Skynet/misc_nixos-mailserver
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'scintill/nixos-mailserver-fix-tests'

Browse source
This commit is contained in:
Robin Raymond 2019-08-13 19:51:16 +02:00
commit 0bf2bb0b54
8 changed files with 110 additions and 42 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
.gitlab-ci.yml
View file

@ -1,41 +1,47 @@
before_script:
# report CPU info so we can monitor if real KVM becomes available. create /dev/kvm to fool nix
- cat /proc/cpuinfo
- ls -l /dev/kvm || true
- touch /dev/kvm
nixos-intern:
image: nixos/nix
variables:
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz"
script:
- nix-build tests/intern.nix
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/intern.nix
nixos-extern:
image: nixos/nix
variables:
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz"
script:
- nix-build tests/extern.nix
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/extern.nix
nixos-clamav:
image: nixos/nix
variables:
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-19.03.tar.gz"
script:
- nix-build tests/clamav.nix
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/clamav.nix
nixos-unstable-intern:
image: nixos/nix
variables:
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz"
script:
- nix-build tests/intern.nix
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/intern.nix
nixos-unstable-extern:
image: nixos/nix
variables:
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz"
script:
- nix-build tests/extern.nix
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/extern.nix
nixos-unstable-clamav:
image: nixos/nix
variables:
NIX_PATH: "nixpkgs=https://github.com/NixOS/nixpkgs-channels/archive/nixos-unstable.tar.gz"
script:
- nix-build tests/clamav.nix
- nix-build --arg pkgs 'import tests/lib/pkgs.nokvm.nix' tests/clamav.nix

24
mail-server/opendkim.nix
View file

@ -40,16 +40,6 @@ let
fi
'';
createAllCerts = lib.concatStringsSep "\n" (map createDomainDkimCert cfg.domains);
create_dkim_cert =
''
# Create dkim dir
mkdir -p "${cfg.dkimKeyDirectory}"
chown ${dkimUser}:${dkimGroup} "${cfg.dkimKeyDirectory}"
${createAllCerts}
chown -R ${dkimUser}:${dkimGroup} "${cfg.dkimKeyDirectory}"
'';
keyTable = pkgs.writeText "opendkim-KeyTable"
(lib.concatStringsSep "\n" (lib.flip map cfg.domains
@ -80,11 +70,17 @@ in
};
users.users = optionalAttrs (config.services.postfix.user == "postfix") {
postfix.extraGroups = [ "${config.services.opendkim.group}" ];
postfix.extraGroups = [ "${dkimGroup}" ];
};
systemd.services.opendkim = {
preStart = create_dkim_cert;
serviceConfig.ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
preStart = lib.mkForce createAllCerts;
serviceConfig = {
ExecStart = lib.mkForce "${pkgs.opendkim}/bin/opendkim ${escapeShellArgs args}";
PermissionsStartOnly = lib.mkForce false;
};
};
systemd.tmpfiles.rules = [
"d '${cfg.dkimKeyDirectory}' - ${dkimUser} ${dkimGroup} - -"
];
};
}
}

29
mail-server/rspamd.nix
View file

@ -27,19 +27,22 @@ in
config = with cfg; lib.mkIf enable {
services.rspamd = {
enable = true;
extraConfig = ''
extended_spam_headers = yes;
'' + (lib.optionalString cfg.virusScanning ''
antivirus {
clamav {
action = "reject";
symbol = "CLAM_VIRUS";
type = "clamav";
log_clean = true;
servers = "/run/clamav/clamd.ctl";
}
}
'');
inherit debug;
locals = {
"milter_headers.conf" = { text = ''
extended_spam_headers = yes;
''; };
"antivirus.conf" = lib.mkIf cfg.virusScanning { text = ''
clamav {
action = "reject";
symbol = "CLAM_VIRUS";
type = "clamav";
log_clean = true;
servers = "/run/clamav/clamd.ctl";
scan_mime_parts = false; # scan mail as a whole unit, not parts. seems to be needed to work at all
}
''; };
};
overrides = {
"milter_headers.conf" = {

