about summary refs log tree commit diff
path: root/nixos/tests
Commit message (Collapse)AuthorAge
* Merge pull request #82603 from emilazy/nixos-initrd-opensshYegor Timoshenko2020-03-28
|\ | | | | nixos/initrd-ssh: switch from Dropbear to OpenSSH
| * nixos/initrd-ssh: switch from Dropbear to OpenSSHEmily2020-03-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Dropbear lags behind OpenSSH significantly in both support for modern key formats like `ssh-ed25519`, let alone the recently-introduced U2F/FIDO2-based `sk-ssh-ed25519@openssh.com` (as I found when I switched my `authorizedKeys` over to it and promptly locked myself out of my server's initrd SSH, breaking reboots), as well as security features like multiprocess isolation. Using the same SSH daemon for stage-1 and the main system ensures key formats will always remain compatible, as well as more conveniently allowing the sharing of configuration and host keys. The main reason to use Dropbear over OpenSSH would be initrd space concerns, but NixOS initrds are already large (17 MiB currently on my server), and the size difference between the two isn't huge (the test's initrd goes from 9.7 MiB to 12 MiB with this change). If the size is still a problem, then it would be easy to shrink sshd down to a few hundred kilobytes by using an initrd-specific build that uses musl and disables things like Kerberos support. This passes the test and works on my server, but more rigorous testing and review from people who use initrd SSH would be appreciated!
* | Merge pull request #83309 from mmahut/quorumMarek Mahut2020-03-28
|\ \ | | | | | | nixos/quorum: init
| * | nixos/quorum: initMarek Mahut2020-03-27
| | |
* | | nginx: Fix ETag patch to ignore realpath(3) erroraszlig2020-03-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While our ETag patch works pretty fine if it comes to serving data off store paths, it unfortunately broke something that might be a bit more common, namely when using regexes to extract path components of location directives for example. Recently, @devhell has reported a bug with a nginx location directive like this: location ~^/\~([a-z0-9_]+)(/.*)?$" { alias /home/$1/public_html$2; } While this might look harmless at first glance, it does however cause issues with our ETag patch. The alias directive gets broken up by nginx like this: *2 http script copy: "/home/" *2 http script capture: "foo" *2 http script copy: "/public_html/" *2 http script capture: "bar.txt" In our patch however, we use realpath(3) to get the canonicalised path from ngx_http_core_loc_conf_s.root, which returns the *configured* value from the root or alias directive. So in the example above, realpath(3) boils down to the following syscalls: lstat("/home", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 lstat("/home/$1", 0x7ffd08da6f60) = -1 ENOENT (No such file or directory) During my review[1] of the initial patch, I didn't actually notice that what we're doing here is returning NGX_ERROR if the realpath(3) call fails, which in turn causes an HTTP 500 error. Since our patch actually made the canonicalisation (and thus additional syscalls) necessary, we really shouldn't introduce an additional error so let's - at least for now - silently skip return value if realpath(3) has failed. However since we're using the unaltered root from the config we have another issue, consider this root: /nix/store/...-abcde/$1 Calling realpath(3) on this path will fail (except if there's a file called "$1" of course), so even this fix is not enough because it results in the ETag not being set to the store path hash. While this is very ugly and we should fix this very soon, it's not as serious as getting HTTP 500 errors for serving static files. I added a small NixOS VM test, which uses the example above as a regression test. It seems that my memory is failing these days, since apparently I *knew* about this issue since digging for existing issues in nixpkgs, I found this similar pull request which I even reviewed: https://github.com/NixOS/nixpkgs/pull/66532 However, since the comments weren't addressed and the author hasn't responded to the pull request, I decided to keep this very commit and do a follow-up pull request. [1]: https://github.com/NixOS/nixpkgs/pull/48337 Signed-off-by: aszlig <aszlig@nix.build> Reported-by: @devhell Acked-by: @7c6f434c Acked-by: @yorickvP Merges: https://github.com/NixOS/nixpkgs/pull/80671 Fixes: https://github.com/NixOS/nixpkgs/pull/66532
* | | nixos/tests/mongodb: rewrite with pythonMaximilian Bosch2020-03-26
| | | | | | | | | | | | perl-based VM tests are deprecated.
* | | nixos/tests/mongodb: test against mongodb versions 3.4, 3.6, 4.0Nathan Smyth2020-03-26
| | | | | | | | | | | | | | | Now has tests for 3.4, 3.6, 4.0. Has some duplication, but it appears to work on my machine.
