checks/cluster: init WIP

cluster/services/consul/agent.nix

@@ -23,6 +23,7 @@ in
       bind_addr = hl.ipv4;
       ports.serf_lan = hl.port;
       retry_join = map (hostName: hostLinks.${hostName}.consul.tuple) (cfg.otherNodes.agent hostName);
+      bootstrap_expect = builtins.length cfg.nodes.agent;
     };
   };
 

hosts/VEGAS/system.nix

@@ -46,7 +46,7 @@
   time.timeZone = "Europe/Helsinki";
 
   networking.useDHCP = false;
-  networking.interfaces.enp0s31f6.useDHCP = true;
+  networking.interfaces.${config.reflection.interfaces.primary.link}.useDHCP = true;
 
   i18n.defaultLocale = "en_US.UTF-8";
 

hosts/checkmate/system.nix

@@ -1,4 +1,4 @@
-{ depot, ... }:
+{ config, depot, ... }:
 
 {
   imports =
@@ -22,7 +22,7 @@
   time.timeZone = "Europe/Zurich";
 
   networking.useDHCP = false;
-  networking.interfaces.ens3.useDHCP = true;
+  networking.interfaces.${config.reflection.interfaces.primary.link}.useDHCP = true;
 
   i18n.defaultLocale = "en_US.UTF-8";
 

hosts/prophet/system.nix

@@ -1,4 +1,4 @@
-{ depot, ... }:
+{ config, depot, ... }:
 
 {
   imports =
@@ -24,7 +24,7 @@
   time.timeZone = "Europe/Zurich";
 
   networking.useDHCP = false;
-  networking.interfaces.enp0s6.useDHCP = true;
+  networking.interfaces.${config.reflection.interfaces.primary.link}.useDHCP = true;
 
   i18n.defaultLocale = "en_US.UTF-8";
 

hosts/soda/system.nix

@@ -1,4 +1,4 @@
-{ depot, ... }:
+{ config, depot, ... }:
 
 {
   imports = with depot.nixosModules; [
@@ -12,7 +12,7 @@
 
   networking.useDHCP = false;
 
-  networking.interfaces.eth0.useDHCP = true;
+  networking.interfaces.${config.reflection.interfaces.primary.link}.useDHCP = true;
 
   networking.nameservers = [ depot.hours.VEGAS.interfaces.vstub.addr ];
 

hosts/thunderskin/system.nix

@@ -1,4 +1,4 @@
-{ depot, ... }:
+{ config, depot, ... }:
 
 {
   imports =
@@ -22,7 +22,7 @@
   time.timeZone = "Europe/Zurich";
 
   networking.useDHCP = false;
-  networking.interfaces.ens3.useDHCP = true;
+  networking.interfaces.${config.reflection.interfaces.primary.link}.useDHCP = true;
 
   i18n.defaultLocale = "en_US.UTF-8";
 

