SelfPrivacy/selfprivacy-nixos-infect
1
0
Fork 0
mirror of https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-infect.git synced 2024-11-22 12:01:27 +00:00
Code Issues Projects Releases Wiki Activity

use staging ACME with root CA verification

Browse source
This commit is contained in:
Alexander Tomokhov 2023-12-24 15:49:35 +04:00
parent 6171589cc3
commit 867396b274
1 changed files with 11 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
.drone.yml
View file

@ -24,7 +24,7 @@ steps:
cat << EOF > infect.sh cat << EOF > infect.sh
#! /usr/bin/env bash #! /usr/bin/env bash
export STAGING_ACME=false export STAGING_ACME=true
EOF EOF
- echo "curl https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-infect/raw/branch/$INFECT_SOURCE_BRANCH/nixos-infect | PROVIDER=hetzner DOMAIN=$DOMAIN LUSER=cicdcicd USER_PASS=\"$USER_PASS\" DNS_PROVIDER_TOKEN=$CLOUDFLARE_TOKEN DNS_PROVIDER_TYPE=CLOUDFLARE DB_PASSWORD=\"$USER_PASS\" API_TOKEN=\"$USER_PASS\" HOSTNAME=selfprivacy-ci-test NIX_VERSION=2.18.1 NIXOS_CONFIG_NAME=sp-nixos CONFIG_URL=https://git.selfprivacy.org/api/v1/repos/SelfPrivacy/selfprivacy-nixos-template/archive/master.tar.gz SSH_AUTHORIZED_KEY=\"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBb3yVhYF4slhf1iQCiGLOVcbGKP/MmkQiEMl2un+4K\" bash 2>&1 | tee /root/infect.log" >> infect.sh - echo "curl https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-infect/raw/branch/$INFECT_SOURCE_BRANCH/nixos-infect | PROVIDER=hetzner DOMAIN=$DOMAIN LUSER=cicdcicd USER_PASS=\"$USER_PASS\" DNS_PROVIDER_TOKEN=$CLOUDFLARE_TOKEN DNS_PROVIDER_TYPE=CLOUDFLARE DB_PASSWORD=\"$USER_PASS\" API_TOKEN=\"$USER_PASS\" HOSTNAME=selfprivacy-ci-test NIX_VERSION=2.18.1 NIXOS_CONFIG_NAME=sp-nixos CONFIG_URL=https://git.selfprivacy.org/api/v1/repos/SelfPrivacy/selfprivacy-nixos-template/archive/master.tar.gz SSH_AUTHORIZED_KEY=\"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBb3yVhYF4slhf1iQCiGLOVcbGKP/MmkQiEMl2un+4K\" bash 2>&1 | tee /root/infect.log" >> infect.sh
- http -v --check-status --ignore-stdin POST https://api.hetzner.cloud/v1/servers Authorization:"Bearer $PASSWORD" name=ci-sibling server_type=cx11 start_after_create:=true image=ubuntu-20.04 user_data=@infect.sh automount:=false location=fsn1 - http -v --check-status --ignore-stdin POST https://api.hetzner.cloud/v1/servers Authorization:"Bearer $PASSWORD" name=ci-sibling server_type=cx11 start_after_create:=true image=ubuntu-20.04 user_data=@infect.sh automount:=false location=fsn1
@ -87,7 +87,8 @@ steps:
commands: commands:
- sleep 300 - sleep 300
- t0="$(date '+%s')"; until nix shell --inputs-from git+https://git.selfprivacy.org/alexoundos/selfprivacy-tests.git nixpkgs#netcat -c nc -zv -w1 "$DOMAIN" 443; do sleep 10; cur_date="$(date '+%s')"; remaining=$((t0 + TIMEOUT - cur_date)); [ "$remaining" -gt 0 ]; echo "$remaining seconds remain before teardown"; done - t0="$(date '+%s')"; until nix shell --inputs-from git+https://git.selfprivacy.org/alexoundos/selfprivacy-tests.git nixpkgs#netcat -c nc -zv -w1 "$DOMAIN" 443; do sleep 10; cur_date="$(date '+%s')"; remaining=$((t0 + TIMEOUT - cur_date)); [ "$remaining" -gt 0 ]; echo "$remaining seconds remain before teardown"; done
- sleep 10 - echo "give time for obtaining ACME certificate"
- sleep 60
- name: basic test - name: basic test
environment: environment:
@ -103,20 +104,21 @@ steps:
TIMEOUT_1: 100 TIMEOUT_1: 100
commands: commands:
# ideally it should depend on $STAGING_ACME # ideally it should depend on $STAGING_ACME
# INSECURE=$(if [[ $STAGING_ACME == true ]]; then echo "--insecure"; else echo ""; fi) # CERT_VERIFY=$(if [[ $STAGING_ACME == true ]]; then echo "--cacert root.pem"; else echo ""; fi)
- INSECURE="--insecure" - CERT_VERIFY="--cacert root.pem"
- source $(nix build $TESTS_REPO#library --print-out-paths) - source $(nix build $TESTS_REPO#library --print-out-paths)
- curl https://letsencrypt.org/certs/staging/letsencrypt-stg-root-x1.pem -sS --fail -o root.pem
- dig api.$DOMAIN - dig api.$DOMAIN
- > - >
retry $TIMEOUT_1 10 curl https://api.$DOMAIN/services/status --fail-with-body $INSECURE -H "Authorization: Bearer $USER_PASS" retry $TIMEOUT_1 10 curl https://api.$DOMAIN/services/status --fail-with-body $CERT_VERIFY -H "Authorization: Bearer $USER_PASS"
- swaks --to ci@$DOMAIN -s selfprivacy.org -tls -au test@selfprivacy.org -ap $TEST_EMAIL_PASS -ahp - swaks --to ci@$DOMAIN -s selfprivacy.org -tls -au test@selfprivacy.org -ap $TEST_EMAIL_PASS -ahp
- > - >
curl https://cloud.$DOMAIN/ocs/v2.php/apps/serverinfo/api/v1/info?format=json --fail-with-body $INSECURE -u "admin:$USER_PASS" | jq -re ".ocs.meta.status == \"ok\"" curl https://cloud.$DOMAIN/ocs/v2.php/apps/serverinfo/api/v1/info?format=json -sS --fail-with-body $CERT_VERIFY -u "admin:$USER_PASS" | jq -re '.ocs.meta.status == "ok"'
- echo "File to test nextcloud upload" > file - echo 'File to test nextcloud upload' > file
- > - >
curl -X PUT https://cloud.$DOMAIN/remote.php/dav/files/admin/file --fail-with-body $INSECURE -d @file -u "admin:$USER_PASS" curl -X PUT https://cloud.$DOMAIN/remote.php/dav/files/admin/file -sS --fail-with-body $CERT_VERIFY -d @file -u "admin:$USER_PASS"
- > - >
curl https://cloud.$DOMAIN/remote.php/dav/files/admin/file --fail-with-body $INSECURE -u "admin:$USER_PASS" curl https://cloud.$DOMAIN/remote.php/dav/files/admin/file -sS --fail-with-body $CERT_VERIFY -u "admin:$USER_PASS"
- name: API & nixos-rebuild test - name: API & nixos-rebuild test
environment: environment: