blob: 3465090b23570431649df260099e1a02b7792fed (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
{ ... }:
{
name = "tandoor-recipes-media";
nodes.machine = {
services.tandoor-recipes = {
enable = true;
# This setting is not recommended, but it's an easy way serve the media
# folder in this test.
extraConfig = {
GUNICORN_MEDIA = true;
};
};
specialisation.oldVersion.configuration = {
system.stateVersion = "25.11";
services.tandoor-recipes = {
enable = true;
extraConfig = {
GUNICORN_MEDIA = true;
# Explicitly set insecure value (skips warning)
MEDIA_ROOT = "/var/lib/tandoor-recipes";
};
};
};
specialisation.oldVersionOverrideMedia.configuration = {
system.stateVersion = "25.11";
services.tandoor-recipes = {
enable = true;
extraConfig = {
GUNICORN_MEDIA = true;
MEDIA_ROOT = "/var/lib/tandoor-recipes/media";
};
};
};
};
testScript =
{ nodes, ... }:
let
specBase = "${nodes.machine.system.build.toplevel}/specialisation";
oldVersion = "${specBase}/oldVersion";
oldVersionOverrideMedia = "${specBase}/oldVersionOverrideMedia";
in
# python
''
def wait_for_tandoor():
machine.wait_for_unit("tandoor-recipes.service")
machine.wait_for_open_port(8080)
def stop_and_rm():
machine.systemctl("stop tandoor-recipes")
machine.succeed("rm -r /var/lib/tandoor-recipes")
db_path = "http://localhost:8080/media/db.sqlite3"
# The media folder shouldn't contain the database. Subsequently it
# should **not** get served, resulting in a 404. Previously the
# database was located in the media folder. Therefore serving the media
# folder would expose the database. See #338339.
wait_for_tandoor()
machine.succeed(f"curl --head {db_path} | grep \"HTTP/1.1 404 Not Found\"")
# Switch to NixOS 25.11 to check if the setup still functions the same
# as before.
stop_and_rm()
machine.succeed("${oldVersion}/bin/switch-to-configuration test")
# With the old setup the media folder should contain the database.
# Subsequently it should get served, resulting in a 200.
wait_for_tandoor()
machine.succeed(f"curl --head {db_path} | grep \"HTTP/1.1 200 OK\"")
# Switch to NixOS 25.11 with the MEDIA_ROOT already set to
# /var/lib/tandoor-recipes/media.
stop_and_rm()
machine.succeed("${oldVersionOverrideMedia}/bin/switch-to-configuration test")
# With MEDIA_ROOT being set to /var/lib/tandoor-recipes/media the media
# folder shouldn't contain the database. Subsequently it should **not**
# get served, resulting in a 404.
wait_for_tandoor()
machine.succeed(f"curl --head {db_path} | grep \"HTTP/1.1 404 Not Found\"")
'';
}
|
