about summary refs log tree commit diff
path: root/nixos/tests/radicale.nix
blob: 66650dce4a008a2afad2decee3982b383ed41866 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
import ./make-test-python.nix ({ lib, pkgs, ... }:

let
  user = "someuser";
  password = "some_password";
  port = "5232";
  filesystem_folder = "/data/radicale";

  cli = "${pkgs.calendar-cli}/bin/calendar-cli --caldav-user ${user} --caldav-pass ${password}";
in {
  name = "radicale3";
  meta.maintainers = with lib.maintainers; [ dotlambda ];

  nodes.machine = { pkgs, ... }: {
    services.radicale = {
      enable = true;
      settings = {
        auth = {
          type = "htpasswd";
          htpasswd_filename = "/etc/radicale/users";
          htpasswd_encryption = "bcrypt";
        };
        storage = {
          inherit filesystem_folder;
          hook = "git add -A && (git diff --cached --quiet || git commit -m 'Changes by '%(user)s)";
        };
        logging.level = "info";
      };
      rights = {
        principal = {
          user = ".+";
          collection = "{user}";
          permissions = "RW";
        };
        calendars = {
          user = ".+";
          collection = "{user}/[^/]+";
          permissions = "rw";
        };
      };
    };
    systemd.services.radicale.path = [ pkgs.git ];
    environment.systemPackages = [ pkgs.git ];
    systemd.tmpfiles.rules = [ "d ${filesystem_folder} 0750 radicale radicale -" ];
    # WARNING: DON'T DO THIS IN PRODUCTION!
    # This puts unhashed secrets directly into the Nix store for ease of testing.
    environment.etc."radicale/users".source = pkgs.runCommand "htpasswd" {} ''
      ${pkgs.apacheHttpd}/bin/htpasswd -bcB "$out" ${user} ${password}
    '';
  };
  testScript = ''
    machine.wait_for_unit("radicale.service")
    machine.wait_for_open_port(${port})

    machine.succeed("sudo -u radicale git -C ${filesystem_folder} init")
    machine.succeed(
        "sudo -u radicale git -C ${filesystem_folder} config --local user.email radicale@example.com"
    )
    machine.succeed(
        "sudo -u radicale git -C ${filesystem_folder} config --local user.name radicale"
    )

    with subtest("Test calendar and event creation"):
        machine.succeed(
            "${cli} --caldav-url http://localhost:${port}/${user} calendar create cal"
        )
        machine.succeed("test -d ${filesystem_folder}/collection-root/${user}/cal")
        machine.succeed('test -z "$(ls ${filesystem_folder}/collection-root/${user}/cal)"')
        machine.succeed(
            "${cli} --caldav-url http://localhost:${port}/${user}/cal calendar add 2021-04-23 testevent"
        )
        machine.succeed('test -n "$(ls ${filesystem_folder}/collection-root/${user}/cal)"')
        (status, stdout) = machine.execute(
            "sudo -u radicale git -C ${filesystem_folder} log --format=oneline | wc -l"
        )
        assert status == 0, "git log failed"
        assert stdout == "3\n", "there should be exactly 3 commits"

    with subtest("Test rights file"):
        machine.fail(
            "${cli} --caldav-url http://localhost:${port}/${user} calendar create sub/cal"
        )
        machine.fail(
            "${cli} --caldav-url http://localhost:${port}/otheruser calendar create cal"
        )

    with subtest("Test web interface"):
        machine.succeed("curl --fail http://${user}:${password}@localhost:${port}/.web/")

    with subtest("Test security"):
        output = machine.succeed("systemd-analyze security radicale.service")
        machine.log(output)
        assert output[-9:-1] == "SAFE :-}"
  '';
})