1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
{ pkgs, ... }:
{
name = "systemd-journal-upload";
meta = with pkgs.lib.maintainers; {
maintainers = [
minijackson
];
};
# systemd in Nixpkgs is built without GnuTLS, so systemd-journal-remote
# cannot terminate TLS itself. We put nginx in front of it with mutual TLS
# and have systemd-journal-upload (which uses curl+openssl) talk HTTPS to
# nginx. This exercises both the recommended migration path and verifies
# that journal-upload's TLS support still works.
nodes.server =
{ lib, nodes, ... }:
{
services.journald.remote = {
enable = true;
settings.Remote = {
Seal = true;
};
};
# Keep journal-remote loopback-only; only nginx is exposed to the network.
systemd.sockets.systemd-journal-remote.listenStreams = lib.mkForce [
""
"127.0.0.1:${toString nodes.server.services.journald.remote.port}"
];
virtualisation.credentials = {
"ca.cert.pem".source = "./ca.cert.pem";
"server.cert.pem".source = "./server.cert.pem";
"server.key.pem".source = "./server.key.pem";
};
systemd.services.nginx.serviceConfig.ImportCredential = [
"server.cert.pem"
"server.key.pem"
"ca.cert.pem"
];
services.nginx = {
enable = true;
virtualHosts."server" = {
onlySSL = true;
http2 = false;
sslCertificate = "/run/credentials/nginx.service/server.cert.pem";
sslCertificateKey = "/run/credentials/nginx.service/server.key.pem";
extraConfig = ''
ssl_client_certificate /run/credentials/nginx.service/ca.cert.pem;
ssl_verify_client on;
'';
locations."/".proxyPass = "http://127.0.0.1:${toString nodes.server.services.journald.remote.port}";
};
};
networking.firewall.allowedTCPPorts = [ 443 ];
};
nodes.client =
{ lib, ... }:
{
virtualisation.credentials = {
"ca.cert.pem".source = "./ca.cert.pem";
"client.cert.pem".source = "./client.cert.pem";
"client.key.pem".source = "./client.key.pem";
};
systemd.services.systemd-journal-upload.serviceConfig.ImportCredential = [
"client.cert.pem"
"client.key.pem"
"ca.cert.pem"
];
services.journald.upload = {
enable = true;
settings.Upload = {
URL = "https://server:443";
ServerCertificateFile = "/run/credentials/systemd-journal-upload.service/client.cert.pem";
ServerKeyFile = "/run/credentials/systemd-journal-upload.service/client.key.pem";
TrustedCertificateFile = "/run/credentials/systemd-journal-upload.service/ca.cert.pem";
};
};
};
testScript = ''
import subprocess
import tempfile
import shutil
tmpdir_o = tempfile.TemporaryDirectory()
tmpdir = tmpdir_o.name
def generate_pems(domain: str):
subprocess.run(
[
"${pkgs.minica}/bin/minica",
"--ca-key=ca.key.pem",
"--ca-cert=ca.cert.pem",
f"--domains={domain}",
],
cwd=str(tmpdir),
)
with subtest("Creating keys and certificates"):
generate_pems("server")
generate_pems("client")
def copy_pems(machine: BaseMachine, domain: str):
shutil.copy(f"{tmpdir}/{domain}/cert.pem", machine.state_dir / f"{domain}.cert.pem")
shutil.copy(f"{tmpdir}/{domain}/key.pem", machine.state_dir / f"{domain}.key.pem")
shutil.copy(f"{tmpdir}/ca.cert.pem", machine.state_dir / "ca.cert.pem")
with subtest("Copying keys and certificates"):
copy_pems(server, "server")
copy_pems(client, "client")
server.wait_for_unit("nginx.service")
client.wait_for_unit("systemd-journal-upload.service")
identifier = "nixos-test"
message = "Hello from NixOS test infrastructure"
client.succeed(f"systemd-cat --identifier={identifier} <<< '{message}'")
server.wait_until_succeeds(
f"journalctl --file /var/log/journal/remote/remote-*.journal --identifier={identifier} | grep -F '{message}'"
)
'';
}
|
