Merge branch 'scintill/nixos-mailserver-fix-tests'

.gitlab-ci.yml

@@ -1,41 +1,47 @@
+before_script:
+  # report CPU info so we can monitor if real KVM becomes available. create /dev/kvm to fool nix
+  - cat /proc/cpuinfo
+  - ls -l /dev/kvm || true
+  - touch /dev/kvm
+
 nixos-intern:
   image: nixos/nix
   variables:
     NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz"
   script:
-    - nix-build tests/intern.nix
+    - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/intern.nix
 
 nixos-extern:
   image: nixos/nix
   variables:
     NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz"
   script:
-    - nix-build tests/extern.nix
+    - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/extern.nix
 
 nixos-clamav:
   image: nixos/nix
   variables:
     NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz"
   script:
-    - nix-build tests/clamav.nix
+    - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/clamav.nix
 
 nixos-unstable-intern:
   image: nixos/nix
   variables:
     NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz"
   script:
-    - nix-build tests/intern.nix
+    - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/intern.nix
 
 nixos-unstable-extern:
   image: nixos/nix
   variables:
     NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz"
   script:
-    - nix-build tests/extern.nix
+    - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/extern.nix
 
 nixos-unstable-clamav:
   image: nixos/nix
   variables:
     NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz"
   script:
-    - nix-build tests/clamav.nix
+    - nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/clamav.nix

mail-server/opendkim.nix

@@ -40,16 +40,6 @@ let
           fi
         '';
   createAllCerts = lib.concatStringsSep "\n" (map createDomainDkimCert cfg.domains);
-  create_dkim_cert =
-        ''
-          # Create dkim dir
-          mkdir -p "${cfg.dkimKeyDirectory}"
-          chown ${dkimUser}:${dkimGroup} "${cfg.dkimKeyDirectory}"
-
-          ${createAllCerts}
-
-          chown -R ${dkimUser}:${dkimGroup} "${cfg.dkimKeyDirectory}"
-        '';
 
   keyTable = pkgs.writeText "opendkim-KeyTable" 
     (lib.concatStringsSep "\n" (lib.flip map cfg.domains 
@@ -80,11 +70,17 @@ in
       };
 
       users.users = optionalAttrs (config.services.postfix.user == "postfix") {
-        postfix.extraGroups = [ "${config.services.opendkim.group}" ];
+        postfix.extraGroups = [ "${dkimGroup}" ];
       };
       systemd.services.opendkim = {
-        preStart = create_dkim_cert;
+        preStart = lib.mkForce createAllCerts;
-        serviceConfig.ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
+        serviceConfig = {
+          ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
+          PermissionsStartOnly = lib.mkForce false;
+        };
       };
+      systemd.tmpfiles.rules = [
+        "d '${cfg.dkimKeyDirectory}' - ${dkimUser} ${dkimGroup} - -"
+      ];
     };
-}
+}

mail-server/rspamd.nix

@@ -27,19 +27,22 @@ in
   config = with cfg; lib.mkIf enable {
     services.rspamd = {
       enable = true;
-      extraConfig = ''
+      inherit debug;
-        extended_spam_headers = yes;
+      locals = {
-      '' + (lib.optionalString cfg.virusScanning ''
+          "milter_headers.conf" = { text = ''
-        antivirus {
+              extended_spam_headers = yes;
-          clamav {
+          ''; };
-            action = "reject";
+          "antivirus.conf" = lib.mkIf cfg.virusScanning { text = ''
-            symbol = "CLAM_VIRUS";
+              clamav {
-            type = "clamav";
+                action = "reject";
-            log_clean = true;
+                symbol = "CLAM_VIRUS";
-            servers = "/run/clamav/clamd.ctl";
+                type = "clamav";
-          }
+                log_clean = true;
-        }
+                servers = "/run/clamav/clamd.ctl";
-      '');
+                scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all
+              }
+          ''; };
+      };
 
       overrides = {
         "milter_headers.conf" = {

tests/clamav.nix

@@ -34,6 +34,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
         {
             imports = [
                 ../default.nix
+                ./lib/config.nix
             ];
 
             virtualisation.memorySize = 1500;
@@ -103,6 +104,10 @@ import <nixpkgs/nixos/tests/make-test.nix> {
           exec grep '${clientIP}' "$@"
         '';
       in {
+        imports = [
+            ./lib/config.nix
+        ];
+
         environment.systemPackages = with pkgs; [
           fetchmail msmtp procmail findutils grep-ip
         ];
@@ -120,10 +125,15 @@ import <nixpkgs/nixos/tests/make-test.nix> {
           };
           "root/.msmtprc" = {
             text = ''
-              account        test2
+              defaults
+              tls            on
+              tls_certcheck  off
+
+              account        user2
               host           ${serverIP}
               port           587
               from           user@example2.com
+              auth           on
               user           user@example2.com
               password       user2
             '';
@@ -164,7 +174,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
             X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
             --Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607--
           '';
-          "root/email2".text = ''
+          "root/safe-email".text = ''
             From: User <user@example2.com>
             To: User1 <user1@example.com>
             Cc:
@@ -182,13 +192,17 @@ import <nixpkgs/nixos/tests/make-test.nix> {
       };
     };
 
