mirror of
https://github.com/juanfont/headscale.git
synced 2026-09-29 19:39:37 +09:00
nix: run the headscale VM test on the test kit
Drops nginx, the cert and dead ip_prefixes. Proves DERP relay and TLS noise after a restart, and puts nix/module.nix under CI.
This commit is contained in:
Kristoffer Dalby
committed by
Kristoffer Dalby
Kristoffer Dalby
parent
200c2c01e8
commit
00663fbbfe
@@ -296,12 +296,14 @@
|
||||
}
|
||||
);
|
||||
|
||||
checks = {
|
||||
headscale = pkgs.testers.nixosTest (import ./nix/tests/headscale.nix);
|
||||
}
|
||||
# The Go build/test checks are gated to Linux: parts of the tree are
|
||||
# Linux-specific and the pure unit subset is validated by CI.
|
||||
// pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux goChecks;
|
||||
# Gated to Linux: parts of the tree are Linux-specific, and the VM
|
||||
# test needs KVM.
|
||||
checks = pkgs.lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux (
|
||||
goChecks
|
||||
// {
|
||||
headscale = pkgs.testers.runNixOSTest (import ./nix/tests/headscale.nix self);
|
||||
}
|
||||
);
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
+52
-87
@@ -1,14 +1,18 @@
|
||||
{ pkgs, lib, ... }:
|
||||
# The test kit's contract test, and CI's coverage of nix/module.nix.
|
||||
self:
|
||||
{ lib, pkgs, ... }:
|
||||
let
|
||||
tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
|
||||
openssl req \
|
||||
-x509 -newkey rsa:4096 -sha256 -days 365 \
|
||||
-nodes -out cert.pem -keyout key.pem \
|
||||
-subj '/CN=headscale' -addext "subjectAltName=DNS:headscale"
|
||||
|
||||
mkdir -p $out
|
||||
cp key.pem cert.pem $out
|
||||
'';
|
||||
policy = pkgs.writeText "policy.json" (
|
||||
builtins.toJSON {
|
||||
acls = [
|
||||
{
|
||||
action = "accept";
|
||||
src = [ "*" ];
|
||||
dst = [ "*:*" ];
|
||||
}
|
||||
];
|
||||
}
|
||||
);
|
||||
in
|
||||
{
|
||||
name = "headscale";
|
||||
@@ -17,89 +21,50 @@ in
|
||||
misterio77
|
||||
];
|
||||
|
||||
nodes =
|
||||
let
|
||||
headscalePort = 8080;
|
||||
stunPort = 3478;
|
||||
peer = {
|
||||
services.tailscale.enable = true;
|
||||
security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
|
||||
};
|
||||
in
|
||||
{
|
||||
peer1 = peer;
|
||||
peer2 = peer;
|
||||
|
||||
headscale = {
|
||||
services = {
|
||||
headscale = {
|
||||
enable = true;
|
||||
port = headscalePort;
|
||||
settings = {
|
||||
server_url = "https://headscale";
|
||||
ip_prefixes = [ "100.64.0.0/10" ];
|
||||
derp = {
|
||||
server = {
|
||||
enabled = true;
|
||||
region_id = 999;
|
||||
stun_listen_addr = "0.0.0.0:${toString stunPort}";
|
||||
};
|
||||
urls = [ ];
|
||||
};
|
||||
dns = {
|
||||
base_domain = "tailnet";
|
||||
extra_records = [
|
||||
{
|
||||
name = "foo.bar";
|
||||
type = "A";
|
||||
value = "100.64.0.2";
|
||||
}
|
||||
];
|
||||
override_local_dns = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
nginx = {
|
||||
enable = true;
|
||||
virtualHosts.headscale = {
|
||||
addSSL = true;
|
||||
sslCertificate = "${tls-cert}/cert.pem";
|
||||
sslCertificateKey = "${tls-cert}/key.pem";
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString headscalePort}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
allowedUDPPorts = [ stunPort ];
|
||||
};
|
||||
environment.systemPackages = [ pkgs.headscale ];
|
||||
};
|
||||
nodes = {
|
||||
headscale = {
|
||||
imports = [ self.nixosModules.testkit ];
|
||||
services.headscale.settings.dns.extra_records = [
|
||||
{
|
||||
name = "foo.bar";
|
||||
type = "A";
|
||||
value = "100.64.0.2";
|
||||
}
|
||||
];
|
||||
};
|
||||
# All of peer1's noise goes over the kit's TLS listener, not plain :80.
|
||||
peer1 = {
|
||||
imports = [ self.nixosModules.testkit-peer ];
|
||||
systemd.services.tailscaled.environment.TS_FORCE_NOISE_443 = "1";
|
||||
};
|
||||
# No direct UDP for peer2: its traffic has to cross the kit's DERP.
|
||||
peer2 = {
|
||||
imports = [ self.nixosModules.testkit-peer ];
|
||||
systemd.services.tailscaled.environment.TS_DEBUG_ALWAYS_USE_DERP = "1";
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
from datetime import timedelta
|
||||
|
||||
start_all()
|
||||
headscale.wait_for_unit("headscale")
|
||||
headscale.wait_for_open_port(443)
|
||||
key = headscale.succeed("hs-authkey test").strip()
|
||||
for peer in [peer1, peer2]:
|
||||
peer.succeed(f"hs-join {key}")
|
||||
|
||||
# Create headscale user and preauth-key
|
||||
headscale.succeed("headscale users create test")
|
||||
authkey = headscale.succeed("headscale preauthkeys -u 1 create --reusable")
|
||||
peer1.wait_until_succeeds("tailscale ping --until-direct=false -c 1 peer2 | grep -F 'via DERP(headscale)'")
|
||||
peer2.wait_until_succeeds("tailscale ping --until-direct=false -c 1 peer1.tailnet")
|
||||
res = peer1.wait_until_succeeds("${lib.getExe pkgs.dig} +short foo.bar").strip()
|
||||
assert res == "100.64.0.2", res
|
||||
|
||||
# Connect peers
|
||||
up_cmd = f"tailscale up --login-server 'https://headscale' --auth-key {authkey}"
|
||||
peer1.execute(up_cmd)
|
||||
peer2.execute(up_cmd)
|
||||
headscale.succeed("headscale policy set -f ${policy}")
|
||||
|
||||
# Check that they are reachable from the tailnet
|
||||
peer1.wait_until_succeeds("tailscale ping peer2")
|
||||
peer2.wait_until_succeeds("tailscale ping peer1.tailnet")
|
||||
assert (res := peer1.wait_until_succeeds("${lib.getExe pkgs.dig} +short foo.bar").strip()) == "100.64.0.2", f"Domain {res} did not match 100.64.0.2"
|
||||
# Clients reconnect after a control restart, peer1 over the TLS listener.
|
||||
headscale.systemctl("restart headscale.service")
|
||||
headscale.wait_until_succeeds(
|
||||
"headscale nodes list -o json | ${lib.getExe pkgs.jq} -e 'length == 2 and all(.[]; .online)'",
|
||||
timeout=timedelta(minutes=2),
|
||||
)
|
||||
peer1.wait_until_succeeds("tailscale ping --until-direct=false -c 1 peer2")
|
||||
'';
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user