29
tests/clamav.nix
View file

@ -34,6 +34,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
{
imports = [
../default.nix
./lib/config.nix
];
virtualisation.memorySize = 1500;
@ -103,6 +104,10 @@ import <nixpkgs/nixos/tests/make-test.nix> {
exec grep '${clientIP}' "$@"
'';
in {
imports = [
./lib/config.nix
];
environment.systemPackages = with pkgs; [
fetchmail msmtp procmail findutils grep-ip
];
@ -120,10 +125,15 @@ import <nixpkgs/nixos/tests/make-test.nix> {
};
"root/.msmtprc" = {
text = ''
account test2
defaults
tls on
tls_certcheck off
account user2
host ${serverIP}
port 587
from user@example2.com
auth on
user user@example2.com
password user2
'';
@ -164,7 +174,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
--Apple-Mail=_2689C63E-FD18-4E4D-8822-54797BDA9607--
'';
"root/email2".text = ''
"root/safe-email".text = ''
From: User <user@example2.com>
To: User1 <user1@example.com>
Cc:
@ -182,13 +192,17 @@ import <nixpkgs/nixos/tests/make-test.nix> {
};
};
testScript =
testScript = { nodes, ... }:
''
startAll;
$server->waitForUnit("multi-user.target");
$client->waitForUnit("multi-user.target");
# TODO put this blocking into the systemd units? I am not sure if rspamd already waits for the clamd socket.
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/clamav/clamd.ctl < /dev/null; [ \$? -eq 124 ]");
$client->execute("cp -p /etc/root/.* ~/");
$client->succeed("mkdir -p ~/mail");
$client->succeed("ls -la ~/ >&2");
@ -201,7 +215,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
# Verify that mail can be sent and received before testing virus scanner
$client->execute("rm ~/mail/*");
$client->succeed("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/email2 >&2");
$client->succeed("msmtp -a user2 user1\@example.com < /etc/root/safe-email >&2");
# give the mail server some time to process the mail
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
$client->execute("rm ~/mail/*");
@ -209,13 +223,12 @@ import <nixpkgs/nixos/tests/make-test.nix> {
$client->succeed("fetchmail -v >&2");
$client->execute("rm ~/mail/*");
subtest "virus scan file", sub {
$server->fail("clamscan --follow-file-symlinks=2 -r /etc/root/ >&2");
$server->succeed("clamdscan \$(readlink -f /etc/root/eicar.com.txt) | grep \"Txt\\.Malware\\.Agent-1787597 FOUND\" >&2");
};
subtest "virus scanner", sub {
$client->fail("msmtp -a test2 --tls=on --tls-certcheck=off --auth=on user1\@example.com < /etc/root/virus-email >&2");
subtest "virus scan email", sub {
$client->succeed("msmtp -a user2 user1\@example.com < /etc/root/virus-email 2>&1 | grep \"server message: 554 5\\.7\\.1 clamav: virus found: .*\\(Eicar\\|EICAR\\)\" >&2"); # for some reason this ID is nondetermistic...
# give the mail server some time to process the mail
$server->waitUntilFails('[ "$(postqueue -p)" != "Mail queue is empty" ]');
};

9
tests/extern.nix
View file

@ -21,6 +21,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
{
imports = [
../default.nix
./lib/config.nix
];
services.rsyslogd = {
@ -134,6 +135,9 @@ import <nixpkgs/nixos/tests/make-test.nix> {
imap.close()
'';
in {
imports = [
./lib/config.nix
];
environment.systemPackages = with pkgs; [
fetchmail msmtp procmail findutils grep-ip check-mail-id test-imap-spam test-imap-ham
];
@ -271,13 +275,16 @@ import <nixpkgs/nixos/tests/make-test.nix> {
};
};
testScript =
testScript = { nodes, ... }:
''
startAll;
$server->waitForUnit("multi-user.target");
$client->waitForUnit("multi-user.target");
# TODO put this blocking into the systemd units?
$server->waitUntilSucceeds("timeout 1 ${nodes.server.pkgs.netcat}/bin/nc -U /run/rspamd/rspamd-milter.sock < /dev/null; [ \$? -eq 124 ]");
$client->execute("cp -p /etc/root/.* ~/");
$client->succeed("mkdir -p ~/mail");
$client->succeed("ls -la ~/ >&2");

1
tests/intern.nix
View file

@ -21,6 +21,7 @@ import <nixpkgs/nixos/tests/make-test.nix> {
{
imports = [
./../default.nix
./lib/config.nix
];
mailserver = {

11
tests/lib/config.nix Normal file
View file

@ -0,0 +1,11 @@
{
security.dhparams.defaultBitSize = 16; # really low for quicker tests
# For slow non-kvm tests.
# nixos/modules/testing/test-instrumentation.nix also sets this. I don't know if there's a better way than etc to override theirs.
environment.etc."systemd/system.conf.d/bigdefaulttimeout.conf".text = ''
[Manager]
# Allow extremely slow start (default for test-VMs is 5 minutes)
DefaultTimeoutStartSec=15min
'';
}

31
tests/lib/pkgs.nokvm.nix Normal file
View file

@ -0,0 +1,31 @@
let
pkgs = (import <nixpkgs> { system = builtins.currentSystem; config = {}; });
patchedMachinePM = pkgs.writeTextFile {
name = "Machine.pm.patched-to-wait-longer-for-vm";
text = builtins.replaceStrings ["alarm 600;"] ["alarm 1200;"] (builtins.readFile (<nixpkgs>+"/nixos/lib/test-driver/Machine.pm"));
};
in
(pkgs // {
qemu_test = with pkgs; stdenv.mkDerivation {
name = "qemu_test_no_kvm";
buildInputs = [ coreutils qemu_test ];
inherit qemu_test;
inherit coreutils;
builder = builtins.toFile "builder.sh" ''
PATH=$coreutils/bin:$PATH
mkdir -p $out/bin
cp $qemu_test/bin/* $out/bin/
ln -sf $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
'';
};
stdenv = pkgs.stdenv // {
mkDerivation = args: (pkgs.stdenv.mkDerivation (args // (
pkgs.lib.optionalAttrs (args.name == "nixos-test-driver") {
installPhase = args.installPhase + ''
rm $libDir/Machine.pm
cp ${patchedMachinePM} $libDir/Machine.pm
'';
}
)));
};
})