chn/nixpkgs
1
0
Fork 0
mirror of https://github.com/CHN-beta/nixpkgs.git synced 2026-01-12 02:40:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

nixos/nebula: add DNS tests

Browse Source 
Signed-off-by: Sirio Balmelli <sirio@b-ad.ch>
This commit is contained in:
Sirio Balmelli
2025-03-06 10:56:52 +01:00
parent 40567b6b8d
commit a247dd229a
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
nixos/tests/nebula.nix
View File

@@ -14,7 +14,10 @@ import ./make-test-python.nix (
lib.mkMerge [
{
# Expose nebula for doing cert signing.
environment.systemPackages = [ pkgs.nebula ];
environment.systemPackages = [
pkgs.dig
pkgs.nebula
];
users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
services.openssh.enable = true;
networking.firewall.enable = true; # Implicitly true, but let's make sure.
@@ -51,6 +54,7 @@ import ./make-test-python.nix (
lighthouse =
{ ... }@args:
makeNebulaNode args "lighthouse" {
networking.firewall.allowedUDPPorts = [ 53 ];
networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
{
address = "192.168.1.1";
@@ -77,6 +81,13 @@ import ./make-test-python.nix (
}
];
};
lighthouse = {
dns = {
enable = true;
host = "10.0.100.1"; # bind to lighthouse interface
port = 53; # answer on standard DNS port
};
};
};
};
@@ -338,6 +349,8 @@ import ./make-test-python.nix (
# allowAny can ping the lighthouse, but not allowFromLighthouse because of its inbound firewall
allowAny.succeed("ping -c3 10.0.100.1")
allowAny.fail("ping -c3 10.0.100.3")
# allowAny can also resolve DNS on lighthouse
allowAny.succeed("dig @10.0.100.1 allowToLighthouse | grep -E 'allowToLighthouse\.\s+[0-9]+\s+IN\s+A\s+10\.0\.100\.4'")
# allowFromLighthouse can ping the lighthouse and allowAny
allowFromLighthouse.succeed("ping -c3 10.0.100.1")