blob: 88aadce7a8f4bfe927188a76448bc6fcc3f10ad4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
{
system ? builtins.currentSystem,
pkgs ? import ../.. {
inherit system;
config = { };
},
}:
let
inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
in
makeTest {
name = "oxidized";
nodes.server =
{ config, pkgs, ... }:
{
security.pam.services.sshd.allowNullPassword = true; # the default `UsePam yes` makes this necessary
services = {
sshd.enable = true;
openssh = {
settings.PermitRootLogin = "yes";
settings.PermitEmptyPasswords = "yes";
};
oxidized = {
enable = true;
package = pkgs.oxidized;
routerDB = pkgs.writeText "oxidized-router.db" ''
localhost:linuxgeneric:root
'';
configFile = pkgs.writeText "oxidized-config.yml" ''
# vi: ft=yaml
---
extensions:
oxidized-web:
load: true
listen: 127.0.0.1
port: 8888
vhosts:
- localhost
- 127.0.0.1
- oxidized
- oxidized.example.com
interval: 3600
retries: 3
model: linuxgeneric
username: root
source:
default: csv
csv:
file: "/var/lib/oxidized/.config/oxidized/router.db"
delimiter: !ruby/regexp /:/
map:
name: 0
model: 1
username: 2
password: 3
vars_map:
enable: 4
input:
default: ssh
utf8_encoded: true
output:
default: git
git:
single_repo: true
user: oxidized
email: oxidized@example.com
repo: /var/lib/oxidized/git
'';
};
};
systemd.services.oxidized = {
stopIfChanged = false;
environment.HOME = "/var/lib/oxidized";
environment.APP_ENV = "production";
serviceConfig = {
StateDirectory = "oxidized";
MemoryDenyWriteExecute = false;
PrivateNetwork = false;
SystemCallFilter = "@system-service";
};
path = [ config.programs.ssh.package ];
};
};
testScript =
{ nodes, ... }:
''
start_all()
server.wait_for_unit("oxidized.service")
with subtest("Check if oxidized reports the correct version"):
server.wait_until_succeeds(("curl --silent --fail --location http://127.0.0.1:8888/ | grep '${nodes.server.services.oxidized.package.version}' >&2"))
with subtest("Check if oxidized can be accessed with a vhost and reports the correct version"):
server.wait_until_succeeds(("curl --silent --fail --resolve oxidized:8888:127.0.0.1 --location http://oxidized:8888/ | grep '${nodes.server.services.oxidized.package.version}' >&2"))
with subtest("Check if oxidized can connect to linuxgeneric model"):
server.wait_until_succeeds("journalctl -b --grep 'Oxidized::Worker -- Configuration updated for /localhost' -t oxidized")
'';
}
|
