6c4a459773
`checks.script-test-nats-render-config` runs the queue server's `ExecStartPre` render against a scratch runtime directory: a fetched key lands in `auth_callout.xkey` and the wrapper includes the fragment, and a missing or malformed key file fails the start and writes no config. module-eval only sees the render as a store path, so dropping `xkey` from the template, or its substitution, passed every check while the server would have run unsealed.
50 lines
1.7 KiB
Nix
50 lines
1.7 KiB
Nix
# `checks.script-test-nats-render-config` — runs the queue server's
|
|
# `ExecStartPre`, ../host-modules/swarm-nats.nix's `renderConfig`, which writes
|
|
# the callout xkey into the config `nats-server` reads. The cases are in
|
|
# ./nats-render-config.sh.
|
|
#
|
|
# What runs is the rendered script. The one edit is its runtime directory,
|
|
# moved under the build directory because the sandbox has no writable
|
|
# `/var/lib`.
|
|
{
|
|
pkgs,
|
|
lib,
|
|
self,
|
|
nixosSystem,
|
|
}:
|
|
let
|
|
inherit
|
|
(import ../module-eval/lib.nix {
|
|
inherit
|
|
pkgs
|
|
lib
|
|
self
|
|
nixosSystem
|
|
;
|
|
})
|
|
hive
|
|
;
|
|
|
|
queue = hive {
|
|
deploy.nats.enable = true;
|
|
deploy.nats.autoGenerateCallout = false;
|
|
deploy.nats.calloutUserPublicKey = "UTESTUSERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
|
deploy.nats.calloutIssuerPublicKey = "ATESTISSUERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
|
deploy.nats.calloutUserSeedFile = "/run/secrets/nats-user.seed";
|
|
deploy.nats.calloutIssuerSeedFile = "/run/secrets/nats-issuer.seed";
|
|
deploy.nats.authPackage = pkgs.emptyDirectory;
|
|
deploy.nats.authBaoClientCertFile = "/etc/pki/nats-auth.pem";
|
|
deploy.nats.authBaoClientKeyFile = "/etc/pki/nats-auth-key.pem";
|
|
};
|
|
in
|
|
pkgs.runCommand "hyperhive-script-test-nats-render-config"
|
|
{
|
|
# `removePrefix` keeps the string context, and with it the script's store
|
|
# path among this check's inputs. The `+` is systemd's, not the path's.
|
|
RENDER = lib.removePrefix "+" queue.containers.swarm-nats.config.systemd.services.nats.serviceConfig.ExecStartPre;
|
|
nativeBuildInputs = [ pkgs.jq ];
|
|
}
|
|
''
|
|
${pkgs.bash}/bin/bash ${./nats-render-config.sh}
|
|
touch "$out"
|
|
''
|