* | | Merge pull request #82929 from zimbatm/nixos-gerritzimbatm2020-03-26
|\ \ \ | | | | | | | | nixos gerrit module
| * | | nixos: add gerrit modulezimbatm2020-03-26
| | | | | | | | | | | | | | | | | | | | Co-authored-by: edef <edef@edef.eu> Co-authored-by: Florian Klink <flokli@flokli.de>
* | | | nixosTests.installer: Don't wait for the nixos-manual serviceMichael Weiss2020-03-26
| |_|/ |/| | | | | | | | | | | | | | | | | | | | The nixos-manual service was removed in #83199 but we missed the check in this test which prevents the "tested" job from succeeding [0][1]. [0]: https://hydra.nixos.org/build/115472896 [1]: https://hydra.nixos.org/build/115472896/nixlog/94/tail
* | | Merge pull request #83042 from aanderse/mysql-fixupOrivej Desh (NixOS)2020-03-23
|\ \ \ | |/ / |/| | nixos/mysql: fix service so it works with mysql80 package
| * | nixos/mysql: test with mysql80 packageAaron Andersen2020-03-21
| |/
* / nixos/griphite: Migrate to python3, drop graphite-pagerLancelot SIX2020-03-22
|/
* nixosTests.fenics: Add basic testJosef Kemetmüller2020-03-19
|
* nixos/networkd: respect systemd.network.links also with disabled ↵Florian Klink2020-03-19
| | | | | | | | | | | systemd-networkd This mirrors the behaviour of systemd - It's udev that parses `.link` files, not `systemd-networkd`. This was originally applied in 36ef112a477034fc6d1d9170bf1bcda0140a8d1d, but was reverted due to 1115959a8d4d73ad73341563dc8bbf52230a281e causing evaluation errors on hydra.
* Merge pull request #79120 from symphorien/iodineLéo Gaspard2020-03-16
|\ | | | | Iodine: ipv6 support, updates, hardening, nixos test....
| * nixos/iodine: add testSymphorien Gibol2020-02-04
| |
* | matrix-synapse: 1.9.1 -> 1.11.1Maximilian Bosch2020-03-15
| | | | | | | | | | | | | | https://github.com/matrix-org/synapse/releases/tag/v1.10.0 https://github.com/matrix-org/synapse/releases/tag/v1.10.1 https://github.com/matrix-org/synapse/releases/tag/v1.11.0 https://github.com/matrix-org/synapse/releases/tag/v1.11.1
* | Revert Merge #82310: nixos/systemd: apply .linkVladimír Čunát2020-03-13
| | | | | | | | | | | | | | | | | | | | | | | | ...even when networkd is disabled This reverts commit ce78f3ac701017008aa7f1db387b871b7ae65e01, reversing changes made to dc34da0755b3c36469965659c0ee4a1337e81c05. I'm sorry; Hydra has been unable to evaluate, always returning > error: unexpected EOF reading a line and I've been unable to reproduce the problem locally. Bisecting pointed to this merge, but I still can't see what exactly was wrong.
* | Merge pull request #81241 from thefloweringash/nesting-systemMichele Guerini Rocco2020-03-13
|\ \ | | | | | | nixos/activation: propagate system to nested configurations
| * | nixosTests.nesting: fix subtest scopingAndrew Childs2020-02-27
| | |
* | | Merge pull request #82310 from flokli/systemd-network-link-no-networkdFlorian Klink2020-03-12
|\ \ \ | | | | | | | | nixos/systemd: apply .link even when networkd is disabled
| * | | nixos/networkd: respect systemd.network.links also with disabled ↵Florian Klink2020-03-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | systemd-networkd This mirrors the behaviour of systemd - It's udev that parses `.link` files, not `systemd-networkd`.
| * | | tests/networking: remove pkgs.lib usages.Félix Baylac-Jacqué2020-03-11
| | | |
* | | | Merge pull request #82148 from devhell/tests_signal-desktopFlorian Klink2020-03-11
|\ \ \ \ | |/ / / |/| | | tests: Fix signal-desktop
| * | | tests: Fix signal-desktopdevhell2020-03-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This test fails due to OOM on the VM. Setting the memory of the VM to 1024 lets the test succeed. Cc: @flokli
* | | | Merge pull request #81941 from volth/patch-390Sarah Brofeldt2020-03-11
|\ \ \ \ | |/ / / |/| | | tests/kubernetes: remove unreferenced variable and import from inexisting file
| * | | tests/kubernetes: remove unreferenced variable and import from inexsisting filevolth2020-03-07
| | | |
* | | | Merge pull request #80921 from hercules-ci/buildLayeredImage-allow-empty-storeDomen Kožar2020-03-08
|\ \ \ \ | |/ / / |/| | | buildLayeredImage: Allow empty store, no paths to add
| * | | buildLayeredImage: Allow empty store, no paths to addRobert Hensing2020-02-28
| | | | | | | | | | | | | | | | | | | | | | | | This is useful when buildLayeredImage is called in a generic way that should allow simple (base) images to be built, which may not reference any store paths.
