mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-21 05:25:38 +00:00
Code Issues Wiki Activity
nixpkgs/nixos/tests/rspamd.nix

256 lines
9.7 KiB
Nix
Raw Normal View History

tests: refactor to carry the package set as an argument This way, the package set will be possible to pass without re-importing all the time
2018-11-11 08:41:11 +00:00
{ system ? builtins.currentSystem,
config ? {},
pkgs ? import ../.. { inherit system config; }
}:
with import ../lib/testing.nix { inherit system pkgs; };
nixos/tests: add basic tests for services.rspamd
2018-02-02 00:35:32 +00:00
with pkgs.lib;
tests: refactor to carry the package set as an argument This way, the package set will be possible to pass without re-importing all the time
2018-11-11 08:41:11 +00:00
nixos/tests: add basic tests for services.rspamd
2018-02-02 00:35:32 +00:00
let
initMachine = ''
startAll
$machine->waitForUnit("rspamd.service");
$machine->succeed("id \"rspamd\" >/dev/null");
'';
checkSocket = socket: user: group: mode: ''
$machine->succeed("ls ${socket} >/dev/null");
$machine->succeed("[[ \"\$(stat -c %U ${socket})\" == \"${user}\" ]]");
$machine->succeed("[[ \"\$(stat -c %G ${socket})\" == \"${group}\" ]]");
$machine->succeed("[[ \"\$(stat -c %a ${socket})\" == \"${mode}\" ]]");
'';
nixos/rspamd: Remove non-working socket activation The socket activation I added to the rspamd module doesn't actually work and can't be made to work without changes to rspamd. See: #47421 See: rspamd/rspamd#2035
2018-09-28 03:00:24 +01:00
simple = name: enableIPv6: makeTest {
nixos/tests: add basic tests for services.rspamd
2018-02-02 00:35:32 +00:00
name = "rspamd-${name}";
machine = {
nixos/rspamd: Remove non-working socket activation The socket activation I added to the rspamd module doesn't actually work and can't be made to work without changes to rspamd. See: #47421 See: rspamd/rspamd#2035
2018-09-28 03:00:24 +01:00
services.rspamd.enable = true;
nixos/tests: add basic tests for services.rspamd
2018-02-02 00:35:32 +00:00
networking.enableIPv6 = enableIPv6;
};
testScript = ''
startAll
$machine->waitForUnit("multi-user.target");
$machine->waitForOpenPort(11334);
$machine->waitForUnit("rspamd.service");
$machine->succeed("id \"rspamd\" >/dev/null");
${checkSocket "/run/rspamd/rspamd.sock" "rspamd" "rspamd" "660" }
sleep 10;
nixos/rspamd: Add support for included files By default rspamd will look for multiple files in /etc/rspamd/local.d and /etc/rspamd/override.d to be included in subsections of the merged final config for rspamd. Most of the config snippets in the official rspamd documentation are made to these files and so it makes sense for NixOS to support them and this is what this commit does. As part of rspamd 1.8.1 support was added for having custom Lua rules stored in $LOCAL_CONFDIR/rspamd.local.lua which means that it is now possible for NixOS to support such rules and so this commit also adds support for this to the rspamd module.
2018-11-01 22:55:44 +00:00
$machine->log($machine->succeed("cat /etc/rspamd/rspamd.conf"));
nixos/rspamd: Support multiple workers When the workers option for rspamd was originally implemented it was based on a flawed understanding of how workers are configured in rspamd. This meant that while rspamd supports configuring multiple workers of the same type, so that different controller workers could have different passwords, the NixOS module did not support this because it would write an invalid configuration file if you tried. Specifically a configuration like the one below: ``` workers.controller = {}; workers.controller2 = { type = "controller"; }; ``` Would result in a rspamd configuration of: ``` worker { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller2" { type = "controller"; count = 1; } ``` While to get multiple controller workers it should instead be: ``` worker "controller" { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller" { type = "controller"; count = 1; } ```
2018-11-05 23:26:55 +00:00
$machine->log($machine->succeed("grep 'CONFDIR/worker-controller.inc' /etc/rspamd/rspamd.conf"));
$machine->log($machine->succeed("grep 'CONFDIR/worker-normal.inc' /etc/rspamd/rspamd.conf"));
nixos/tests: add basic tests for services.rspamd
2018-02-02 00:35:32 +00:00
$machine->log($machine->succeed("systemctl cat rspamd.service"));
$machine->log($machine->succeed("curl http://localhost:11334/auth"));
$machine->log($machine->succeed("curl http://127.0.0.1:11334/auth"));
${optionalString enableIPv6 ''
$machine->log($machine->succeed("curl http://[::1]:11334/auth"));
''}
'';
};
in
{
nixos/rspamd: Remove non-working socket activation The socket activation I added to the rspamd module doesn't actually work and can't be made to work without changes to rspamd. See: #47421 See: rspamd/rspamd#2035
2018-09-28 03:00:24 +01:00
simple = simple "simple" true;
ipv4only = simple "ipv4only" false;
nixos/rspamd: options for worker configuration and socket activation
2018-02-03 18:04:31 +00:00
deprecated = makeTest {
