tjh.dev
nixpkgs mirror (for testing)
github.com/NixOS/nixpkgs
nix
1import ./make-test-python.nix ({ pkgs, ... }:
2 let
3 certs = import ./common/acme/server/snakeoil-certs.nix;
4 serverDomain = certs.domain;
5 in
6 {
7 name = "kanidm";
8 meta.maintainers = with pkgs.lib.maintainers; [ erictapen Flakebi ];
9
10 nodes.server = { config, pkgs, lib, ... }: {
11 services.kanidm = {
12 enableServer = true;
13 serverSettings = {
14 origin = "https://${serverDomain}";
15 domain = serverDomain;
16 bindaddress = "[::]:443";
17 ldapbindaddress = "[::1]:636";
18 tls_chain = certs."${serverDomain}".cert;
19 tls_key = certs."${serverDomain}".key;
20 };
21 };
22
23 security.pki.certificateFiles = [ certs.ca.cert ];
24
25 networking.hosts."::1" = [ serverDomain ];
26 networking.firewall.allowedTCPPorts = [ 443 ];
27
28 users.users.kanidm.shell = pkgs.bashInteractive;
29
30 environment.systemPackages = with pkgs; [ kanidm openldap ripgrep ];
31 };
32
33 nodes.client = { pkgs, nodes, ... }: {
34 services.kanidm = {
35 enableClient = true;
36 clientSettings = {
37 uri = "https://${serverDomain}";
38 verify_ca = true;
39 verify_hostnames = true;
40 };
41 enablePam = true;
42 unixSettings = {
43 pam_allowed_login_groups = [ "shell" ];
44 };
45 };
46
47 networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ serverDomain ];
48
49 security.pki.certificateFiles = [ certs.ca.cert ];
50 };
51
52 testScript = { nodes, ... }:
53 let
54 ldapBaseDN = builtins.concatStringsSep "," (map (s: "dc=" + s) (pkgs.lib.splitString "." serverDomain));
55
56 # We need access to the config file in the test script.
57 filteredConfig = pkgs.lib.converge
58 (pkgs.lib.filterAttrsRecursive (_: v: v != null))
59 nodes.server.services.kanidm.serverSettings;
60 serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;
61
62 in
63 ''
64 start_all()
65 server.wait_for_unit("kanidm.service")
66
67 with subtest("Test HTTP interface"):
68 server.wait_until_succeeds("curl -sf https://${serverDomain} | grep Kanidm")
69
70 with subtest("Test LDAP interface"):
71 server.succeed("ldapsearch -H ldaps://${serverDomain}:636 -b '${ldapBaseDN}' -x '(name=test)'")
72
73 with subtest("Test CLI login"):
74 client.succeed("kanidm login -D anonymous")
75 client.succeed("kanidm self whoami | grep anonymous@${serverDomain}")
76
77 with subtest("Recover idm_admin account"):
78 # Must stop the server for account recovery or else kanidmd fails with
79 # "unable to lock kanidm exclusive lock at /var/lib/kanidm/kanidm.db.klock".
80 server.succeed("systemctl stop kanidm")
81 server.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '")
82 server.succeed("systemctl start kanidm")
83
84 with subtest("Test unixd connection"):
85 client.wait_for_unit("kanidm-unixd.service")
86 # TODO: client.wait_for_file("/run/kanidm-unixd/sock")
87 client.wait_until_succeeds("kanidm-unix status | grep working!")
88 '';
89 })