nixpkgs/nixos/tests/acme.nix
aszlig 01fffd94e5
nixos/tests/acme: Patch certifi with cacert
Since 67651d80bc the requests package now
depends on certifi, which in turn provides the CA root certificates that
we need to replace.

It might also be a good idea to actually patch certifi with our version
of cacert by default so that if we want to override and/or add something
we only need to do it once.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Cc: @fpletz, @k0ral, @FRidh
2017-09-13 23:16:43 +02:00

63 lines
1.7 KiB
Nix

let
commonConfig = { config, lib, pkgs, nodes, ... }: {
networking.nameservers = [
nodes.letsencrypt.config.networking.primaryIPAddress
];
nixpkgs.overlays = lib.singleton (self: super: {
cacert = super.cacert.overrideDerivation (drv: {
installPhase = (drv.installPhase or "") + ''
cat "${nodes.letsencrypt.config.test-support.letsencrypt.caCert}" \
>> "$out/etc/ssl/certs/ca-bundle.crt"
'';
});
pythonPackages = (super.python.override {
packageOverrides = lib.const (pysuper: {
certifi = pysuper.certifi.overrideDerivation (drv: {
postPatch = (drv.postPatch or "") + ''
cat "${self.cacert}/etc/ssl/certs/ca-bundle.crt" \
> certifi/cacert.pem
'';
});
});
}).pkgs;
});
};
in import ./make-test.nix {
name = "acme";
nodes = {
letsencrypt = ./common/letsencrypt.nix;
webserver = { config, pkgs, ... }: {
imports = [ commonConfig ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.extraHosts = ''
${config.networking.primaryIPAddress} example.com
'';
services.nginx.enable = true;
services.nginx.virtualHosts."example.com" = {
enableACME = true;
forceSSL = true;
locations."/".root = pkgs.runCommand "docroot" {} ''
mkdir -p "$out"
echo hello world > "$out/index.html"
'';
};
};
client = commonConfig;
};
testScript = ''
$letsencrypt->waitForUnit("boulder.service");
startAll;
$webserver->waitForUnit("acme-certificates.target");
$client->succeed('curl https://example.com/ | grep -qF "hello world"');
'';
}