name = "rspamd-deprecated";
nixos/tests: add basic tests for services.rspamd
2018-02-02 00:35:32 +00:00
machine = {
services.rspamd = {
enable = true;
bindSocket = [ "/run/rspamd.sock mode=0600 user=root group=root" ];
bindUISocket = [ "/run/rspamd-worker.sock mode=0666 user=root group=root" ];
};
};
testScript = ''
${initMachine}
$machine->waitForFile("/run/rspamd.sock");
${checkSocket "/run/rspamd.sock" "root" "root" "600" }
${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" }
nixos/rspamd: Add support for included files By default rspamd will look for multiple files in /etc/rspamd/local.d and /etc/rspamd/override.d to be included in subsections of the merged final config for rspamd. Most of the config snippets in the official rspamd documentation are made to these files and so it makes sense for NixOS to support them and this is what this commit does. As part of rspamd 1.8.1 support was added for having custom Lua rules stored in $LOCAL_CONFDIR/rspamd.local.lua which means that it is now possible for NixOS to support such rules and so this commit also adds support for this to the rspamd module.
2018-11-01 22:55:44 +00:00
$machine->log($machine->succeed("cat /etc/rspamd/rspamd.conf"));
nixos/rspamd: Support multiple workers When the workers option for rspamd was originally implemented it was based on a flawed understanding of how workers are configured in rspamd. This meant that while rspamd supports configuring multiple workers of the same type, so that different controller workers could have different passwords, the NixOS module did not support this because it would write an invalid configuration file if you tried. Specifically a configuration like the one below: ``` workers.controller = {}; workers.controller2 = { type = "controller"; }; ``` Would result in a rspamd configuration of: ``` worker { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller2" { type = "controller"; count = 1; } ``` While to get multiple controller workers it should instead be: ``` worker "controller" { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller" { type = "controller"; count = 1; } ```
2018-11-05 23:26:55 +00:00
$machine->log($machine->succeed("grep 'CONFDIR/worker-controller.inc' /etc/rspamd/rspamd.conf"));
$machine->log($machine->succeed("grep 'CONFDIR/worker-normal.inc' /etc/rspamd/rspamd.conf"));
nixos/rspamd: options for worker configuration and socket activation
2018-02-03 18:04:31 +00:00
$machine->log($machine->succeed("rspamc -h /run/rspamd-worker.sock stat"));
$machine->log($machine->succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping"));
'';
};
bindports = makeTest {
name = "rspamd-bindports";
machine = {
services.rspamd = {
enable = true;
workers.normal.bindSockets = [{
socket = "/run/rspamd.sock";
mode = "0600";
owner = "root";
group = "root";
}];
workers.controller.bindSockets = [{
socket = "/run/rspamd-worker.sock";
mode = "0666";
owner = "root";
group = "root";
}];
nixos/rspamd: Support multiple workers When the workers option for rspamd was originally implemented it was based on a flawed understanding of how workers are configured in rspamd. This meant that while rspamd supports configuring multiple workers of the same type, so that different controller workers could have different passwords, the NixOS module did not support this because it would write an invalid configuration file if you tried. Specifically a configuration like the one below: ``` workers.controller = {}; workers.controller2 = { type = "controller"; }; ``` Would result in a rspamd configuration of: ``` worker { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller2" { type = "controller"; count = 1; } ``` While to get multiple controller workers it should instead be: ``` worker "controller" { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller" { type = "controller"; count = 1; } ```
2018-11-05 23:26:55 +00:00
workers.controller2 = {
type = "controller";
bindSockets = [ "0.0.0.0:11335" ];
extraConfig = ''
static_dir = "''${WWWDIR}";
secure_ip = null;
password = "verysecretpassword";
'';
};
nixos/rspamd: options for worker configuration and socket activation
2018-02-03 18:04:31 +00:00
};
};
testScript = ''
${initMachine}
$machine->waitForFile("/run/rspamd.sock");
${checkSocket "/run/rspamd.sock" "root" "root" "600" }
${checkSocket "/run/rspamd-worker.sock" "root" "root" "666" }
nixos/rspamd: Add support for included files By default rspamd will look for multiple files in /etc/rspamd/local.d and /etc/rspamd/override.d to be included in subsections of the merged final config for rspamd. Most of the config snippets in the official rspamd documentation are made to these files and so it makes sense for NixOS to support them and this is what this commit does. As part of rspamd 1.8.1 support was added for having custom Lua rules stored in $LOCAL_CONFDIR/rspamd.local.lua which means that it is now possible for NixOS to support such rules and so this commit also adds support for this to the rspamd module.
