vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats: test that the server's rendered config carries the callout xkey

Browse source 
`checks.script-test-nats-render-config` runs the queue server's
`ExecStartPre` render against a scratch runtime directory: a fetched key
lands in `auth_callout.xkey` and the wrapper includes the fragment, and
a missing or malformed key file fails the start and writes no config.

module-eval only sees the render as a store path, so dropping `xkey`
from the template, or its substitution, passed every check while the
server would have run unsealed.
This commit is contained in:
atlas 2026-10-05 22:13:59 +02:00 • committed by mara
commit 6c4a459773
3 changed files with 116 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

50
nix/script-tests/nats-render-config.nix Normal file
View file

@ -0,0 +1,50 @@
# `checks.script-test-nats-render-config` — runs the queue server's
# `ExecStartPre`, ../host-modules/swarm-nats.nix's `renderConfig`, which writes
# the callout xkey into the config `nats-server` reads. The cases are in
# ./nats-render-config.sh.
#
# What runs is the rendered script. The one edit is its runtime directory,
# moved under the build directory because the sandbox has no writable
# `/var/lib`.
{
pkgs,
lib,
self,
nixosSystem,
}:
let
inherit
(import ../module-eval/lib.nix {
inherit
pkgs
lib
self
nixosSystem
;
})
hive
;
queue = hive {
deploy.nats.enable = true;
deploy.nats.autoGenerateCallout = false;
deploy.nats.calloutUserPublicKey = "UTESTUSERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
deploy.nats.calloutIssuerPublicKey = "ATESTISSUERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
deploy.nats.calloutUserSeedFile = "/run/secrets/nats-user.seed";
deploy.nats.calloutIssuerSeedFile = "/run/secrets/nats-issuer.seed";
deploy.nats.authPackage = pkgs.emptyDirectory;
deploy.nats.authBaoClientCertFile = "/etc/pki/nats-auth.pem";
deploy.nats.authBaoClientKeyFile = "/etc/pki/nats-auth-key.pem";
};
in
pkgs.runCommand "hyperhive-script-test-nats-render-config"
{
# `removePrefix` keeps the string context, and with it the script's store
# path among this check's inputs. The `+` is systemd's, not the path's.
RENDER = lib.removePrefix "+" queue.containers.swarm-nats.config.systemd.services.nats.serviceConfig.ExecStartPre;
nativeBuildInputs = [ pkgs.jq ];
}
''
${pkgs.bash}/bin/bash ${./nats-render-config.sh}
touch "$out"
''