WIP: test: Set up service tests

checks/default.nix

@@ -6,6 +6,8 @@ let
 in
 {
   x86_64-linux = lib.mergeAttrsList [
+    flake-inputs.self.nixosConfigurations.hetzner-1.config.serviceTests
+
     {
       nix = checkLib.mkLint {
         name = "nix-lints";

configuration/default.nix

@@ -11,7 +11,7 @@
     flake-inputs.tlaternet-webserver.nixosModules.default
 
     "${modulesPath}/profiles/minimal.nix"
-    (import ../modules)
+    ../modules
 
     ./services/backups.nix
     ./services/battery-manager.nix
@@ -28,11 +28,8 @@
     # ./services/starbound.nix -- Not currently used
     ./services/postgres.nix
     ./nginx
-    ./sops.nix
   ];
 
-  nixpkgs.overlays = [ (_: prev: { local = import ../pkgs { pkgs = prev; }; }) ];
-
   nix = {
     extraOptions = ''
       experimental-features = nix-command flakes
@@ -124,6 +121,7 @@
       services.sudo.rssh = true;
     };
   };
+  sops.defaultSopsFile = ../keys/production.yaml;
 
   # Remove some unneeded packages
   environment.defaultPackages = [ ];

configuration/nginx/default.nix

@@ -1,4 +1,9 @@
-{ lib, ... }:
+{
+  flake-inputs,
+  pkgs,
+  lib,
+  ...
+}:
 {
   imports = [
     ./logging.nix
@@ -10,13 +15,69 @@
     description = "The base domain name to append to virtual domain names";
   };
 
-  config.services.nginx = {
-    enable = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedProxySettings = true;
-    clientMaxBodySize = "10G";
-    statusPage = true; # For metrics, should be accessible only from localhost
+  config = {
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedProxySettings = true;
+      clientMaxBodySize = "10G";
+      statusPage = true; # For metrics, should be accessible only from localhost
+    };
+
+    serviceTests =
+      let
+        testHostConfig =
+          { config, ... }:
+          {
+            _module.args = { inherit flake-inputs; };
+            imports = [
+              ./.
+              ../../modules/serviceTests/mocks.nix
+              flake-inputs.sops-nix.nixosModules.sops
+            ];
+
+            networking.firewall.allowedTCPPorts = [
+              80
+              443
+            ];
+
+            services.nginx = {
+              domain = "testHost";
+
+              virtualHosts."${config.services.nginx.domain}" = {
+                useACMEHost = "tlater.net";
+                forceSSL = true;
+                enableHSTS = true;
+                locations."/".return = "200 ok";
+              };
+            };
+          };
+      in
+      {
+        hstsIsSet = pkgs.testers.runNixOSTest {
+          name = "assert-hsts";
+          nodes = {
+            testHost = testHostConfig;
+
+            client =
+              { pkgs, ... }:
+              {
+                environment.systemPackages = [ pkgs.curl ];
+              };
+          };
+
+          testScript = ''
+            start_all()
+
+            testHost.wait_for_unit("nginx")
+            testHost.succeed("systemctl start network-online.target")
+            testHost.wait_for_unit("network-online.target")
+
+            client.succeed("curl --max-time 10 https://testHost")
+          '';
+        };
+      };
   };
 }

configuration/nginx/ssl.nix

@@ -64,5 +64,10 @@
         in
         ''${pkgs.runtimeShell} -c '${confirm}' '';
     };
+
+    sops.secrets = {
+      "porkbun/api-key".owner = "acme";
+      "porkbun/secret-api-key".owner = "acme";
+    };
   };
 }

configuration/services/backups.nix

@@ -265,5 +265,18 @@ in
       };
       groups.backup = { };
     };
+
+    sops.secrets = {
+      "restic/storagebox-backups" = {
+        owner = "root";
+        group = "backup";
+        mode = "0440";
+      };
+      "restic/storagebox-ssh-key" = {
+        owner = "backup";
+        group = "backup";
+        mode = "0040";
+      };
+    };
   };
 }

configuration/services/battery-manager.nix

@@ -13,4 +13,9 @@
       log_level = "DEBUG";
     };
   };
+
+  sops.secrets = {
+    "battery-manager/email" = { };
+    "battery-manager/password" = { };
+  };
 }