2018-11-01 22:55:44 +00:00
$machine->log($machine->succeed("cat /etc/rspamd/rspamd.conf"));
nixos/rspamd: Support multiple workers When the workers option for rspamd was originally implemented it was based on a flawed understanding of how workers are configured in rspamd. This meant that while rspamd supports configuring multiple workers of the same type, so that different controller workers could have different passwords, the NixOS module did not support this because it would write an invalid configuration file if you tried. Specifically a configuration like the one below: ``` workers.controller = {}; workers.controller2 = { type = "controller"; }; ``` Would result in a rspamd configuration of: ``` worker { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller2" { type = "controller"; count = 1; } ``` While to get multiple controller workers it should instead be: ``` worker "controller" { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller" { type = "controller"; count = 1; } ```
2018-11-05 23:26:55 +00:00
$machine->log($machine->succeed("grep 'CONFDIR/worker-controller.inc' /etc/rspamd/rspamd.conf"));
$machine->log($machine->succeed("grep 'CONFDIR/worker-normal.inc' /etc/rspamd/rspamd.conf"));
nixos/rspamd: Put extraConfig in included files The lines stored in `extraConfig` and `worker.<name?>.extraConfig` should take precedent over values from included files but in order to do this in rspamd UCL they need to be stored in a file that then gets included with a high priority. This commit uses the overrides option to store the value of the two `extraConfig` options in `extra-config.inc` and `worker-<name?>.inc` respectively.
2018-11-05 23:34:23 +00:00
$machine->log($machine->succeed("grep 'LOCAL_CONFDIR/override.d/worker-controller2.inc' /etc/rspamd/rspamd.conf"));
$machine->log($machine->succeed("grep 'verysecretpassword' /etc/rspamd/override.d/worker-controller2.inc"));
nixos/rspamd: Support multiple workers When the workers option for rspamd was originally implemented it was based on a flawed understanding of how workers are configured in rspamd. This meant that while rspamd supports configuring multiple workers of the same type, so that different controller workers could have different passwords, the NixOS module did not support this because it would write an invalid configuration file if you tried. Specifically a configuration like the one below: ``` workers.controller = {}; workers.controller2 = { type = "controller"; }; ``` Would result in a rspamd configuration of: ``` worker { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller2" { type = "controller"; count = 1; } ``` While to get multiple controller workers it should instead be: ``` worker "controller" { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller" { type = "controller"; count = 1; } ```
2018-11-05 23:26:55 +00:00
$machine->waitUntilSucceeds("journalctl -u rspamd | grep -i 'starting controller process' >&2");
nixos/tests: add basic tests for services.rspamd
2018-02-02 00:35:32 +00:00
$machine->log($machine->succeed("rspamc -h /run/rspamd-worker.sock stat"));
$machine->log($machine->succeed("curl --unix-socket /run/rspamd-worker.sock http://localhost/ping"));
nixos/rspamd: Support multiple workers When the workers option for rspamd was originally implemented it was based on a flawed understanding of how workers are configured in rspamd. This meant that while rspamd supports configuring multiple workers of the same type, so that different controller workers could have different passwords, the NixOS module did not support this because it would write an invalid configuration file if you tried. Specifically a configuration like the one below: ``` workers.controller = {}; workers.controller2 = { type = "controller"; }; ``` Would result in a rspamd configuration of: ``` worker { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller2" { type = "controller"; count = 1; } ``` While to get multiple controller workers it should instead be: ``` worker "controller" { type = "controller"; count = 1; .include "$CONFDIR/worker-controller.inc" } worker "controller" { type = "controller"; count = 1; } ```
2018-11-05 23:26:55 +00:00
$machine->log($machine->succeed("curl http://localhost:11335/ping"));
nixos/tests: add basic tests for services.rspamd
2018-02-02 00:35:32 +00:00
'';
};
nixos/rspamd: Add support for included files By default rspamd will look for multiple files in /etc/rspamd/local.d and /etc/rspamd/override.d to be included in subsections of the merged final config for rspamd. Most of the config snippets in the official rspamd documentation are made to these files and so it makes sense for NixOS to support them and this is what this commit does. As part of rspamd 1.8.1 support was added for having custom Lua rules stored in $LOCAL_CONFDIR/rspamd.local.lua which means that it is now possible for NixOS to support such rules and so this commit also adds support for this to the rspamd module.
