blob: 7f30f279dc7a91ae6abbe31cf7af1e172095b65a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
{ pkgs, ... }:
let
inherit (import ./ssh-keys.nix pkgs) snakeOilEd25519PrivateKey snakeOilEd25519PublicKey;
username = "nix-remote-builder";
in
{
name = "rush";
meta = { inherit (pkgs.rush.meta) maintainers platforms; };
defaults = {
nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
};
nodes = {
client =
{ ... }:
{
nix.settings.extra-experimental-features = [ "nix-command" ];
};
server =
{ config, ... }:
{
nix.settings.trusted-users = [ "${username}" ];
programs.rush = {
enable = true;
global = "debug 1";
rules = {
daemon = ''
match $# == 2
match $0 == "nix-daemon"
match $1 == "--stdio"
match $user == "${username}"
chdir "${config.nix.package}/bin"
'';
whoami = ''
match $# == 1
match $0 == "whoami"
match $user == "${username}"
chdir "${dirOf config.environment.usrbinenv}"
'';
};
};
services.openssh = {
enable = true;
extraConfig = ''
Match User ${username}
AllowAgentForwarding no
AllowTcpForwarding no
PermitTTY no
PermitTunnel no
X11Forwarding no
Match All
'';
};
users = {
groups."${username}" = { };
users."${username}" = {
inherit (config.programs.rush) shell;
group = "${username}";
isSystemUser = true;
openssh.authorizedKeys.keys = [ snakeOilEd25519PublicKey ];
};
};
};
};
testScript = ''
start_all()
client.succeed("mkdir -m 700 /root/.ssh")
client.succeed("cat '${snakeOilEd25519PrivateKey}' | tee /root/.ssh/id_ed25519")
client.succeed("chmod 600 /root/.ssh/id_ed25519")
server.wait_for_unit("sshd")
client.succeed("ssh-keyscan -H server | tee -a /root/.ssh/known_hosts")
client.succeed("ssh ${username}@server -- whoami")
client.succeed("nix store info --store 'ssh-ng://${username}@server'")
client.fail("ssh ${username}@server -- date")
client.fail("nix store info --store 'ssh://${username}@server'")
'';
}
|