packages/checks/cluster.nix

@@ -0,0 +1,71 @@
+{ testers, config, extendModules, lib, system }:
+
+let
+  lift = config;
+
+  snakeoil = {
+    ssh = {
+      public = lib.fileContents ./snakeoil/ssh/snakeoil-key.pub;
+      private = ./snakeoil/ssh/snakeoil-key;
+    };
+    wireguard = {
+      public = lib.genAttrs nodes (node: lib.fileContents ./snakeoil/wireguard/public-key-${toString digits.${node}});
+      private = lib.genAttrs nodes (node: ./snakeoil/wireguard/private-key-${toString digits.${node}});
+    };
+  };
+
+  nodes = lib.attrNames config.gods.fromLight;
+  digits = lib.attrsets.listToAttrs (lib.zipListsWith lib.nameValuePair nodes (lib.range 1 255));
+  depot' = extendModules {
+    modules = [
+      ({ config, ... }: {
+        gods.fromLight = lib.mapAttrs (name: cfg: {
+          interfaces.primary = {
+            link = lib.mkForce "eth1";
+            addr = lib.mkForce "192.168.1.${toString digits.${name}}";
+            addrPublic = lib.mkForce "192.168.1.${toString digits.${name}}";
+          };
+          ssh.id.publicKey = lib.mkForce snakeoil.ssh.public;
+        }) lift.gods.fromLight;
+
+        cluster = lib.mkForce (lift.cluster.extendModules {
+          specialArgs.depot = config;
+          modules = [
+            {
+              hostLinks = lib.genAttrs nodes (node: {
+                mesh.extra = lib.mkForce (lift.cluster.config.hostLinks.${node}.mesh.extra // {
+                  pubKey = snakeoil.wireguard.public.${node};
+                });
+              });
+            }
+          ];
+        });
+      })
+    ];
+  };
+  specialArgs = depot'.config.lib.summon system lib.id;
+in
+
+testers.runNixOSTest {
+  name = "cluster";
+
+  node = { inherit specialArgs; };
+  nodes = lib.genAttrs nodes (node: {
+    imports = [
+      specialArgs.depot.hours.${node}.nixos
+      ./modules/nixos/age-dummy-secrets
+    ] ++ depot'.config.cluster.config.out.injectNixosConfig node;
+
+    environment.etc."ssh/ssh_host_ed25519_key" = {
+      source = snakeoil.ssh.private;
+      mode = "0400";
+    };
+    environment.etc."dummy-secrets/cluster-wireguard-meshPrivateKey".source = lib.mkForce snakeoil.wireguard.private.${node};
+    passthru.depot = depot';
+    virtualisation.memorySize = 4096;
+  });
+
+  testScript = ''
+    grail.succeed("false")
+  '';
+}

packages/checks/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, self, ... }:
+{ config, lib, self, extendModules, ... }:
 
 let
   timeMachine = {
@@ -7,6 +7,7 @@ let
 in
 
 {
+  debug = lib.warn "debug mode is enabled" true;
   perSystem = { filters, pkgs, self', system, ... }: {
     checks = lib.mkIf (system == "x86_64-linux") {
       ascensions = pkgs.callPackage ./ascensions.nix {
@@ -14,6 +15,10 @@ in
         inherit (self) nixosModules;
       };
 
+      cluster = pkgs.callPackage ./cluster.nix {
+        inherit config extendModules;
+      };
+
       garage = pkgs.callPackage ./garage.nix {
         inherit (self'.packages) garage consul;
         inherit (self) nixosModules;

packages/checks/garage.nix

@@ -14,7 +14,8 @@ testers.runNixOSTest {
       inherit (config.networking) hostName primaryIPAddress;
     in {
       imports = lib.flatten [
-        ./modules/nixos/age-dummy-secrets.nix
+        ./modules/nixos/age-dummy-secrets
+        ./modules/nixos/age-dummy-secrets/options.nix
         nixosModules.ascensions
         nixosModules.systemd-extras
         nixosModules.consul-distributed-services

packages/checks/modules/nixos/age-dummy-secrets/default.nix

@@ -0,0 +1,26 @@
+{ config, lib, ... }:
+with lib;
+
+{
+  options.age.secrets = mkOption {
+    type = types.attrsOf (types.submodule ({ name, config, ... }: {
+      config.path = lib.mkForce "/etc/dummy-secrets/${name}";
+    }));
+  };
+  config.environment.etc = mapAttrs' (name: secret: {
+    name = removePrefix "/etc/" secret.path;
+    value = mapAttrs (const mkDefault) {
+      user = secret.owner;
+      inherit (secret) mode group;
+      text = builtins.hashString "md5" name;
+    };
+  }) config.age.secrets;
+
+  config.system.activationScripts = {
+    agenixChown.text = lib.mkForce "echo using age-dummy-secrets";
+    agenixNewGeneration.text = lib.mkForce "echo using age-dummy-secrets";
+    agenixInstall.text = lib.mkForce ''
+      ln -sf /etc/dummy-secrets /run/agenix
+    '';
+  };
+}

