akkoma.nix

/*
  End-to-end test for Akkoma.

  Based in part on nixos/tests/pleroma.

  TODO: Test federation.
*/
import ./make-test-python.nix (
  {
    pkgs,
    package ? pkgs.akkoma,
    confined ? false,
    ...
  }:
  let
    userPassword = "4LKOrGo8SgbPm1a6NclVU5Wb";

    provisionUser = pkgs.writers.writeBashBin "provisionUser" ''
      set -eu -o errtrace -o pipefail

      pleroma_ctl user new jamy jamy@nixos.test --password '${userPassword}' --moderator --admin -y
    '';

    tlsCert =
      pkgs.runCommand "selfSignedCerts"
        {
          nativeBuildInputs = with pkgs; [ openssl ];
        }
        ''
          mkdir -p $out
          openssl req -x509 \
            -subj '/CN=akkoma.nixos.test/' -days 49710 \
            -addext 'subjectAltName = DNS:akkoma.nixos.test' \
            -keyout "$out/key.pem" -newkey ed25519 \
            -out "$out/cert.pem" -noenc
        '';

    sendToot = pkgs.writers.writeBashBin "sendToot" ''
      set -eu -o errtrace -o pipefail

      export REQUESTS_CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt"

      ${pkgs.toot}/bin/toot login_cli -i "akkoma.nixos.test" -e "jamy@nixos.test" -p '${userPassword}'
      ${pkgs.toot}/bin/toot post "hello world Jamy here"
      ${pkgs.toot}/bin/toot timeline -1 | grep -F -q "hello world Jamy here"

      # Test file upload
      echo "y" | ${pkgs.toot}/bin/toot upload <(dd if=/dev/zero bs=1024 count=1024 status=none) \
        | grep -F -q "https://akkoma.nixos.test:443/media"
    '';

    checkFe = pkgs.writers.writeBashBin "checkFe" ''
      set -eu -o errtrace -o pipefail

      paths=( / /static/{config,styles}.json /pleroma/admin/ )

      for path in "''${paths[@]}"; do
        diff \
          <(${pkgs.curl}/bin/curl -f -S -s -o /dev/null -w '%{response_code}' "https://akkoma.nixos.test$path") \
          <(echo -n 200)
      done
    '';

    hosts = nodes: ''
      ${nodes.akkoma.networking.primaryIPAddress} akkoma.nixos.test
      ${nodes.client.networking.primaryIPAddress} client.nixos.test
    '';
  in
  {
    name = "akkoma";
    nodes = {
      client =
        {
          nodes,
          pkgs,
          config,
          ...
        }:
        {
          security.pki.certificateFiles = [ "${tlsCert}/cert.pem" ];
          networking.extraHosts = hosts nodes;
        };

      akkoma =
        {
          nodes,
          pkgs,
          config,
          ...
        }:
        {
          networking.extraHosts = hosts nodes;
          networking.firewall.allowedTCPPorts = [ 443 ];
          environment.systemPackages = with pkgs; [ provisionUser ];
          systemd.services.akkoma.confinement.enable = confined;

          services.akkoma = {
            enable = true;
            package = package;
            config = {
              ":pleroma" = {
                ":instance" = {
                  name = "NixOS test Akkoma server";
                  description = "NixOS test Akkoma server";
                  email = "akkoma@nixos.test";
                  notify_email = "akkoma@nixos.test";
                  registration_open = true;
                };

                ":media_proxy" = {
                  enabled = false;
                };

                "Pleroma.Web.Endpoint" = {
                  url.host = "akkoma.nixos.test";
                };
                "Pleroma.Upload" = {
                  base_url = "https://akkoma.nixos.test:443/media/";
                };
              };
            };

            nginx = {
              addSSL = true;
              sslCertificate = "${tlsCert}/cert.pem";
              sslCertificateKey = "${tlsCert}/key.pem";
            };
          };

          services.nginx.enable = true;
          services.postgresql.enable = true;
        };
    };

    testScript =
      { nodes, ... }:
      ''
        start_all()
        akkoma.wait_for_unit('akkoma-initdb.service')
        akkoma.systemctl('restart akkoma-initdb.service')  # test repeated initialisation
        akkoma.wait_for_unit('akkoma.service')
        akkoma.wait_for_file('/run/akkoma/socket');
        akkoma.succeed('${provisionUser}/bin/provisionUser')
        akkoma.wait_for_unit('nginx.service')
        client.succeed('${sendToot}/bin/sendToot')
        client.succeed('${checkFe}/bin/checkFe')
      '';
  }
)