-  testScript =
+  testScript = { nodes, ... }:
       ''
       startAll;
 
       $server->waitForUnit("multi-user.target");
       $client->waitForUnit("multi-user.target");
 
+      # TODO put this blocking into the systemd units? I am not sure if rspamd already waits for the clamd socket.
+      $server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
+      $server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ \$? -eq 124 ]");
+
       $client->execute("cp -p /etc/root/.* ~/");
       $client->succeed("mkdir -p ~/mail");
       $client->succeed("ls -la ~/ >&2");
@@ -201,7 +215,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
 
       # Verify that mail can be sent and received before testing virus scanner
       $client->execute("rm ~/mail/*");
-      $client->succeed("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email2 >&2");
+      $client->succeed("msmtp -a user2 user1\@example.com < /etc/root/safe-email >&2");
       # give the mail server some time to process the mail
       $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
       $client->execute("rm ~/mail/*");
@@ -209,13 +223,12 @@ import <nixpkgs/nixos/tests/make-test.nix> {
       $client->succeed("fetchmail -v >&2");
       $client->execute("rm ~/mail/*");
 
-
       subtest "virus scan file", sub {
-        $server->fail("clamscan --follow-file-symlinks=2 -r /etc/root/ >&2");
+          $server->succeed("clamdscan \$(readlink -f /etc/root/eicar.com.txt) | grep \"Txt\\.Malware\\.Agent-1787597 FOUND\" >&2");
       };
 
-      subtest "virus scanner", sub {
+      subtest "virus scan email", sub {
-          $client->fail("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/virus-email >&2");
+          $client->succeed("msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | grep \"server message: 554 5\\.7\\.1 clamav: virus found: .*\\(Eicar\\|EICAR\\)\" >&2"); # for some reason this ID is nondetermistic...
           # give the mail server some time to process the mail
           $server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
       };

tests/extern.nix

@@ -21,6 +21,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
         {
             imports = [
                 ../default.nix
+                ./lib/config.nix
             ];
 
             services.rsyslogd = {
@@ -134,6 +135,9 @@ import <nixpkgs/nixos/tests/make-test.nix> {
             imap.close()
         '';
       in {
+        imports = [
+            ./lib/config.nix
+        ];
         environment.systemPackages = with pkgs; [
           fetchmail msmtp procmail findutils grep-ip check-mail-id test-imap-spam test-imap-ham
         ];
@@ -271,13 +275,16 @@ import <nixpkgs/nixos/tests/make-test.nix> {
       };
     };
 
-  testScript =
+  testScript = { nodes, ... }:
       ''
       startAll;
 
       $server->waitForUnit("multi-user.target");
       $client->waitForUnit("multi-user.target");
 
+      # TODO put this blocking into the systemd units?
+      $server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
+
       $client->execute("cp -p /etc/root/.* ~/");
       $client->succeed("mkdir -p ~/mail");
       $client->succeed("ls -la ~/ >&2");

tests/intern.nix

@@ -21,6 +21,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
     {
         imports = [
             ./../default.nix
+            ./lib/config.nix
         ];
 
         mailserver = {

tests/lib/config.nix

@@ -0,0 +1,11 @@
+{
+    security.dhparams.defaultBitSize = 16; # really low for quicker tests
+
+    # For slow non-kvm tests.
+    # nixos/modules/testing/test-instrumentation.nix also sets this. I don't know if there's a better way than etc to override theirs.
+    environment.etc."systemd/system.conf.d/bigdefaulttimeout.conf".text = ''
+      [Manager]
+      # Allow extremely slow start (default for test-VMs is 5 minutes)
+      DefaultTimeoutStartSec=15min
+    '';
+}

tests/lib/pkgs.nokvm.nix

@@ -0,0 +1,31 @@
+let
+    pkgs = (import <nixpkgs> { system = builtins.currentSystem; config = {}; });
+    patchedMachinePM = pkgs.writeTextFile {
+        name = "Machine.pm.patched-to-wait-longer-for-vm";
+        text = builtins.replaceStrings ["alarm 600;"] ["alarm 1200;"] (builtins.readFile (<nixpkgs>+"/nixos/lib/test-driver/Machine.pm"));
+    };
+in
+(pkgs // {
+    qemu_test = with pkgs; stdenv.mkDerivation {
+        name = "qemu_test_no_kvm";
+        buildInputs = [ coreutils qemu_test ];
+        inherit qemu_test;
+        inherit coreutils;
+        builder = builtins.toFile "builder.sh" ''
+            PATH=$coreutils/bin:$PATH
+            mkdir -p $out/bin
+            cp $qemu_test/bin/* $out/bin/
+            ln -sf $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
+        '';
+    };
+    stdenv = pkgs.stdenv // {
+        mkDerivation = args: (pkgs.stdenv.mkDerivation (args // (
+            pkgs.lib.optionalAttrs (args.name == "nixos-test-driver") {
+                installPhase = args.installPhase + ''
+                    rm $libDir/Machine.pm
+                    cp ${patchedMachinePM} $libDir/Machine.pm
+                '';
+            }
+        )));
+    };
+})