nixos/tests/firewall: use specialisations instead of multiple machines
This commit is contained in:
parent
58ef00c5f7
commit
fda8ac99d5
@ -14,17 +14,10 @@ import ./make-test-python.nix ( { pkgs, nftables, ... } : {
|
||||
networking.nftables.enable = nftables;
|
||||
services.httpd.enable = true;
|
||||
services.httpd.adminAddr = "foo@example.org";
|
||||
};
|
||||
|
||||
# Dummy configuration to check whether firewall.service will be honored
|
||||
# during system activation. This only needs to be different to the
|
||||
# original walled configuration so that there is a change in the service
|
||||
# file.
|
||||
walled2 =
|
||||
{ ... }:
|
||||
{ networking.firewall.enable = true;
|
||||
networking.firewall.rejectPackets = true;
|
||||
networking.nftables.enable = nftables;
|
||||
specialisation.different-config.configuration = {
|
||||
networking.firewall.rejectPackets = true;
|
||||
};
|
||||
};
|
||||
|
||||
attacker =
|
||||
@ -36,7 +29,6 @@ import ./make-test-python.nix ( { pkgs, nftables, ... } : {
|
||||
};
|
||||
|
||||
testScript = { nodes, ... }: let
|
||||
newSystem = nodes.walled2.system.build.toplevel;
|
||||
unit = if nftables then "nftables" else "firewall";
|
||||
in ''
|
||||
start_all()
|
||||
@ -62,7 +54,7 @@ import ./make-test-python.nix ( { pkgs, nftables, ... } : {
|
||||
|
||||
# Check whether activation of a new configuration reloads the firewall.
|
||||
walled.succeed(
|
||||
"${newSystem}/bin/switch-to-configuration test 2>&1 | grep -qF ${unit}.service"
|
||||
"/run/booted-system/specialisation/different-config/bin/switch-to-configuration test 2>&1 | grep -qF ${unit}.service"
|
||||
)
|
||||
'';
|
||||
})
|
||||
|
Loading…
Reference in New Issue
Block a user