nixos/tests/nginx-auth.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

{ pkgs, ... }:
{
  name = "nginx-auth";

  nodes = {
    webserver =
      { pkgs, lib, ... }:
      {
        services.nginx =
          let
            root = pkgs.runCommand "testdir" { } ''
              mkdir "$out"
              echo hello world > "$out/index.html"
            '';
          in
          {
            enable = true;

            virtualHosts.lockedroot = {
              inherit root;
              basicAuth.alice = "pwofa";
            };

            virtualHosts.lockedsubdir = {
              inherit root;
              locations."/sublocation/" = {
                alias = "${root}/";
                basicAuth.bob = "pwofb";
              };
            };
          };
      };
  };

  testScript = ''
    webserver.wait_for_unit("nginx")
    webserver.wait_for_open_port(80)

    webserver.fail("curl --fail --resolve lockedroot:80:127.0.0.1 http://lockedroot")
    webserver.succeed(
        "curl --fail --resolve lockedroot:80:127.0.0.1 http://alice:pwofa@lockedroot"
    )

    webserver.succeed("curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir")
    webserver.fail(
        "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir/sublocation/index.html"
    )
    webserver.succeed(
        "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://bob:pwofb@lockedsubdir/sublocation/index.html"
    )
  '';
}