* | | | nixos/prometheus-mikrotik-exporter: initMartin Milata2020-03-06
| | | |
* | | | nixos/tests/prometheus-exporters: increase memory for rspamdWilliButz2020-03-06
| | | | | | | | | | | | | | | | Before this, the test failed because rspamd did invoke the oom-killer.
* | | | nixos/prometheus-mail-exporter: misc fixesMartin Milata2020-03-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - Fix misspelled option. mkRenamedOptionModule is not used because the option hasn't really worked before. - Add missing cfg.telemetryPath arg to ExecStart. - Fix mkdir invocation in test.
* | | | Merge pull request #81405 from NinjaTrappeur/nin-networkd-policy-rulesMaximilian Bosch2020-03-04
|\ \ \ \ | | | | | | | | | | nixos/networkd: add RoutingPolicyRules-related options
| * | | | nixos/networkd: test routingPolicyRules with a nixos vm testFélix Baylac-Jacqué2020-03-02
| | | | |
* | | | | Merge pull request #81327 from flokli/add-cageFlorian Klink2020-03-03
|\ \ \ \ \ | | | | | | | | | | | | nixos/cage: init
| * | | | | nixos/cage: initMatthew Bauer2020-03-02
| | |/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a cage module to nixos. This can be used to make kiosk-style systems that boot directly to a single application. The user (demo by default) is automatically logged in by this service and the program (xterm by default) is automatically started. This is useful for some embedded, single-user systems where we want automatic booting. To keep the system secure, the user should have limited privileges. Based on the service provided in the Cage wiki here: https://github.com/Hjdskes/cage/wiki/Starting-Cage-on-boot-with-systemd Co-Authored-By: Florian Klink <flokli@flokli.de>
* | | | | Merge pull request #81292 from hercules-ci/fix-service-runner-quotesRobert Hensing2020-03-03
|\ \ \ \ \ | | | | | | | | | | | | nixos/service-runner.nix: Allow quotes in commands + test
| * | | | | nixos/service-runner.nix: Allow quotes in commands + testRobert Hensing2020-02-28
| | |_|/ / | |/| | |
* | | | | Merge pull request #81060 from andir/opensmtpd-timeoutAndreas Rammhold2020-03-03
|\ \ \ \ \ | | | | | | | | | | | | nixos/tests/opensmtpd: bump test (&build) timeout to 30m from 30s
| * | | | | nixos/tests/opensmtpd: bump test (&build) timeout to 30m from 30sAndreas Rammhold2020-02-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I am not sure how this ever passed on hydra but 30s is barely enough to pass the configure phase of opensmtpd. It is likely the package was built as part of another jobset. Whenever it is built as part of the test execution the timeout propagates and 30s is clearly not enough for that.
* | | | | | Merge pull request #80096 from tfc/port-rsyslogd-testFlorian Klink2020-03-02
|\ \ \ \ \ \ | | | | | | | | | | | | | | nixosTests.rsyslogd: Port to python
| * | | | | | nixosTests.rsyslogd: Port to pythonJacek Galowicz2020-02-27
| | |/ / / / | |/| | | |
* | | | | | prometheus-nginx-exporter: 0.5.0 -> 0.6.0 (#81285)WilliButz2020-03-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * prometheus-nginx-exporter: 0.5.0 -> 0.6.0 * nixos/prometheus-nginx-exporter: update for 0.6.0 Added new option constLabels and updated virtualHost name in the exporter's test.
* | | | | | Merge pull request #79532 from NixOS/fix-predictable-ifnames-in-initrdMaximilian Bosch2020-03-02
|\ \ \ \ \ \ | |_|_|_|/ / |/| | | | | nixos/stage-1: fix predictable interface names in initrd
| * | | | | nixos/initrd-network: flush interfaces before stage 2Franz Pletz2020-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Depending on the network management backend being used, if the interface configuration in stage 1 is not cleared, there might still be some old addresses or routes from stage 1 present in stage 2 after network configuration has finished.
| * | | | | nixos/stage-1: fix predictable interfaces namesFranz Pletz2020-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes predictable interfaces names available as soon as possible with udev by adding the default network link units to initrd which are read by udev. Also adds some udev rules that are needed but which would normally loaded from the udev store path which is not included in the initrd.
* | | | | | Merge pull request #81118 from tilpner/gitdaemon-usercreationworldofpeace2020-03-01
|\ \ \ \ \ \ | | | | | | | | | | | | | | nixos/git-daemon: only create git user if it will be used
| * | | | | | nixos/git-daemon: only create git user if it will be usedtilpner2020-02-26
| | |/ / / / | |/| | | |
* | | | | | buildbot: 2.6.0 -> 2.7.0 (#81406)Ben Wolsieffer2020-02-29
| |_|_|/ / |/| | | |
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-06 21:04:19 +0000