nixos/tests/firewall: use specialisations instead of multiple machines

This commit is contained in:
K900 2024-09-08 15:39:35 +03:00
parent 58ef00c5f7
commit fda8ac99d5

View File

@ -14,17 +14,10 @@ import ./make-test-python.nix ( { pkgs, nftables, ... } : {
networking.nftables.enable = nftables;
services.httpd.enable = true;
services.httpd.adminAddr = "foo@example.org";
};
# Dummy configuration to check whether firewall.service will be honored
# during system activation. This only needs to be different to the
# original walled configuration so that there is a change in the service
# file.
walled2 =
{ ... }:
{ networking.firewall.enable = true;
networking.firewall.rejectPackets = true;
networking.nftables.enable = nftables;
specialisation.different-config.configuration = {
networking.firewall.rejectPackets = true;
};
};
attacker =
@ -36,7 +29,6 @@ import ./make-test-python.nix ( { pkgs, nftables, ... } : {
};
testScript = { nodes, ... }: let
newSystem = nodes.walled2.system.build.toplevel;
unit = if nftables then "nftables" else "firewall";
in ''
start_all()
@ -62,7 +54,7 @@ import ./make-test-python.nix ( { pkgs, nftables, ... } : {
# Check whether activation of a new configuration reloads the firewall.
walled.succeed(
"${newSystem}/bin/switch-to-configuration test 2>&1 | grep -qF ${unit}.service"
"/run/booted-system/specialisation/different-config/bin/switch-to-configuration test 2>&1 | grep -qF ${unit}.service"
)
'';
})