packages/checks/modules/nixos/age-dummy-secrets/options.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ lib, ... }:
 with lib;
 
 let
@@ -22,12 +22,4 @@ in
       };
     }));
   };
-  config.environment.etc = mapAttrs' (name: secret: {
-    name = removePrefix "/etc/" secret.path;
-    value = mapAttrs (const mkDefault) {
-      user = secret.owner;
-      inherit (secret) mode group;
-      text = builtins.hashString "md5" name;
-    };
-  }) config.age.secrets;
 }

packages/checks/s3ql-upgrade.nix

@@ -8,7 +8,8 @@ testers.runNixOSTest {
       nixosModules.ascensions
       nixosModules.external-storage
       nixosModules.systemd-extras
-      ./modules/nixos/age-dummy-secrets.nix
+      ./modules/nixos/age-dummy-secrets
+      ./modules/nixos/age-dummy-secrets/options.nix
     ];
 
     _module.args.depot.packages = { inherit (previous.packages.${system}) s3ql; };

packages/checks/snakeoil/ssh/snakeoil-key

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAOx03X+LtW0aN8ejdN4IJgDPrTZgVwe7WbXhhBvqVwgwAAAJAS78fWEu/H
+1gAAAAtzc2gtZWQyNTUxOQAAACAOx03X+LtW0aN8ejdN4IJgDPrTZgVwe7WbXhhBvqVwgw
+AAAEAUtGOZZIZdzGP6g85JuXBjDtciNQ9bLHNxSN5Gbwvb2Q7HTdf4u1bRo3x6N03ggmAM
++tNmBXB7tZteGEG+pXCDAAAACW1heEBUSVRBTgECAwQ=
+-----END OPENSSH PRIVATE KEY-----

packages/checks/snakeoil/ssh/snakeoil-key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7HTdf4u1bRo3x6N03ggmAM+tNmBXB7tZteGEG+pXCD

packages/checks/snakeoil/wireguard/private-key-1

@@ -0,0 +1 @@
+YHzP8rBP6qiXs6ZdnvHop9KnCYRADIEejwZzAzvj8m4=

packages/checks/snakeoil/wireguard/private-key-2

@@ -0,0 +1 @@
+uD7X5E6N9d0sN+xPr/bWnehSa3bAok741GO7Z4I+Z3I=

packages/checks/snakeoil/wireguard/private-key-3

@@ -0,0 +1 @@
+YLl+hkWaCWx/5PpWs3cQ+bKqYdJef/qZ+FMTsM9ammM=

packages/checks/snakeoil/wireguard/private-key-4

@@ -0,0 +1 @@
+MNvWpMluuzQvPyGTp7jtyPSyz6n9lIly/WX1gW2NAHg=

packages/checks/snakeoil/wireguard/private-key-5

@@ -0,0 +1 @@
+QHyIJ3HoKGGFN28qOrQP4UyoQMP5bM7Idn2MzayKzEM=

packages/checks/snakeoil/wireguard/public-key-1

@@ -0,0 +1 @@
+TESTtbFybW5YREwtd18a1A4StS4YAIUS5/M1Lv0jHjA=

packages/checks/snakeoil/wireguard/public-key-2

@@ -0,0 +1 @@
+TEsTh7bthkaDh9A1CpqDi/F121ao5lRZqIJznLH8mB4=

packages/checks/snakeoil/wireguard/public-key-3

@@ -0,0 +1 @@
+tEST6afFmVN18o+EiWNFx+ax3MJwdQIeNfJSGEpffXw=

packages/checks/snakeoil/wireguard/public-key-4

@@ -0,0 +1 @@
+tEsT6s7VtM5C20eJBaq6UlQydAha8ATlmrTRe9T5jnM=

packages/checks/snakeoil/wireguard/public-key-5

@@ -0,0 +1 @@
+TEstYyb5IoqSL53HbSQwMhTaR16sxcWcMmXIBPd+1gE=