push sheeet

nixos/tests/web-apps/mastodon/default.nix

@@ -0,0 +1,18 @@
+{
+  system ? builtins.currentSystem,
+  pkgs,
+  handleTestOn,
+  ...
+}:
+let
+  supportedSystems = [
+    "x86_64-linux"
+    "i686-linux"
+    "aarch64-linux"
+  ];
+
+in
+{
+  standard = handleTestOn supportedSystems ./standard.nix { inherit system pkgs; };
+  remote-databases = handleTestOn supportedSystems ./remote-databases.nix { inherit system pkgs; };
+}

nixos/tests/web-apps/mastodon/remote-databases.nix

@@ -0,0 +1,220 @@
+import ../../make-test-python.nix (
+  { pkgs, ... }:
+  let
+    cert =
+      pkgs:
+      pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+        openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=mastodon.local' -days 36500
+        mkdir -p $out
+        cp key.pem cert.pem $out
+      '';
+
+    hosts = ''
+      192.168.2.103 mastodon.local
+    '';
+
+    postgresqlPassword = "thisisnotasecret";
+    redisPassword = "thisisnotasecrettoo";
+
+  in
+  {
+    name = "mastodon-remote-postgresql";
+    meta.maintainers = with pkgs.lib.maintainers; [
+      erictapen
+      izorkin
+    ];
+
+    nodes = {
+      databases =
+        { config, ... }:
+        {
+          environment = {
+            etc = {
+              "redis/password-redis-db".text = redisPassword;
+            };
+          };
+          networking = {
+            interfaces.eth1 = {
+              ipv4.addresses = [
+                {
+                  address = "192.168.2.102";
+                  prefixLength = 24;
+                }
+              ];
+            };
+            extraHosts = hosts;
+            firewall.allowedTCPPorts = [
+              config.services.redis.servers.mastodon.port
+              config.services.postgresql.settings.port
+            ];
+          };
+
+          services.redis.servers.mastodon = {
+            enable = true;
+            bind = "0.0.0.0";
+            port = 31637;
+            requirePassFile = "/etc/redis/password-redis-db";
+          };
+
+          services.postgresql = {
+            enable = true;
+            enableTCPIP = true;
+            authentication = ''
+              hostnossl mastodon mastodon 192.168.2.201/32 md5
+            '';
+            ensureDatabases = [ "mastodon" ];
+            ensureUsers = [
+              {
+                name = "mastodon";
+                ensureDBOwnership = true;
+              }
+            ];
+            initialScript = pkgs.writeText "postgresql_init.sql" ''
+              CREATE ROLE mastodon LOGIN PASSWORD '${postgresqlPassword}';
+            '';
+          };
+        };
+
+      nginx =
+        { nodes, ... }:
+        {
+          networking = {
+            interfaces.eth1 = {
+              ipv4.addresses = [
+                {
+                  address = "192.168.2.103";
+                  prefixLength = 24;
+                }
+              ];
+            };
+            extraHosts = hosts;
+            firewall.allowedTCPPorts = [
+              80
+              443
+            ];
+          };
+
+          security = {
+            pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
+          };
+
+          services.nginx = {
+            enable = true;
+            recommendedProxySettings = true;
+            virtualHosts."mastodon.local" = {
+              root = "/var/empty";
+              forceSSL = true;
+              enableACME = pkgs.lib.mkForce false;
+              sslCertificate = "${cert pkgs}/cert.pem";
+              sslCertificateKey = "${cert pkgs}/key.pem";
+              locations."/" = {
+                tryFiles = "$uri @proxy";
+              };
+              locations."@proxy" = {
+                proxyPass = "http://192.168.2.201:${toString nodes.server.services.mastodon.webPort}";
+                proxyWebsockets = true;
+              };
+            };
+          };
+        };
+
+      server =
+        { config, pkgs, ... }:
+        {
+          virtualisation.memorySize = 2048;
+
+          environment = {
+            etc = {
+              "mastodon/password-redis-db".text = redisPassword;
+              "mastodon/password-posgressql-db".text = postgresqlPassword;
+            };
+          };
+
+          networking = {
+            interfaces.eth1 = {
+              ipv4.addresses = [
+                {
+                  address = "192.168.2.201";
+                  prefixLength = 24;
+                }
+              ];
+            };
+            extraHosts = hosts;
+            firewall.allowedTCPPorts = [
+              config.services.mastodon.webPort
+              config.services.mastodon.sidekiqPort
+            ];
+          };
+
+          services.mastodon = {
+            enable = true;
+            configureNginx = false;
+            localDomain = "mastodon.local";
+            enableUnixSocket = false;
+            streamingProcesses = 2;
+            redis = {
+              createLocally = false;
+              host = "192.168.2.102";
+              port = 31637;
+              passwordFile = "/etc/mastodon/password-redis-db";
+            };
+            database = {
+              createLocally = false;
+              host = "192.168.2.102";
+              port = 5432;
+              name = "mastodon";
+              user = "mastodon";
+              passwordFile = "/etc/mastodon/password-posgressql-db";
+            };
+            smtp = {
+              createLocally = false;
+              fromAddress = "mastodon@mastodon.local";
+            };
+            extraConfig = {
+              BIND = "0.0.0.0";
+              EMAIL_DOMAIN_ALLOWLIST = "example.com";
+              RAILS_SERVE_STATIC_FILES = "true";
+              TRUSTED_PROXY_IP = "192.168.2.103";
+            };
+          };
+        };
+
+      client =
+        { pkgs, ... }:
+        {
+          environment.systemPackages = [ pkgs.jq ];
+          networking = {
+            interfaces.eth1 = {
+              ipv4.addresses = [
+                {
+                  address = "192.168.2.202";
+                  prefixLength = 24;
+                }
+              ];
+            };
+            extraHosts = hosts;
+          };
+
+          security = {
+            pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
+          };
+        };
+    };
+
+    testScript = import ./script.nix {
+      inherit pkgs;
+      extraInit = ''
+        nginx.wait_for_unit("nginx.service")
+        nginx.wait_for_open_port(443)
+        databases.wait_for_unit("redis-mastodon.service")
+        databases.wait_for_unit("postgresql.target")
+        databases.wait_for_open_port(31637)
+        databases.wait_for_open_port(5432)
+      '';
+      extraShutdown = ''
+        nginx.shutdown()
+        databases.shutdown()
+      '';
+    };
+  }
+)

