blob: ee61b3f0bc72c34463f16cf9e1a590da8a1eeda7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
{ lib, pkgs, ... }:
let
runWithOpenSSL =
name: cmd:
pkgs.runCommand name {
buildInputs = [ pkgs.openssl ];
} cmd;
caKey = runWithOpenSSL "ca.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
caCert = runWithOpenSSL "ca.crt" ''
openssl req -new -x509 -sha256 -key ${caKey} -out $out -subj "/CN=Test CA" -days 36500
'';
serverKey = runWithOpenSSL "server.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
serverCert = runWithOpenSSL "server.crt" ''
openssl req -new -sha256 -key ${serverKey} -out server.csr -subj "/CN=server"
openssl x509 -req -in server.csr -CA ${caCert} -CAkey ${caKey} \
-CAcreateserial -out $out -days 36500 -sha256
'';
clientKey = runWithOpenSSL "client.key" "openssl ecparam -name prime256v1 -genkey -noout -out $out";
clientCert = runWithOpenSSL "client.crt" ''
openssl req -new -sha256 -key ${clientKey} -out client.csr -subj "/CN=client"
openssl x509 -req -in client.csr -CA ${caCert} -CAkey ${caKey} \
-CAcreateserial -out $out -days 36500 -sha256
'';
in
{
_class = "nixosTest";
name = "tlshd";
nodes = {
server =
{ pkgs, ... }:
{
system.services.tlshd = {
imports = [ pkgs.ktls-utils.services.default ];
tlshd.settings = {
"authenticate.server" = {
"x509.certificate" = toString serverCert;
"x509.private_key" = toString serverKey;
"x509.truststore" = toString caCert;
};
};
};
services.nfs.server = {
enable = true;
exports = ''
/export 192.168.1.0/24(rw,no_root_squash,no_subtree_check,xprtsec=mtls)
'';
createMountPoints = true;
};
networking.firewall.enable = false;
};
client =
{ pkgs, ... }:
{
system.services.tlshd = {
imports = [ pkgs.ktls-utils.services.default ];
tlshd.settings = {
"authenticate.client" = {
"x509.certificate" = toString clientCert;
"x509.private_key" = toString clientKey;
"x509.truststore" = toString caCert;
};
};
};
virtualisation.fileSystems."/mnt/nfs" = {
device = "server:/export";
fsType = "nfs";
options = [ "xprtsec=mtls" ];
};
networking.firewall.enable = false;
};
};
testScript = ''
start_all()
server.wait_for_unit("nfs-server.service")
server.wait_for_unit("tlshd.service")
client.wait_for_unit("tlshd.service")
client.wait_for_unit("mnt-nfs.mount")
client.wait_until_succeeds("echo 'hello from client' > /mnt/nfs/test.txt")
server.wait_until_succeeds("grep 'hello from client' /export/test.txt")
'';
meta.maintainers = with lib.maintainers; [ tomfitzhenry ];
}
|
