Merge branch 'scintill/nixos-mailserver-fix-tests'
This commit is contained in:
Robin Raymond
commit
0bf2bb0b54
|
|
@ -1,41 +1,47 @@
|
|||
before_script:
|
||||
# report CPU info so we can monitor if real KVM becomes available. create /dev/kvm to fool nix
|
||||
- cat /proc/cpuinfo
|
||||
- ls -l /dev/kvm || true
|
||||
- touch /dev/kvm
|
||||
|
||||
nixos-intern:
|
||||
image: nixos/nix
|
||||
variables:
|
||||
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz"
|
||||
script:
|
||||
- nix-build tests/intern.nix
|
||||
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/intern.nix
|
||||
|
||||
nixos-extern:
|
||||
image: nixos/nix
|
||||
variables:
|
||||
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz"
|
||||
script:
|
||||
- nix-build tests/extern.nix
|
||||
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/extern.nix
|
||||
|
||||
nixos-clamav:
|
||||
image: nixos/nix
|
||||
variables:
|
||||
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz"
|
||||
script:
|
||||
- nix-build tests/clamav.nix
|
||||
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/clamav.nix
|
||||
|
||||
nixos-unstable-intern:
|
||||
image: nixos/nix
|
||||
variables:
|
||||
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz"
|
||||
script:
|
||||
- nix-build tests/intern.nix
|
||||
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/intern.nix
|
||||
|
||||
nixos-unstable-extern:
|
||||
image: nixos/nix
|
||||
variables:
|
||||
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz"
|
||||
script:
|
||||
- nix-build tests/extern.nix
|
||||
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/extern.nix
|
||||
|
||||
nixos-unstable-clamav:
|
||||
image: nixos/nix
|
||||
variables:
|
||||
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz"
|
||||
script:
|
||||
- nix-build tests/clamav.nix
|
||||
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/clamav.nix
|
||||
|
|
|
|||
|
|
@ -40,16 +40,6 @@ let
|
|||
fi
|
||||
'';
|
||||
createAllCerts = lib.concatStringsSep "\n" (map createDomainDkimCert cfg.domains);
|
||||
create_dkim_cert =
|
||||
''
|
||||
# Create dkim dir
|
||||
mkdir -p "${cfg.dkimKeyDirectory}"
|
||||
chown ${dkimUser}:${dkimGroup} "${cfg.dkimKeyDirectory}"
|
||||
|
||||
${createAllCerts}
|
||||
|
||||
chown -R ${dkimUser}:${dkimGroup} "${cfg.dkimKeyDirectory}"
|
||||
'';
|
||||
|
||||
keyTable = pkgs.writeText "opendkim-KeyTable"
|
||||
(lib.concatStringsSep "\n" (lib.flip map cfg.domains
|
||||
|
|
@ -80,11 +70,17 @@ in
|
|||
};
|
||||
|
||||
users.users = optionalAttrs (config.services.postfix.user == "postfix") {
|
||||
postfix.extraGroups = [ "${config.services.opendkim.group}" ];
|
||||
postfix.extraGroups = [ "${dkimGroup}" ];
|
||||
};
|
||||
systemd.services.opendkim = {
|
||||
preStart = create_dkim_cert;
|
||||
serviceConfig.ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
|
||||
preStart = lib.mkForce createAllCerts;
|
||||
serviceConfig = {
|
||||
ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
|
||||
PermissionsStartOnly = lib.mkForce false;
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${cfg.dkimKeyDirectory}' - ${dkimUser} ${dkimGroup} - -"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
@ -27,19 +27,22 @@ in
|
|||
config = with cfg; lib.mkIf enable {
|
||||
services.rspamd = {
|
||||
enable = true;
|
||||
extraConfig = ''
|
||||
inherit debug;
|
||||
locals = {
|
||||
"milter_headers.conf" = { text = ''
|
||||
extended_spam_headers = yes;
|
||||
'' + (lib.optionalString cfg.virusScanning ''
|
||||
antivirus {
|
||||
''; };
|
||||
"antivirus.conf" = lib.mkIf cfg.virusScanning { text = ''
|
||||
clamav {
|
||||
action = "reject";
|
||||
symbol = "CLAM_VIRUS";
|
||||
type = "clamav";
|
||||
log_clean = true;
|
||||
servers = "/run/clamav/clamd.ctl";
|
||||
scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all
|
||||
}
|
||||
}
|
||||
'');
|
||||
''; };
|
||||
};
|
||||
|
||||
overrides = {
|
||||
"milter_headers.conf" = {
|
||||
|
|
|
|||
|
|
@ -34,6 +34,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
{
|
||||
imports = [
|
||||
../default.nix
|
||||
./lib/config.nix
|
||||
];
|
||||
|
||||
virtualisation.memorySize = 1500;
|
||||
|
|
@ -103,6 +104,10 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
exec grep '${clientIP}' "$@"
|
||||
'';
|
||||
in {
|
||||
imports = [
|
||||
./lib/config.nix
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
fetchmail msmtp procmail findutils grep-ip
|
||||
];
|
||||
|
|
@ -120,10 +125,15 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
};
|
||||
"root/.msmtprc" = {
|
||||
text = ''
|
||||
account test2
|
||||
defaults
|
||||
tls on
|
||||
tls_certcheck off
|
||||
|
||||
account user2
|
||||
host ${serverIP}
|
||||
port 587
|
||||
from user@example2.com
|
||||
auth on
|
||||
user user@example2.com
|
||||
password user2
|
||||
'';
|
||||
|
|
@ -164,7 +174,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
|
||||
--Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607--
|
||||
'';
|
||||
"root/email2".text = ''
|
||||
"root/safe-email".text = ''
|
||||
From: User <user@example2.com>
|
||||
To: User1 <user1@example.com>
|
||||
Cc:
|
||||
|
|
@ -182,13 +192,17 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
};
|
||||
};
|
||||
|
||||
testScript =
|
||||
testScript = { nodes, ... }:
|
||||
''
|
||||
startAll;
|
||||
|
||||
$server->waitForUnit("multi-user.target");
|
||||
$client->waitForUnit("multi-user.target");
|
||||
|
||||
# TODO put this blocking into the systemd units? I am not sure if rspamd already waits for the clamd socket.
|
||||
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
|
||||
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ \$? -eq 124 ]");
|
||||
|
||||
$client->execute("cp -p /etc/root/.* ~/");
|
||||
$client->succeed("mkdir -p ~/mail");
|
||||
$client->succeed("ls -la ~/ >&2");
|
||||
|
|
@ -201,7 +215,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
|
||||
# Verify that mail can be sent and received before testing virus scanner
|
||||
$client->execute("rm ~/mail/*");
|
||||
$client->succeed("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email2 >&2");
|
||||
$client->succeed("msmtp -a user2 user1\@example.com < /etc/root/safe-email >&2");
|
||||
# give the mail server some time to process the mail
|
||||
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
|
||||
$client->execute("rm ~/mail/*");
|
||||
|
|
@ -209,13 +223,12 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
$client->succeed("fetchmail -v >&2");
|
||||
$client->execute("rm ~/mail/*");
|
||||
|
||||
|
||||
subtest "virus scan file", sub {
|
||||
$server->fail("clamscan --follow-file-symlinks=2 -r /etc/root/ >&2");
|
||||
$server->succeed("clamdscan \$(readlink -f /etc/root/eicar.com.txt) | grep \"Txt\\.Malware\\.Agent-1787597 FOUND\" >&2");
|
||||
};
|
||||
|
||||
subtest "virus scanner", sub {
|
||||
$client->fail("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/virus-email >&2");
|
||||
subtest "virus scan email", sub {
|
||||
$client->succeed("msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | grep \"server message: 554 5\\.7\\.1 clamav: virus found: .*\\(Eicar\\|EICAR\\)\" >&2"); # for some reason this ID is nondetermistic...
