Something went wrong. Try again.
An ATProto Powered Reputation Network
Something went wrong. Try again.
6.7 kB · 185 lines
Nix
at master
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186{ self, nixpkgs, pkgs, system,}:let inherit (nixpkgs) lib; evaluate = modules: (lib.nixosSystem { inherit system; modules = modules ++ [ { system.stateVersion = "26.05"; boot.loader.grub.enable = false; fileSystems."/" = { device = "/dev/root"; fsType = "ext4"; }; } ]; }).config; valid = cfg: lib.all (item: item.assertion) cfg.assertions; appviewConfig.services.provenance.appview = { enable = true; serviceKeyFile = "/run/secrets/provenance/service-key"; listenAddress = "[::1]:9091"; stateDirectory = "test-appview"; databaseFile = "graph.sqlite"; jetstreamURL = "wss://stream.example.com/subscribe"; jetstreamAfterSequence = 100; jetstreamBeforeSequence = 1000; slingshotURL = "https://records.example.com"; hopPenalty = 0.25; trustCacheTTL = "48h"; externalWorkers = 2; logLevel = "debug"; enableSoftVouch = true; softVouchLists = true; softVouchAllAuthors = true; }; uiConfig.services.provenance.ui = { enable = true; serviceKeyFile = "/run/secrets/provenance/service-key"; encryptionKeyFile = "/run/secrets/provenance/encryption-key"; listenAddress = "[::1]:9090"; stateDirectory = "test-ui"; databaseFile = "sessions.sqlite"; publicOrigin = "https://provenance.example.com"; appviewURL = "https://appview.example.com"; externalWorkers = 3; }; disabled = evaluate [ self.nixosModules.default ]; appview = evaluate [ self.nixosModules.appview appviewConfig ]; ui = evaluate [ self.nixosModules.ui uiConfig ]; combined = evaluate [ self.nixosModules.default appviewConfig uiConfig ]; missingSecrets = evaluate [ self.nixosModules.default { services.provenance.appview.enable = true; services.provenance.ui.enable = true; } ]; storeSecret = evaluate [ self.nixosModules.appview { services.provenance.appview = { enable = true; serviceKeyFile = "/nix/store/not-a-runtime-secret"; }; } ]; sharedState = evaluate [ self.nixosModules.default appviewConfig uiConfig { services.provenance.ui.stateDirectory = lib.mkForce "test-appview"; } ]; appUnit = appview.systemd.services.provenance-appview; custom = evaluate [ self.nixosModules.default appviewConfig uiConfig { services.provenance.appview = { dataDirectory = "/srv/provenance/graph"; jetstreamReplay = true; jetstreamAPIKeyFile = "/run/agenix/jetstream"; traceEndpoint = "http://127.0.0.1:10428/insert/opentelemetry/v1/traces"; }; services.provenance.ui.dataDirectory = "/srv/provenance/ui"; } ]; uiUnit = ui.systemd.services.provenance-ui; fixture = pkgs.runCommand "provenance-package-fixture" { } "mkdir -p $out/bin"; override = evaluate [ self.nixosModules.ui uiConfig { services.provenance.ui.package = fixture; } ]; invalidPenalty = builtins.tryEval (evaluate [ self.nixosModules.appview { services.provenance.appview.hopPenalty = -0.1; } ]).services.provenance.appview.hopPenalty;inassert valid custom;assert custom.systemd.services.provenance-appview.environment.PROVENANCE_TRACE_ENDPOINT == "http://127.0.0.1:10428/insert/opentelemetry/v1/traces";assert !(appUnit.environment ? PROVENANCE_TRACE_ENDPOINT);assert custom.systemd.services.provenance-appview.environment.PROVENANCE_APPVIEW_DB == "/srv/provenance/graph/graph.sqlite";assert custom.systemd.services.provenance-ui.environment.PROVENANCE_UI_DB == "/srv/provenance/ui/sessions.sqlite";assert !custom.systemd.services.provenance-appview.serviceConfig.DynamicUser;assert custom.systemd.services.provenance-appview.serviceConfig.User == "provenance-appview";assert lib.elem "JETSTREAM_API_KEY_FILE:/run/agenix/jetstream" custom.systemd.services.provenance-appview.serviceConfig.LoadCredential;assert lib.hasInfix ''export JETSTREAM_API_KEY_FILE="$CREDENTIALS_DIRECTORY/JETSTREAM_API_KEY_FILE"'' custom.systemd.services.provenance-appview.script;assert !(disabled.systemd.services ? provenance-appview);assert !(disabled.systemd.services ? provenance-ui);assert valid appview && valid ui && valid combined;assert !(appview.systemd.services ? provenance-ui);assert !(ui.systemd.services ? provenance-appview);assert !(valid missingSecrets) && !(valid storeSecret);assert !(valid sharedState);assert !invalidPenalty.success;assert appUnit.environment.PROVENANCE_APPVIEW_ADDR == "[::1]:9091";assert appUnit.environment.PROVENANCE_APPVIEW_DB == "/var/lib/test-appview/graph.sqlite";assert appUnit.environment.PROVENANCE_JETSTREAM_URL == "wss://stream.example.com/subscribe";assert appUnit.environment.PROVENANCE_JETSTREAM_AFTER_SEQ == "100";assert appUnit.environment.PROVENANCE_JETSTREAM_BEFORE_SEQ == "1000";assert appUnit.environment.PROVENANCE_SLINGSHOT_URL == "https://records.example.com";assert appUnit.environment.PROVENANCE_HOP_PENALTY == toString 0.25;assert appUnit.environment.PROVENANCE_TRUST_CACHE_TTL == "48h";assert appUnit.environment.PROVENANCE_EXTERNAL_WORKERS == "2";assert appUnit.environment.PROVENANCE_LOG_LEVEL == "debug";assert uiUnit.environment.PROVENANCE_LOG_LEVEL == "info";assert uiUnit.environment.PROVENANCE_EXTERNAL_WORKERS == "3";assert appUnit.environment.ENABLE_SOFT_VOUCH == "true";assert appUnit.environment.ENABLE_SOFT_VOUCH_LISTS == "true";assert appUnit.environment.ENABLE_SOFT_VOUCH_ALL_AUTHORS == "true";assert !(appUnit.environment ? PROVENANCE_SERVICE_KEY);assert !(uiUnit.environment ? PROVENANCE_ENCRYPTION_KEY);assert appUnit.serviceConfig.LoadCredential == [ "PROVENANCE_SERVICE_KEY:/run/secrets/provenance/service-key" ];assert builtins.length uiUnit.serviceConfig.LoadCredential == 2;assert appUnit.serviceConfig.DynamicUser && uiUnit.serviceConfig.DynamicUser;assert appUnit.serviceConfig.ProtectSystem == "strict";assert uiUnit.environment.PROVENANCE_PUBLIC_ORIGIN == "https://provenance.example.com";assert uiUnit.environment.PROVENANCE_UI_ADDR == "[::1]:9090";assert uiUnit.environment.PROVENANCE_UI_DB == "/var/lib/test-ui/sessions.sqlite";assert uiUnit.environment.PROVENANCE_APPVIEW_URL == "https://appview.example.com";assert lib.elem "provenance-appview.service" combined.systemd.services.provenance-ui.after;assert lib.hasInfix (builtins.unsafeDiscardStringContext ( toString fixture)) override.systemd.services.provenance-ui.script;pkgs.runCommand "provenance-module-checks" { } '' mkdir -p "$out" echo "NixOS module checks passed." > "$out/result"''