diff options
Diffstat (limited to 'tests/by-name/gi/git-server/test.nix')
| -rw-r--r-- | tests/by-name/gi/git-server/test.nix | 245 |
1 files changed, 245 insertions, 0 deletions
diff --git a/tests/by-name/gi/git-server/test.nix b/tests/by-name/gi/git-server/test.nix new file mode 100644 index 0000000..0cf3ee8 --- /dev/null +++ b/tests/by-name/gi/git-server/test.nix @@ -0,0 +1,245 @@ +{ + nixos-lib, + pkgsUnstable, + nixpkgs-unstable, + pkgs, + extraModules, + nixLib, + ... +}: let + sshKeys = + import ./ssh_keys.nix {inherit pkgs;}; + + gitServerDomain = "server"; + + gitoliteAdminConfSnippet = pkgs.writeText "gitolite-admin-conf-snippet" '' + repo CREATOR/[a-zA-Z0-9].* + C = @all + RW+ = CREATOR + RW = WRITERS + R = READERS + option user-configs = cgit\.owner cgit\.desc cgit\.section cgit\.homepage + ''; + + expectedGitoliteConf = pkgs.writeText "expected-gitolite-conf" '' + repo gitolite-admin + RW+ = gitolite-admin + + repo testing + RW+ = @all + repo CREATOR/[a-zA-Z0-9].* + C = @all + RW+ = CREATOR + RW = WRITERS + R = READERS + option user-configs = cgit\.owner cgit\.desc cgit\.section cgit\.homepage + ''; + + expectedHtmlReadme = pkgs.writeText "expectedHtmlReadme" '' + <h1>Alice's Repo</h1> + ''; + expectedMdReadme = pkgs.writeText "expectedMdReadme" '' + # Alice's Repo + ''; +in + nixos-lib.runTest { + hostPkgs = pkgs; # the Nixpkgs package set used outside the VMs + + name = "git-server"; + + node = { + specialArgs = {inherit pkgsUnstable nixpkgs-unstable nixLib;}; + + # Use the nixpkgs as constructed by the `nixpkgs.*` options + pkgs = null; + }; + + nodes = { + server = {config, ...}: { + imports = + extraModules + ++ [ + ../../../../modules + ]; + + system.activationScripts = { + gitolite = { + text = '' + if ! [ -d /srv/gitolite ]; then + mkdir --parents /srv/gitolite + chown -R git:git /srv/gitolite + fi + ''; + }; + }; + + vhack = { + openssh.enable = true; + nginx = { + enable = true; + selfsign = true; + }; + git-server = { + enable = true; + domain = gitServerDomain; + gitolite.adminPubkey = sshKeys.admin.pub; + }; + }; + }; + + client = {...}: { + environment.systemPackages = [pkgs.git]; + programs.ssh.extraConfig = '' + Host * + UserKnownHostsFile /dev/null + StrictHostKeyChecking no + # there's nobody around that can input password + PreferredAuthentications publickey + ''; + users.users.alice = {isNormalUser = true;}; + users.users.bob = {isNormalUser = true;}; + }; + }; + + testScript = {nodes, ...}: + /* + python + */ + '' + start_all() + + with subtest("can setup ssh keys on client"): + client.succeed( + "mkdir -p ~root/.ssh", + "cp ${sshKeys.admin.priv} ~root/.ssh/id_ed25519", + "chmod 600 ~root/.ssh/id_ed25519", + ) + client.succeed( + "sudo -u alice mkdir -p ~alice/.ssh", + "sudo -u alice cp ${sshKeys.alice.priv} ~alice/.ssh/id_ed25519", + "sudo -u alice chmod 600 ~alice/.ssh/id_ed25519", + ) + client.succeed( + "sudo -u bob mkdir -p ~bob/.ssh", + "sudo -u bob cp ${sshKeys.bob.priv} ~bob/.ssh/id_ed25519", + "sudo -u bob chmod 600 ~bob/.ssh/id_ed25519", + ) + + with subtest("gitolite server starts"): + server.wait_for_unit("gitolite-init.service") + server.wait_for_unit("sshd.service") + client.succeed("ssh -n git@server info") + + + with subtest("admin can clone and configure gitolite-admin.git"): + client.succeed("${pkgs.writeShellScript "setup-gitolite-admin.git" '' + set -xe + + git clone git@server:gitolite-admin.git + git config --global user.name 'System Administrator' + git config --global user.email root\@domain.example + + cp ${sshKeys.alice.pub} gitolite-admin/keydir/alice.pub + cp ${sshKeys.bob.pub} gitolite-admin/keydir/bob.pub + + (cd gitolite-admin && git switch -c master && git branch -D main) + + (cd gitolite-admin && git add . && git commit -m 'Add keys for alice, bob' && git push -u origin master) + cat ${gitoliteAdminConfSnippet} >> gitolite-admin/conf/gitolite.conf + (cd gitolite-admin && git add . && git commit -m 'Add support for wild repos' && git push) + (cd gitolite-admin && git push -d origin main) + ''}") + + server.succeed("${pkgs.writeShellScript "verify gitolite-admin.conf" '' + set -xe + + testFile=~git/.gitolite/conf/gitolite.conf.test + + cp ~git/.gitolite/conf/gitolite.conf "$testFile" + + # Normalize the white space + sed -i 's/\t/ /g' "$testFile" + sed -i 's/\s\+/ /g' "$testFile" + + diff "$testFile" ${expectedGitoliteConf} + ''}") + + + with subtest("non-admins cannot clone gitolite-admin.git"): + client.fail("sudo -i -u alice git clone git@server:gitolite-admin.git") + client.fail("sudo -i -u bob git clone git@server:gitolite-admin.git") + + with subtest("non-admins can clone testing.git"): + client.succeed("sudo -i -u alice git clone git@server:testing.git") + client.succeed("sudo -i -u bob git clone git@server:testing.git") + + + with subtest("alice can create a repo"): + client.succeed("sudo -u alice ${pkgs.writeShellScript "alice-create-repo" '' + set -xe + + mkdir alice-repo && cd alice-repo; + + git init --initial-branch main + echo "# Alice's Repo" > README.md + git add README.md + git -c user.name=Alice -c user.email=alice@domain.example commit -m 'Add readme' + + git remote add origin git@server:alice/alice-project.git + git push --set-upstream origin main + ''}") + + with subtest("alice can clone alice-project.git"): + client.succeed("sudo -u alice ${pkgs.writeShellScript "alice-clone-repo" '' + set -xe + + git clone git@server:alice/alice-project.git + diff --side-by-side ${expectedMdReadme} ./alice-project/README.md + ''}") + + with subtest("bob cannot clone alice-project.git"): + client.fail("sudo -i -u bob git clone git@server:alice/alice-project.git") + + with subtest("Alice can make her repo public"): + client.succeed( + "sudo -u alice ssh git@server perms alice/alice-project + READERS @all", + "sudo -u alice ssh git@server desc alice/alice-project 'My nice project.'" + ) + + with subtest("Bob can see alice config on cgit"): + client.succeed("sudo -u bob ${pkgs.writeShellScript "bob-clone-repo" '' + set -xe + + cd ~bob + # Disable ssl verification, as the certs are self-signed + git -c http.sslVerify=false clone https://server/alice/alice-project.git + ''}") + + with subtest("Alice can change settings in her repo"): + client.succeed("sudo -u alice ${pkgs.writeShellScript "alice-change-settings" '' + set -xe + + echo 'Hi! You want to work with alice' | ssh git@server motd alice/alice-project set + ssh git@server config alice/alice-project --add 'cgit.owner' 'alice' + ssh git@server config alice/alice-project --add 'cgit.section' 'alice' + ssh git@server config alice/alice-project --add 'cgit.homepage' 'alice' + + owner="$(ssh git@server config alice/alice-project --get-all 'cgit.owner')" + [ "$owner" = "alice" ] || { + echo "owner should be alice but is '$owner'!" + exit 1 + } + ''}") + + + # He can't see the readme (FIXME: find out why this does not work. <2024-08-13> ) + # with subtest("Bob can see alice's README"): + # client.succeed("sudo -u bob ${pkgs.writeShellScript "bob-alice-readme" '' + # set -xe + # + # curl --insecure --silent --fail --show-error 'https://server/alice/alice-project/about' > readme.html + # cat readme.html + # diff --side-by-side ${expectedHtmlReadme} readme.html + # ''}") + ''; + } |