configuration/services/conduit/default.nix

@@ -179,4 +179,11 @@ in
   systemd.services.coturn.serviceConfig.SupplementaryGroups = [
     config.security.acme.certs."tlater.net".group
   ];
+
+  sops.secrets = {
+    "turn/env" = { };
+    "turn/secret" = {
+      owner = "turnserver";
+    };
+  };
 }

configuration/services/conduit/heisenbridge.nix

@@ -75,4 +75,10 @@ in
         # AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
       };
     };
+
+  sops.secrets = {
+    # Accessed via systemd cred through /run/secrets/heisebridge
+    "heisenbridge/as-token" = { };
+    "heisenbridge/hs-token" = { };
+  };
 }

configuration/services/conduit/matrix-hookshot.nix

@@ -163,4 +163,10 @@ in
       metrics.enabled = true;
     };
   };
+
+  sops.secrets = {
+    # Accessed via systemd cred through /run/secrets/matrix-hookshot
+    "matrix-hookshot/as-token" = { };
+    "matrix-hookshot/hs-token" = { };
+  };
 }

configuration/services/metrics/grafana.nix

@@ -67,4 +67,15 @@ in
       };
     };
   };
+
+  sops.secrets = {
+    "grafana/adminPassword" = {
+      owner = "grafana";
+      group = "grafana";
+    };
+    "grafana/secretKey" = {
+      owner = "grafana";
+      group = "grafana";
+    };
+  };
 }

configuration/services/metrics/victoriametrics.nix

@@ -4,7 +4,7 @@ let
   blackbox_port = config.services.prometheus.exporters.blackbox.port;
 in
 {
-  config.services.victoriametrics = {
+  services.victoriametrics = {
     enable = true;
     extraOptions = [ "-storage.minFreeDiskSpaceBytes=5GB" ];
 
@@ -96,4 +96,10 @@ in
       victorialogs.targets = [ config.services.victorialogs.bindAddress ];
     };
   };
+
+  sops.secrets."forgejo/metrics-token" = {
+    owner = "forgejo";
+    group = "metrics";
+    mode = "0440";
+  };
 }

configuration/services/nextcloud.nix

@@ -100,4 +100,9 @@ in
 
   # Ensure that this service doesn't start before postgres is ready
   systemd.services.nextcloud-setup.after = [ "postgresql.service" ];
+
+  sops.secrets."nextcloud/tlater" = {
+    owner = "nextcloud";
+    group = "nextcloud";
+  };
 }

configuration/services/starbound.nix

@@ -1,4 +1,9 @@
-{ pkgs, lib, ... }:
+{
+  flake-inputs,
+  pkgs,
+  lib,
+  ...
+}:
 let
   inherit (lib) concatStringsSep;
 in
@@ -11,7 +16,9 @@ in
     after = [ "network.target" ];
 
     serviceConfig = {
-      ExecStart = "${pkgs.local.starbound}/bin/launch-starbound ${./configs/starbound.json}";
+      ExecStart = "${
+        flake-inputs.self.packages.${pkgs.system}.starbound
+      }/bin/launch-starbound ${./configs/starbound.json}";
 
       Type = "simple";
 
@@ -114,4 +121,7 @@ in
     paths = [ "/var/lib/private/starbound/storage/universe/" ];
     pauseServices = [ "starbound.service" ];
   };
+
+  # Accessed via systemd cred through /run/secrets/steam
+  sops.secrets."steam/tlater" = { };
 }

configuration/services/wireguard.nix

@@ -62,4 +62,10 @@
       };
     };
   };
+
+  sops.secrets."wireguard/server-key" = {
+    owner = "root";
+    group = "systemd-network";
+    mode = "0440";
+  };
 }

