uboot: (firmwareOdroidC2/C4) don't invoke patch tool, use patches = [] instead
https://github.com/NixOS/nixpkgs/blob/master/pkgs/stdenv/generic/setup.sh#L948 this can do it nicely. Signed-off-by: Anton Arapov <anton@deadbeef.mx>
This commit is contained in:
Anton Arapov
Alan Daniels
commit
56de2bcd43
30691 changed files with 3076956 additions and 0 deletions
216
nixos/tests/knot.nix
Normal file
216
nixos/tests/knot.nix
Normal file
|
|
@ -0,0 +1,216 @@
|
|||
import ./make-test-python.nix ({ pkgs, lib, ...} :
|
||||
let
|
||||
common = {
|
||||
networking.firewall.enable = false;
|
||||
networking.useDHCP = false;
|
||||
};
|
||||
exampleZone = pkgs.writeTextDir "example.com.zone" ''
|
||||
@ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800
|
||||
@ NS ns1
|
||||
@ NS ns2
|
||||
ns1 A 192.168.0.1
|
||||
ns1 AAAA fd00::1
|
||||
ns2 A 192.168.0.2
|
||||
ns2 AAAA fd00::2
|
||||
www A 192.0.2.1
|
||||
www AAAA 2001:DB8::1
|
||||
sub NS ns.example.com.
|
||||
'';
|
||||
delegatedZone = pkgs.writeTextDir "sub.example.com.zone" ''
|
||||
@ SOA ns.example.com. noc.example.com. 2019031301 86400 7200 3600000 172800
|
||||
@ NS ns1.example.com.
|
||||
@ NS ns2.example.com.
|
||||
@ A 192.0.2.2
|
||||
@ AAAA 2001:DB8::2
|
||||
'';
|
||||
|
||||
knotZonesEnv = pkgs.buildEnv {
|
||||
name = "knot-zones";
|
||||
paths = [ exampleZone delegatedZone ];
|
||||
};
|
||||
# DO NOT USE pkgs.writeText IN PRODUCTION. This put secrets in the nix store!
|
||||
tsigFile = pkgs.writeText "tsig.conf" ''
|
||||
key:
|
||||
- id: slave_key
|
||||
algorithm: hmac-sha256
|
||||
secret: zOYgOgnzx3TGe5J5I/0kxd7gTcxXhLYMEq3Ek3fY37s=
|
||||
'';
|
||||
in {
|
||||
name = "knot";
|
||||
meta = with pkgs.lib.maintainers; {
|
||||
maintainers = [ hexa ];
|
||||
};
|
||||
|
||||
|
||||
nodes = {
|
||||
master = { lib, ... }: {
|
||||
imports = [ common ];
|
||||
|
||||
# trigger sched_setaffinity syscall
|
||||
virtualisation.cores = 2;
|
||||
|
||||
networking.interfaces.eth1 = {
|
||||
ipv4.addresses = lib.mkForce [
|
||||
{ address = "192.168.0.1"; prefixLength = 24; }
|
||||
];
|
||||
ipv6.addresses = lib.mkForce [
|
||||
{ address = "fd00::1"; prefixLength = 64; }
|
||||
];
|
||||
};
|
||||
services.knot.enable = true;
|
||||
services.knot.extraArgs = [ "-v" ];
|
||||
services.knot.keyFiles = [ tsigFile ];
|
||||
services.knot.extraConfig = ''
|
||||
server:
|
||||
listen: 0.0.0.0@53
|
||||
listen: ::@53
|
||||
|
||||
acl:
|
||||
- id: slave_acl
|
||||
address: 192.168.0.2
|
||||
key: slave_key
|
||||
action: transfer
|
||||
|
||||
remote:
|
||||
- id: slave
|
||||
address: 192.168.0.2@53
|
||||
|
||||
template:
|
||||
- id: default
|
||||
storage: ${knotZonesEnv}
|
||||
notify: [slave]
|
||||
acl: [slave_acl]
|
||||
dnssec-signing: on
|
||||
# Input-only zone files
|
||||
# https://www.knot-dns.cz/docs/2.8/html/operation.html#example-3
|
||||
# prevents modification of the zonefiles, since the zonefiles are immutable
|
||||
zonefile-sync: -1
|
||||
zonefile-load: difference
|
||||
journal-content: changes
|
||||
# move databases below the state directory, because they need to be writable
|
||||
journal-db: /var/lib/knot/journal
|
||||
kasp-db: /var/lib/knot/kasp
|
||||
timer-db: /var/lib/knot/timer
|
||||
|
||||
zone:
|
||||
- domain: example.com
|
||||
file: example.com.zone
|
||||
|
||||
- domain: sub.example.com
|
||||
file: sub.example.com.zone
|
||||
|
||||
log:
|
||||
- target: syslog
|
||||
any: info
|
||||
'';
|
||||
};
|
||||
|
||||
slave = { lib, ... }: {
|
||||
imports = [ common ];
|
||||
networking.interfaces.eth1 = {
|
||||
ipv4.addresses = lib.mkForce [