2018-11-01 22:55:44 +00:00
customLuaRules = makeTest {
name = "rspamd-custom-lua-rules";
machine = {
environment.etc."tests/no-muh.eml".text = ''
From: Sheep1<bah@example.com>
To: Sheep2<mah@example.com>
Subject: Evil cows
I find cows to be evil don't you?
'';
environment.etc."tests/muh.eml".text = ''
From: Cow<cow@example.com>
To: Sheep2<mah@example.com>
Subject: Evil cows
Cows are majestic creatures don't Muh agree?
'';
services.rspamd = {
enable = true;
nixos/rspamd: Fix enable for locals and overrides When implementing #49620 I included an enable option for both the locals and overrides options but the code writing the files didn't actually look at enable and so would write the file regardless of its value. I also set the type to loaOf which should have been attrsOf since the code was not written to handle the options being lists. This fixes both of those issues.
2018-11-05 16:50:34 +00:00
locals = {
"antivirus.conf" = mkIf false { text = ''
clamav {
action = "reject";
symbol = "CLAM_VIRUS";
type = "clamav";
log_clean = true;
servers = "/run/clamav/clamd.ctl";
}
'';};
"redis.conf" = {
enable = false;
text = ''
servers = "127.0.0.1";
'';
};
"groups.conf".text = ''
group "cows" {
symbol {
NO_MUH = {
weight = 1.0;
description = "Mails should not muh";
}
nixos/rspamd: Add support for included files By default rspamd will look for multiple files in /etc/rspamd/local.d and /etc/rspamd/override.d to be included in subsections of the merged final config for rspamd. Most of the config snippets in the official rspamd documentation are made to these files and so it makes sense for NixOS to support them and this is what this commit does. As part of rspamd 1.8.1 support was added for having custom Lua rules stored in $LOCAL_CONFDIR/rspamd.local.lua which means that it is now possible for NixOS to support such rules and so this commit also adds support for this to the rspamd module.
2018-11-01 22:55:44 +00:00
}
}
nixos/rspamd: Fix enable for locals and overrides When implementing #49620 I included an enable option for both the locals and overrides options but the code writing the files didn't actually look at enable and so would write the file regardless of its value. I also set the type to loaOf which should have been attrsOf since the code was not written to handle the options being lists. This fixes both of those issues.
2018-11-05 16:50:34 +00:00
'';
};
nixos/rspamd: Add support for included files By default rspamd will look for multiple files in /etc/rspamd/local.d and /etc/rspamd/override.d to be included in subsections of the merged final config for rspamd. Most of the config snippets in the official rspamd documentation are made to these files and so it makes sense for NixOS to support them and this is what this commit does. As part of rspamd 1.8.1 support was added for having custom Lua rules stored in $LOCAL_CONFDIR/rspamd.local.lua which means that it is now possible for NixOS to support such rules and so this commit also adds support for this to the rspamd module.
2018-11-01 22:55:44 +00:00
localLuaRules = pkgs.writeText "rspamd.local.lua" ''
local rspamd_logger = require "rspamd_logger"
rspamd_config.NO_MUH = {
callback = function (task)
local parts = task:get_text_parts()
if parts then
for _,part in ipairs(parts) do
local content = tostring(part:get_content())
rspamd_logger.infox(rspamd_config, 'Found content %s', content)
local found = string.find(content, "Muh");
rspamd_logger.infox(rspamd_config, 'Found muh %s', tostring(found))
if found then
return true
end
end
end
return false
end,
score = 5.0,
description = 'Allow no cows',
group = "cows",
}
rspamd_logger.infox(rspamd_config, 'Work dammit!!!')
'';
};
};
testScript = ''
${initMachine}
$machine->waitForOpenPort(11334);
$machine->log($machine->succeed("cat /etc/rspamd/rspamd.conf"));
$machine->log($machine->succeed("cat /etc/rspamd/rspamd.local.lua"));
$machine->log($machine->succeed("cat /etc/rspamd/local.d/groups.conf"));
nixos/rspamd: Fix enable for locals and overrides When implementing #49620 I included an enable option for both the locals and overrides options but the code writing the files didn't actually look at enable and so would write the file regardless of its value. I also set the type to loaOf which should have been attrsOf since the code was not written to handle the options being lists. This fixes both of those issues.
