blob: 9e8204e8492e044c7bb99e32fd2f9c3809291f3e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
{ lib, ... }:
{
name = "postgrest";
meta = {
maintainers = with lib.maintainers; [ wolfgangwalther ];
};
nodes.machine =
{
config,
lib,
pkgs,
...
}:
{
services.postgresql = {
enable = true;
initialScript = pkgs.writeText "init.sql" ''
CREATE ROLE postgrest LOGIN NOINHERIT;
CREATE ROLE anon ROLE postgrest;
CREATE ROLE postgrest_with_password LOGIN NOINHERIT PASSWORD 'password';
CREATE ROLE authenticated ROLE postgrest_with_password;
'';
};
services.postgrest = {
enable = true;
settings = {
admin-server-port = 3001;
db-anon-role = "anon";
db-uri.dbname = "postgres";
};
};
specialisation.withSecrets.configuration = {
services.postgresql.enableTCPIP = true;
services.postgrest = {
pgpassFile = "/run/secrets/.pgpass";
jwtSecretFile = "/run/secrets/jwt.secret";
settings.db-uri.host = "localhost";
settings.db-uri.user = "postgrest_with_password";
settings.server-port = 3000;
settings.server-unix-socket = null;
};
};
};
extraPythonPackages = p: [ p.pyjwt ];
testScript =
{ nodes, ... }:
let
withSecrets = "${nodes.machine.system.build.toplevel}/specialisation/withSecrets";
in
''
import jwt
machine.wait_for_unit("postgresql.target")
def wait_for_postgrest():
machine.wait_for_unit("postgrest.service")
machine.wait_until_succeeds("curl --fail -s http://localhost:3001/ready", timeout=30)
with subtest("anonymous access"):
wait_for_postgrest()
machine.succeed(
"curl --fail-with-body --no-progress-meter --unix-socket /run/postgrest/postgrest.sock http://localhost",
timeout=2
)
machine.execute("""
mkdir -p /run/secrets
echo "*:*:*:*:password" > /run/secrets/.pgpass
echo reallyreallyreallyreallyverysafe > /run/secrets/jwt.secret
""")
with subtest("authenticated access"):
machine.succeed("${withSecrets}/bin/switch-to-configuration test >&2")
wait_for_postgrest()
token = jwt.encode({ "role": "authenticated" }, "reallyreallyreallyreallyverysafe")
machine.succeed(
f"curl --fail-with-body --no-progress-meter -H 'Authorization: Bearer {token}' http://localhost:3000",
timeout=2
)
'';
}
|
