mirror of
https://github.com/tailscale/tailscale.git
synced 2024-11-26 11:35:35 +00:00
b131a74f99
Okay, so, at a high level testing NixOS is a lot different than other distros due to NixOS' determinism. Normally NixOS wants packages to be defined in either an overlay, a custom packageOverrides or even yolo-inline as a part of the system configuration. This is going to have us take a different approach compared to other distributions. The overall plan here is as following: 1. make the binaries as normal 2. template in their paths as raw strings to the nixos system module 3. run `nixos-generators -f qcow -o $CACHE_DIR/tailscale/nixos/version -c generated-config.nix` 4. pass that to the steps that make the virtual machine It doesn't really make sense for us to use a premade virtual machine image for this as that will make it harder to deterministically create the image. Nix commands generate a lot of output, so their output is hidden behind the `-verbose-nix-output` flag. This unfortunately makes this test suite have a hard dependency on Nix/NixOS, however the test suite has only ever been run on NixOS (and I am not sure if it runs on other distros at all), so this probably isn't too big of an issue. Signed-off-by: Christine Dodrill <xe@tailscale.com>
90 lines
2.6 KiB
Nix
90 lines
2.6 KiB
Nix
# This is a NixOS module to allow a machine to act as an integration test
|
|
# runner. This is used for the end-to-end VM test suite.
|
|
|
|
{ lib, config, pkgs, ... }:
|
|
|
|
{
|
|
# The GitHub Actions self-hosted runner service.
|
|
services.github-runner = {
|
|
enable = true;
|
|
url = "https://github.com/tailscale/tailscale";
|
|
replace = true;
|
|
extraLabels = [ "vm_integration_test" ];
|
|
|
|
# Justifications for the packages:
|
|
extraPackages = with pkgs; [
|
|
# The test suite is written in Go.
|
|
go
|
|
|
|
# This contains genisoimage, which is needed to create cloud-init
|
|
# seeds.
|
|
cdrkit
|
|
|
|
# This package is the virtual machine hypervisor we use in tests.
|
|
qemu
|
|
|
|
# This package contains tools like `ssh-keygen`.
|
|
openssh
|
|
|
|
# The C complier so cgo builds work.
|
|
gcc
|
|
|
|
# The package manager Nix, just in case.
|
|
nix
|
|
|
|
# Used to generate a NixOS image for testing.
|
|
nixos-generators
|
|
|
|
# Used to extract things.
|
|
gnutar
|
|
|
|
# Used to decompress things.
|
|
lzma
|
|
];
|
|
|
|
# Customize this to include your GitHub username so we can track
|
|
# who is running which node.
|
|
name = "YOUR-GITHUB-USERNAME-tstest-integration-vms";
|
|
|
|
# Replace this with the path to the GitHub Actions runner token on
|
|
# your disk.
|
|
tokenFile = "/run/decrypted/ts-oss-ghaction-token";
|
|
};
|
|
|
|
# A user account so there is a home directory and so they have kvm
|
|
# access. Please don't change this account name.
|
|
users.users.ghrunner = {
|
|
createHome = true;
|
|
isSystemUser = true;
|
|
extraGroups = [ "kvm" ];
|
|
};
|
|
|
|
# The default github-runner service sets a lot of isolation features
|
|
# that attempt to limit the damage that malicious code can use.
|
|
# Unfortunately we rely on some "dangerous" features to do these tests,
|
|
# so this shim will peel some of them away.
|
|
systemd.services.github-runner = {
|
|
serviceConfig = {
|
|
# We need access to /dev to poke /dev/kvm.
|
|
PrivateDevices = lib.mkForce false;
|
|
|
|
# /dev/kvm is how qemu creates a virtual machine with KVM.
|
|
DeviceAllow = lib.mkForce [ "/dev/kvm" ];
|
|
|
|
# Ensure the service has KVM permissions with the `kvm` group.
|
|
ExtraGroups = [ "kvm" ];
|
|
|
|
# The service runs as a dynamic user by default. This makes it hard
|
|
# to persistently store things in /var/lib/ghrunner. This line
|
|
# disables the dynamic user feature.
|
|
DynamicUser = lib.mkForce false;
|
|
|
|
# Run this service as our ghrunner user.
|
|
User = "ghrunner";
|
|
|
|
# We need access to /var/lib/ghrunner to store VM images.
|
|
ProtectSystem = lib.mkForce null;
|
|
};
|
|
};
|
|
}
|