests/ec2.nix
blob: df06724801684125bfdd7738f1a4c1f8a1d47dd4 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
{ system ? builtins.currentSystem,
  config ? {},
  pkgs ? import ../.. { inherit system config; }
}:

with import ../lib/testing-python.nix { inherit system pkgs; };
with pkgs.lib;

with import common/ec2.nix { inherit makeTest pkgs; };

let
  imageCfg = (import ../lib/eval-config.nix {
    inherit system;
    modules = [
      ../maintainers/scripts/ec2/amazon-image.nix
      ../modules/testing/test-instrumentation.nix
      ../modules/profiles/qemu-guest.nix
      {
        ec2.hvm = true;

        # Hack to make the partition resizing work in QEMU.
        boot.initrd.postDeviceCommands = mkBefore ''
          ln -s vda /dev/xvda
          ln -s vda1 /dev/xvda1
        '';

        # Needed by nixos-rebuild due to the lack of network
        # access. Determined by trial and error.
        system.extraDependencies = with pkgs; ( [
          # Needed for a nixos-rebuild.
          busybox
          cloud-utils
          desktop-file-utils
          libxslt.bin
          mkinitcpio-nfs-utils
          stdenv
          stdenvNoCC
          texinfo
          unionfs-fuse
          xorg.lndir

          # These are used in the configure-from-userdata tests
          # for EC2. Httpd and valgrind are requested by the
          # configuration.
          apacheHttpd
          apacheHttpd.doc
          apacheHttpd.man
          valgrind.doc
        ]);
      }
    ];
  }).config;
  image = "${imageCfg.system.build.amazonImage}/${imageCfg.amazonImage.name}.vhd";

  sshKeys = import ./ssh-keys.nix pkgs;
  snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text;
  snakeOilPrivateKeyFile = pkgs.writeText "private-key" snakeOilPrivateKey;
  snakeOilPublicKey = sshKeys.snakeOilPublicKey;

in {
  boot-ec2-nixops = makeEc2Test {
    name         = "nixops-userdata";
    inherit image;
    sshPublicKey = snakeOilPublicKey; # That's right folks! My user's key is also the host key!

    userData = ''
      SSH_HOST_ED25519_KEY_PUB:${snakeOilPublicKey}
      SSH_HOST_ED25519_KEY:${replaceStrings ["\n"] ["|"] snakeOilPrivateKey}
    '';
    script = ''
      machine.start()
      machine.wait_for_file("/etc/ec2-metadata/user-data")
      machine.wait_for_unit("sshd.service")

      machine.succeed("grep unknown /etc/ec2-metadata/ami-manifest-path")

      # We have no keys configured on the client side yet, so this should fail
      machine.fail("ssh -o BatchMode=yes localhost exit")

      # Let's install our client private key
      machine.succeed("mkdir -p ~/.ssh")

      machine.copy_from_host_via_shell(
          "${snakeOilPrivateKeyFile}", "~/.ssh/id_ed25519"
      )
      machine.succeed("chmod 600 ~/.ssh/id_ed25519")

      # We haven't configured the host key yet, so this should still fail
      machine.fail("ssh -o BatchMode=yes localhost exit")

      # Add the host key; ssh should finally succeed
      machine.succeed(
          "echo localhost,127.0.0.1 ${snakeOilPublicKey} > ~/.ssh/known_hosts"
      )
      machine.succeed("ssh -o BatchMode=yes localhost exit")

      # Test whether the root disk was resized.
      blocks, block_size = map(int, machine.succeed("stat -c %b:%S -f /").split(":"))
      GB = 1024 ** 3
      assert 9.7 * GB <= blocks * block_size <= 10 * GB

      # Just to make sure resizing is idempotent.
      machine.shutdown()
      machine.start()
      machine.wait_for_file("/etc/ec2-metadata/user-data")
    '';
  };

  boot-ec2-config = makeEc2Test {
    name         = "config-userdata";
    meta.broken = true; # amazon-init wants to download from the internet while building the system
    inherit image;
    sshPublicKey = snakeOilPublicKey;

    # ### https://nixos.org/channels/nixos-unstable nixos
    userData = ''
      { pkgs, ... }:

      {
        imports = [
          <nixpkgs/nixos/modules/virtualisation/amazon-image.nix>
          <nixpkgs/nixos/modules/testing/test-instrumentation.nix>
          <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
        ];
        environment.etc.testFile = {
          text = "whoa";
        };

        networking.hostName = "ec2-test-vm"; # required by services.httpd

        services.httpd = {
          enable = true;
          adminAddr = "test@example.org";
          virtualHosts.localhost.documentRoot = "''${pkgs.valgrind.doc}/share/doc/valgrind/html";
        };
        networking.firewall.allowedTCPPorts = [ 80 ];
      }
    '';
    script = ''
      machine.start()

      # amazon-init must succeed. if it fails, make the test fail
      # immediately instead of timing out in wait_for_file.
      machine.wait_for_unit("amazon-init.service")

      machine.wait_for_file("/etc/testFile")
      assert "whoa" in machine.succeed("cat /etc/testFile")

      machine.wait_for_unit("httpd.service")
      assert "Valgrind" in machine.succeed("curl http://localhost")
    '';
  };
}