nixos/tests/web-apps/mastodon/script.nix

@@ -0,0 +1,53 @@
+{
+  pkgs,
+  extraInit ? "",
+  extraShutdown ? "",
+}:
+
+''
+  start_all()
+
+  ${extraInit}
+
+  server.wait_for_unit("mastodon-sidekiq-all.service")
+  server.wait_for_unit("mastodon-streaming.target")
+  server.wait_for_unit("mastodon-web.service")
+  server.wait_for_open_port(55001)
+
+  # Check that mastodon-media-auto-remove is scheduled
+  server.succeed("systemctl status mastodon-media-auto-remove.timer")
+
+  # Check Mastodon version from remote client
+  client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'")
+
+  # Check access from remote client
+  client.succeed("curl --fail https://mastodon.local/about | grep 'Mastodon hosted on mastodon.local'")
+  client.succeed("curl --fail $(curl https://mastodon.local/api/v1/instance 2> /dev/null | jq -r .thumbnail) --output /dev/null")
+
+  # Simple check tootctl commands
+  # Check Mastodon version
+  server.succeed("mastodon-tootctl version | grep '${pkgs.mastodon.version}'")
+
+  # Manage accounts
+  server.succeed("mastodon-tootctl email_domain_blocks add example.com")
+  server.succeed("mastodon-tootctl email_domain_blocks list | grep example.com")
+  server.fail("mastodon-tootctl email_domain_blocks list | grep mastodon.local")
+  server.fail("mastodon-tootctl accounts create alice --email=alice@example.com")
+  server.succeed("mastodon-tootctl email_domain_blocks remove example.com")
+  server.succeed("mastodon-tootctl accounts create bob --email=bob@example.com")
+  server.succeed("mastodon-tootctl accounts approve bob")
+  server.succeed("mastodon-tootctl accounts delete bob")
+
+  # Manage IP access
+  server.succeed("mastodon-tootctl ip_blocks add 192.168.0.0/16 --severity=no_access")
+  server.succeed("mastodon-tootctl ip_blocks export | grep 192.168.0.0/16")
+  server.fail("mastodon-tootctl ip_blocks export | grep 172.16.0.0/16")
+  client.fail("curl --fail https://mastodon.local/about")
+  server.succeed("mastodon-tootctl ip_blocks remove 192.168.0.0/16")
+  client.succeed("curl --fail https://mastodon.local/about")
+
+  server.shutdown()
+  client.shutdown()
+
+  ${extraShutdown}
+''

nixos/tests/web-apps/mastodon/standard.nix

@@ -0,0 +1,109 @@
+import ../../make-test-python.nix (
+  { pkgs, ... }:
+  let
+    cert =
+      pkgs:
+      pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+        openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=mastodon.local' -days 36500
+        mkdir -p $out
+        cp key.pem cert.pem $out
+      '';
+
+    hosts = ''
+      192.168.2.101 mastodon.local
+    '';
+
+  in
+  {
+    name = "mastodon-standard";
+    meta.maintainers = with pkgs.lib.maintainers; [
+      erictapen
+      izorkin
+      turion
+    ];
+
+    nodes = {
+      server =
+        { pkgs, ... }:
+        {
+
+          virtualisation.memorySize = 2048;
+
+          networking = {
+            interfaces.eth1 = {
+              ipv4.addresses = [
+                {
+                  address = "192.168.2.101";
+                  prefixLength = 24;
+                }
+              ];
+            };
+            extraHosts = hosts;
+            firewall.allowedTCPPorts = [
+              80
+              443
+            ];
+          };
+
+          security = {
+            pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
+          };
+
+          services.mastodon = {
+            enable = true;
+            configureNginx = true;
+            localDomain = "mastodon.local";
+            enableUnixSocket = false;
+            streamingProcesses = 2;
+            smtp = {
+              createLocally = false;
+              fromAddress = "mastodon@mastodon.local";
+            };
+            extraConfig = {
+              EMAIL_DOMAIN_ALLOWLIST = "example.com";
+            };
+          };
+
+          services.nginx = {
+            virtualHosts."mastodon.local" = {
+              enableACME = pkgs.lib.mkForce false;
+              sslCertificate = "${cert pkgs}/cert.pem";
+              sslCertificateKey = "${cert pkgs}/key.pem";
+            };
+          };
+        };
+
+      client =
+        { pkgs, ... }:
+        {
+          environment.systemPackages = [ pkgs.jq ];
+          networking = {
+            interfaces.eth1 = {
+              ipv4.addresses = [
+                {
+                  address = "192.168.2.102";
+                  prefixLength = 24;
+                }
+              ];
+            };
+            extraHosts = hosts;
+          };
+
+          security = {
+            pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
+          };
+        };
+    };
+
+    testScript = import ./script.nix {
+      inherit pkgs;
+      extraInit = ''
+        server.wait_for_unit("nginx.service")
+        server.wait_for_open_port(443)
+        server.wait_for_unit("redis-mastodon.service")
+        server.wait_for_unit("postgresql.target")
+        server.wait_for_open_port(5432)
+      '';
+    };
+  }
+)