configuration/sops.nix

@@ -1,89 +0,0 @@
-{
-  sops = {
-    defaultSopsFile = ../keys/production.yaml;
-
-    secrets = {
-      "battery-manager/email" = { };
-
-      "battery-manager/password" = { };
-
-      # Gitea
-      "forgejo/metrics-token" = {
-        owner = "forgejo";
-        group = "metrics";
-        mode = "0440";
-      };
-
-      # Grafana
-      "grafana/adminPassword" = {
-        owner = "grafana";
-        group = "grafana";
-      };
-      "grafana/secretKey" = {
-        owner = "grafana";
-        group = "grafana";
-      };
-
-      # Heisenbridge
-      "heisenbridge/as-token" = { };
-      "heisenbridge/hs-token" = { };
-
-      # Matrix-hookshot
-      "matrix-hookshot/as-token" = { };
-      "matrix-hookshot/hs-token" = { };
-
-      # Nextcloud
-      "nextcloud/tlater" = {
-        owner = "nextcloud";
-        group = "nextcloud";
-      };
-
-      # Porkbub/ACME
-      "porkbun/api-key" = {
-        owner = "acme";
-      };
-      "porkbun/secret-api-key" = {
-        owner = "acme";
-      };
-
-      # Restic
-      "restic/local-backups" = {
-        owner = "root";
-        group = "backup";
-        mode = "0440";
-      };
-      "restic/storagebox-backups" = {
-        owner = "root";
-        group = "backup";
-        mode = "0440";
-      };
-      "restic/storagebox-ssh-key" = {
-        owner = "backup";
-        group = "backup";
-        mode = "0040";
-      };
-
-      # Steam
-      "steam/tlater" = { };
-
-      # Turn
-      "turn/env" = { };
-      "turn/secret" = {
-        owner = "turnserver";
-      };
-      "turn/ssl-key" = {
-        owner = "turnserver";
-      };
-      "turn/ssl-cert" = {
-        owner = "turnserver";
-      };
-
-      # Wireguard
-      "wireguard/server-key" = {
-        owner = "root";
-        group = "systemd-network";
-        mode = "0440";
-      };
-    };
-  };
-}

flake.lock

@@ -136,11 +136,11 @@
         "pyproject-nix": "pyproject-nix"
       },
       "locked": {
-        "lastModified": 1754978539,
-        "narHash": "sha256-nrDovydywSKRbWim9Ynmgj8SBm8LK3DI2WuhIqzOHYI=",
+        "lastModified": 1763413832,
+        "narHash": "sha256-dkqBwDXiv8MPoFyIvOuC4bVubAP+TlVZUkVMB78TTSg=",
         "owner": "nix-community",
         "repo": "dream2nix",
-        "rev": "fbec3263cb4895ac86ee9506cdc4e6919a1a2214",
+        "rev": "5658fba3a0b6b7d5cb0460b949651f64f644a743",
         "type": "github"
       },
       "original": {
@@ -356,11 +356,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762868777,
-        "narHash": "sha256-QqS72GvguP56oKDNUckWUPNJHjsdeuXh5RyoKz0wJ+E=",
+        "lastModified": 1763319842,
+        "narHash": "sha256-YG19IyrTdnVn0l3DvcUYm85u3PaqBt6tI6VvolcuHnA=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "c5c3147730384576196fb5da048a6e45dee10d56",
+        "rev": "7275fa67fbbb75891c16d9dee7d88e58aea2d761",
         "type": "github"
       },
       "original": {

modules/default.nix

@@ -1 +1,6 @@
-{ imports = [ ./crowdsec ]; }
+{
+  imports = [
+    ./crowdsec
+    ./serviceTests/stub.nix
+  ];
+}

modules/serviceTests/mocks.nix

@@ -0,0 +1,27 @@
+/**
+  Module containing mock definitions for service test runners.
+*/
+{ lib, ... }:
+{
+  imports = [
+    ../.
+    ../../configuration/services/backups.nix
+  ];
+  # imports = [ flake-inputs.sops-nix.nixosModules.sops ];
+
+  sops.defaultSopsFile = ../../keys/staging.yaml;
+  environment.etc."staging.key" = {
+    mode = "0400";
+    source = ../../keys/hosts/staging.key;
+  };
+  services.openssh = {
+    enable = true;
+    hostKeys = lib.mkForce [
+      {
+        type = "rsa";
+        bits = 4096;
+        path = "/etc/staging.key";
+      }
+    ];
+  };
+}

modules/serviceTests/stub.nix

@@ -0,0 +1,20 @@
+/**
+  Module to make writing service-specific tests easy.
+*/
+{ lib, ... }:
+let
+  inherit (lib) mkOption types;
+in
+{
+  options = {
+    serviceTests = mkOption {
+      type = types.attrsOf types.package;
+
+      description = ''
+        NixOS tests to run.
+      '';
+
+      default = { };
+    };
+  };
+}