|
||||
# give the mail server some time to process the mail
|
||||
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
|
||||
};
|
||||
|
|
|
|||
|
|
@ -21,6 +21,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
{
|
||||
imports = [
|
||||
../default.nix
|
||||
./lib/config.nix
|
||||
];
|
||||
|
||||
services.rsyslogd = {
|
||||
|
|
@ -134,6 +135,9 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
imap.close()
|
||||
'';
|
||||
in {
|
||||
imports = [
|
||||
./lib/config.nix
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
fetchmail msmtp procmail findutils grep-ip check-mail-id test-imap-spam test-imap-ham
|
||||
];
|
||||
|
|
@ -271,13 +275,16 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
};
|
||||
};
|
||||
|
||||
testScript =
|
||||
testScript = { nodes, ... }:
|
||||
''
|
||||
startAll;
|
||||
|
||||
$server->waitForUnit("multi-user.target");
|
||||
$client->waitForUnit("multi-user.target");
|
||||
|
||||
# TODO put this blocking into the systemd units?
|
||||
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
|
||||
|
||||
$client->execute("cp -p /etc/root/.* ~/");
|
||||
$client->succeed("mkdir -p ~/mail");
|
||||
$client->succeed("ls -la ~/ >&2");
|
||||
|
|
|
|||
|
|
@ -21,6 +21,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
|
|||
{
|
||||
imports = [
|
||||
./../default.nix
|
||||
./lib/config.nix
|
||||
];
|
||||
|
||||
mailserver = {
|
||||
|
|
|
|||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
security.dhparams.defaultBitSize = 16; # really low for quicker tests
|
||||
|
||||
# For slow non-kvm tests.
|
||||
# nixos/modules/testing/test-instrumentation.nix also sets this. I don't know if there's a better way than etc to override theirs.
|
||||
environment.etc."systemd/system.conf.d/bigdefaulttimeout.conf".text = ''
|
||||
[Manager]
|
||||
# Allow extremely slow start (default for test-VMs is 5 minutes)
|
||||
DefaultTimeoutStartSec=15min
|
||||
'';
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
let
|
||||
pkgs = (import <nixpkgs> { system = builtins.currentSystem; config = {}; });
|
||||
patchedMachinePM = pkgs.writeTextFile {
|
||||
name = "Machine.pm.patched-to-wait-longer-for-vm";
|
||||
text = builtins.replaceStrings ["alarm 600;"] ["alarm 1200;"] (builtins.readFile (<nixpkgs>+"/nixos/lib/test-driver/Machine.pm"));
|
||||
};
|
||||
in
|
||||
(pkgs // {
|
||||
qemu_test = with pkgs; stdenv.mkDerivation {
|
||||
name = "qemu_test_no_kvm";
|
||||
buildInputs = [ coreutils qemu_test ];
|
||||
inherit qemu_test;
|
||||
inherit coreutils;
|
||||
builder = builtins.toFile "builder.sh" ''
|
||||
PATH=$coreutils/bin:$PATH
|
||||
mkdir -p $out/bin
|
||||
cp $qemu_test/bin/* $out/bin/
|
||||
ln -sf $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
|
||||
'';
|
||||
};
|
||||
stdenv = pkgs.stdenv // {
|
||||
mkDerivation = args: (pkgs.stdenv.mkDerivation (args // (
|
||||
pkgs.lib.optionalAttrs (args.name == "nixos-test-driver") {
|
||||
installPhase = args.installPhase + ''
|
||||
rm $libDir/Machine.pm
|
||||
cp ${patchedMachinePM} $libDir/Machine.pm
|
||||
'';
|
||||
}
|
||||
)));
|
||||
};
|
||||
})
|
||||
Loading…
Reference in New Issue