|
| 1 | +args@{ pkgs, nextcloudVersion ? 25, ... }: |
| 2 | + |
| 3 | +(import ../make-test-python.nix ({ pkgs, ...}: let |
| 4 | + adminuser = "root"; |
| 5 | + adminpass = "notproduction"; |
| 6 | + nextcloudBase = { |
| 7 | + networking.firewall.allowedTCPPorts = [ 80 ]; |
| 8 | + system.stateVersion = "22.05"; # stateVersions <22.11 use openssl 1.1 by default |
| 9 | + services.nextcloud = { |
| 10 | + enable = true; |
| 11 | + config.adminpassFile = "${pkgs.writeText "adminpass" adminpass}"; |
| 12 | + package = pkgs.${"nextcloud" + (toString nextcloudVersion)}; |
| 13 | + }; |
| 14 | + }; |
| 15 | +in { |
| 16 | + name = "nextcloud-openssl"; |
| 17 | + meta = with pkgs.lib.maintainers; { |
| 18 | + maintainers = [ ma27 ]; |
| 19 | + }; |
| 20 | + nodes.nextcloudwithopenssl1 = { |
| 21 | + imports = [ nextcloudBase ]; |
| 22 | + services.nextcloud.hostName = "nextcloudwithopenssl1"; |
| 23 | + }; |
| 24 | + nodes.nextcloudwithopenssl3 = { |
| 25 | + imports = [ nextcloudBase ]; |
| 26 | + services.nextcloud = { |
| 27 | + hostName = "nextcloudwithopenssl3"; |
| 28 | + enableBrokenCiphersForSSE = false; |
| 29 | + }; |
| 30 | + }; |
| 31 | + testScript = { nodes, ... }: let |
| 32 | + withRcloneEnv = host: pkgs.writeScript "with-rclone-env" '' |
| 33 | + #!${pkgs.runtimeShell} |
| 34 | + export RCLONE_CONFIG_NEXTCLOUD_TYPE=webdav |
| 35 | + export RCLONE_CONFIG_NEXTCLOUD_URL="http://${host}/remote.php/webdav/" |
| 36 | + export RCLONE_CONFIG_NEXTCLOUD_VENDOR="nextcloud" |
| 37 | + export RCLONE_CONFIG_NEXTCLOUD_USER="${adminuser}" |
| 38 | + export RCLONE_CONFIG_NEXTCLOUD_PASS="$(${pkgs.rclone}/bin/rclone obscure ${adminpass})" |
| 39 | + "''${@}" |
| 40 | + ''; |
| 41 | + withRcloneEnv1 = withRcloneEnv "nextcloudwithopenssl1"; |
| 42 | + withRcloneEnv3 = withRcloneEnv "nextcloudwithopenssl3"; |
| 43 | + copySharedFile1 = pkgs.writeScript "copy-shared-file" '' |
| 44 | + #!${pkgs.runtimeShell} |
| 45 | + echo 'hi' | ${withRcloneEnv1} ${pkgs.rclone}/bin/rclone rcat nextcloud:test-shared-file |
| 46 | + ''; |
| 47 | + copySharedFile3 = pkgs.writeScript "copy-shared-file" '' |
| 48 | + #!${pkgs.runtimeShell} |
| 49 | + echo 'bye' | ${withRcloneEnv3} ${pkgs.rclone}/bin/rclone rcat nextcloud:test-shared-file2 |
| 50 | + ''; |
| 51 | + openssl1-node = nodes.nextcloudwithopenssl1.config.system.build.toplevel; |
| 52 | + openssl3-node = nodes.nextcloudwithopenssl3.config.system.build.toplevel; |
| 53 | + in '' |
| 54 | + nextcloudwithopenssl1.start() |
| 55 | + nextcloudwithopenssl1.wait_for_unit("multi-user.target") |
| 56 | + nextcloudwithopenssl1.succeed("nextcloud-occ status") |
| 57 | + nextcloudwithopenssl1.succeed("curl -sSf http://nextcloudwithopenssl1/login") |
| 58 | +
|
| 59 | + with subtest("With OpenSSL 1 SSE can be enabled and used"): |
| 60 | + nextcloudwithopenssl1.succeed("nextcloud-occ app:enable encryption") |
| 61 | + nextcloudwithopenssl1.succeed("nextcloud-occ encryption:enable") |
| 62 | +
|
| 63 | + with subtest("Upload file and ensure it's encrypted"): |