|
||||
{ address = "192.168.0.2"; prefixLength = 24; }
|
||||
];
|
||||
ipv6.addresses = lib.mkForce [
|
||||
{ address = "fd00::2"; prefixLength = 64; }
|
||||
];
|
||||
};
|
||||
services.knot.enable = true;
|
||||
services.knot.keyFiles = [ tsigFile ];
|
||||
services.knot.extraArgs = [ "-v" ];
|
||||
services.knot.extraConfig = ''
|
||||
server:
|
||||
listen: 0.0.0.0@53
|
||||
listen: ::@53
|
||||
|
||||
acl:
|
||||
- id: notify_from_master
|
||||
address: 192.168.0.1
|
||||
action: notify
|
||||
|
||||
remote:
|
||||
- id: master
|
||||
address: 192.168.0.1@53
|
||||
key: slave_key
|
||||
|
||||
template:
|
||||
- id: default
|
||||
master: master
|
||||
acl: [notify_from_master]
|
||||
# zonefileless setup
|
||||
# https://www.knot-dns.cz/docs/2.8/html/operation.html#example-2
|
||||
zonefile-sync: -1
|
||||
zonefile-load: none
|
||||
journal-content: all
|
||||
# move databases below the state directory, because they need to be writable
|
||||
journal-db: /var/lib/knot/journal
|
||||
kasp-db: /var/lib/knot/kasp
|
||||
timer-db: /var/lib/knot/timer
|
||||
|
||||
zone:
|
||||
- domain: example.com
|
||||
file: example.com.zone
|
||||
|
||||
- domain: sub.example.com
|
||||
file: sub.example.com.zone
|
||||
|
||||
log:
|
||||
- target: syslog
|
||||
any: info
|
||||
'';
|
||||
};
|
||||
client = { lib, nodes, ... }: {
|
||||
imports = [ common ];
|
||||
networking.interfaces.eth1 = {
|
||||
ipv4.addresses = [
|
||||
{ address = "192.168.0.3"; prefixLength = 24; }
|
||||
];
|
||||
ipv6.addresses = [
|
||||
{ address = "fd00::3"; prefixLength = 64; }
|
||||
];
|
||||
};
|
||||
environment.systemPackages = [ pkgs.knot-dns ];
|
||||
};
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }: let
|
||||
master4 = (lib.head nodes.master.config.networking.interfaces.eth1.ipv4.addresses).address;
|
||||
master6 = (lib.head nodes.master.config.networking.interfaces.eth1.ipv6.addresses).address;
|
||||
|
||||
slave4 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv4.addresses).address;
|
||||
slave6 = (lib.head nodes.slave.config.networking.interfaces.eth1.ipv6.addresses).address;
|
||||
in ''
|
||||
import re
|
||||
|
||||
start_all()
|
||||
|
||||
client.wait_for_unit("network.target")
|
||||
master.wait_for_unit("knot.service")
|
||||
slave.wait_for_unit("knot.service")
|
||||
|
||||
|
||||
def test(host, query_type, query, pattern):
|
||||
out = client.succeed(f"khost -t {query_type} {query} {host}").strip()
|
||||
client.log(f"{host} replied with: {out}")
|
||||
assert re.search(pattern, out), f'Did not match "{pattern}"'
|
||||
|
||||
|
||||
for host in ("${master4}", "${master6}", "${slave4}", "${slave6}"):
|
||||
with subtest(f"Interrogate {host}"):
|
||||
test(host, "SOA", "example.com", r"start of authority.*noc\.example\.com\.")
|
||||
test(host, "A", "example.com", r"has no [^ ]+ record")
|
||||
test(host, "AAAA", "example.com", r"has no [^ ]+ record")
|
||||
|
||||
test(host, "A", "www.example.com", r"address 192.0.2.1$")
|
||||
test(host, "AAAA", "www.example.com", r"address 2001:db8::1$")
|
||||
|
||||
test(host, "NS", "sub.example.com", r"nameserver is ns\d\.example\.com.$")
|
||||
test(host, "A", "sub.example.com", r"address 192.0.2.2$")
|
||||
test(host, "AAAA", "sub.example.com", r"address 2001:db8::2$")
|
||||
|
||||
test(host, "RRSIG", "www.example.com", r"RR set signature is")
|
||||
test(host, "DNSKEY", "example.com", r"DNSSEC key is")
|
||||
|
||||
master.log(master.succeed("systemd-analyze security knot.service | grep -v '✓'"))
|
||||
'';
|
||||
})
|
||||
Loading…
Add table
Add a link
Reference in a new issue