2018-11-05 16:50:34 +00:00
# Verify that redis.conf was not written
$machine->fail("cat /etc/rspamd/local.d/redis.conf >&2");
# Verify that antivirus.conf was not written
$machine->fail("cat /etc/rspamd/local.d/antivirus.conf >&2");
nixos/rspamd: Add support for included files By default rspamd will look for multiple files in /etc/rspamd/local.d and /etc/rspamd/override.d to be included in subsections of the merged final config for rspamd. Most of the config snippets in the official rspamd documentation are made to these files and so it makes sense for NixOS to support them and this is what this commit does. As part of rspamd 1.8.1 support was added for having custom Lua rules stored in $LOCAL_CONFDIR/rspamd.local.lua which means that it is now possible for NixOS to support such rules and so this commit also adds support for this to the rspamd module.
2018-11-01 22:55:44 +00:00
${checkSocket "/run/rspamd/rspamd.sock" "rspamd" "rspamd" "660" }
$machine->log($machine->succeed("curl --unix-socket /run/rspamd/rspamd.sock http://localhost/ping"));
$machine->log($machine->succeed("rspamc -h 127.0.0.1:11334 stat"));
$machine->log($machine->succeed("cat /etc/tests/no-muh.eml | rspamc -h 127.0.0.1:11334"));
$machine->log($machine->succeed("cat /etc/tests/muh.eml | rspamc -h 127.0.0.1:11334 symbols"));
$machine->waitUntilSucceeds("journalctl -u rspamd | grep -i muh >&2");
$machine->log($machine->fail("cat /etc/tests/no-muh.eml | rspamc -h 127.0.0.1:11334 symbols | grep NO_MUH"));
$machine->log($machine->succeed("cat /etc/tests/muh.eml | rspamc -h 127.0.0.1:11334 symbols | grep NO_MUH"));
'';
};
nixos/rspamd: Add options for postfix integration The `rmilter` module has options for configuring `postfix` to use it but since that module is deprecated because rspamd now has a builtin worker that supports the milter protocol this commit adds similar `postfix` integration options directly to the `rspamd` module.
2018-11-05 23:40:52 +00:00
postfixIntegration = makeTest {
name = "rspamd-postfix-integration";
machine = {
environment.systemPackages = with pkgs; [ msmtp ];
environment.etc."tests/gtube.eml".text = ''
From: Sheep1<bah@example.com>
To: Sheep2<tester@example.com>
Subject: Evil cows
I find cows to be evil don't you?
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
'';
environment.etc."tests/example.eml".text = ''
From: Sheep1<bah@example.com>
To: Sheep2<tester@example.com>
Subject: Evil cows
I find cows to be evil don't you?
'';
users.users.tester.password = "test";
services.postfix = {
enable = true;
destination = ["example.com"];
};
services.rspamd = {
enable = true;
postfix.enable = true;
nixos/rspamd: Allow worker type to be proxy again When reworking the rspamd workers I disallowed `proxy` as a type and instead used `rspamd_proxy` which is the correct name for that worker type. That change breaks peoples existing config and so I have made this commit which allows `proxy` as a worker type again but makes it behave as `rspamd_proxy` and prints a warning if you use it.
2018-11-25 05:10:30 +00:00
workers.rspamd_proxy.type = "proxy";
nixos/rspamd: Add options for postfix integration The `rmilter` module has options for configuring `postfix` to use it but since that module is deprecated because rspamd now has a builtin worker that supports the milter protocol this commit adds similar `postfix` integration options directly to the `rspamd` module.
2018-11-05 23:40:52 +00:00
};
};
testScript = ''
${initMachine}
$machine->waitForOpenPort(11334);
$machine->waitForOpenPort(25);
${checkSocket "/run/rspamd/rspamd-milter.sock" "rspamd" "postfix" "660" }
$machine->log($machine->succeed("rspamc -h 127.0.0.1:11334 stat"));
$machine->log($machine->succeed("msmtp --host=localhost -t --read-envelope-from < /etc/tests/example.eml"));
$machine->log($machine->fail("msmtp --host=localhost -t --read-envelope-from < /etc/tests/gtube.eml"));
$machine->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
$machine->fail("journalctl -u postfix | grep -i error >&2");
$machine->fail("journalctl -u postfix | grep -i warning >&2");
'';
};
nixos/tests: add basic tests for services.rspamd
2018-02-02 00:35:32 +00:00
}
Copy permalink