| 64 | + nextcloudwithopenssl1.succeed("${copySharedFile1}") |
| 65 | + nextcloudwithopenssl1.succeed("grep -E '^HBEGIN:oc_encryption_module' /var/lib/nextcloud/data/root/files/test-shared-file") |
| 66 | + nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi") |
| 67 | +
|
| 68 | + with subtest("Switch to OpenSSL 3"): |
| 69 | + nextcloudwithopenssl1.succeed("${openssl3-node}/bin/switch-to-configuration test") |
| 70 | + nextcloudwithopenssl1.wait_for_open_port(80) |
| 71 | + nextcloudwithopenssl1.succeed("nextcloud-occ status") |
| 72 | +
|
| 73 | + with subtest("Existing encrypted files cannot be read, but new files can be added"): |
| 74 | + nextcloudwithopenssl1.fail("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file >&2") |
| 75 | + nextcloudwithopenssl1.succeed("nextcloud-occ encryption:disable") |
| 76 | + nextcloudwithopenssl1.succeed("${copySharedFile3}") |
| 77 | + nextcloudwithopenssl1.succeed("grep bye /var/lib/nextcloud/data/root/files/test-shared-file2") |
| 78 | + nextcloudwithopenssl1.succeed("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye") |
| 79 | +
|
| 80 | + with subtest("Switch back to OpenSSL 1.1 and ensure that encrypted files are readable again"): |
| 81 | + nextcloudwithopenssl1.succeed("${openssl1-node}/bin/switch-to-configuration test") |
| 82 | + nextcloudwithopenssl1.wait_for_open_port(80) |
| 83 | + nextcloudwithopenssl1.succeed("nextcloud-occ status") |
| 84 | + nextcloudwithopenssl1.succeed("nextcloud-occ encryption:enable") |
| 85 | + nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye") |
| 86 | + nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi") |
| 87 | + nextcloudwithopenssl1.succeed("grep -E '^HBEGIN:oc_encryption_module' /var/lib/nextcloud/data/root/files/test-shared-file") |
| 88 | + nextcloudwithopenssl1.succeed("grep bye /var/lib/nextcloud/data/root/files/test-shared-file2") |
| 89 | +
|
| 90 | + with subtest("Ensure that everything can be decrypted"): |
| 91 | + nextcloudwithopenssl1.succeed("echo y | nextcloud-occ encryption:decrypt-all >&2") |
| 92 | + nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye") |
| 93 | + nextcloudwithopenssl1.succeed("${withRcloneEnv1} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi") |
| 94 | + nextcloudwithopenssl1.succeed("grep -vE '^HBEGIN:oc_encryption_module' /var/lib/nextcloud/data/root/files/test-shared-file") |
| 95 | +
|
| 96 | + with subtest("Switch to OpenSSL 3 ensure that all files are usable now"): |
| 97 | + nextcloudwithopenssl1.succeed("${openssl3-node}/bin/switch-to-configuration test") |
| 98 | + nextcloudwithopenssl1.wait_for_open_port(80) |
| 99 | + nextcloudwithopenssl1.succeed("nextcloud-occ status") |
| 100 | + nextcloudwithopenssl1.succeed("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file2 | grep bye") |
| 101 | + nextcloudwithopenssl1.succeed("${withRcloneEnv3} ${pkgs.rclone}/bin/rclone cat nextcloud:test-shared-file | grep hi") |
| 102 | +
|
| 103 | + nextcloudwithopenssl1.shutdown() |
| 104 | + ''; |
| 105 | +})) args |
0 commit comments