Merge pull request #233151 from Misterio77/headscale-better-test

import ./make-test-python.nix ({ pkgs, lib, ... }: {

import ./make-test-python.nix ({ pkgs, lib, ... }:

  let

    tls-cert =

      pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''

        openssl req \

          -x509 -newkey rsa:4096 -sha256 -days 365 \

          -nodes -out cert.pem -keyout key.pem \

          -subj '/CN=headscale' -addext "subjectAltName=DNS:headscale"

        mkdir -p $out

        cp key.pem cert.pem $out

      '';

  in {

    name = "headscale";

    meta.maintainers = with lib.maintainers; [ misterio77 ];

  nodes.machine = { ... }: {

    services.headscale.enable = true;

    nodes = let

      headscalePort = 8080;

      stunPort = 3478;

      peer = {

        services.tailscale.enable = true;

        security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];

      };

    in {

      peer1 = peer;

      peer2 = peer;

      headscale = {

        services = {

          headscale = {

            enable = true;

            port = headscalePort;

            settings = {

              server_url = "https://headscale";

              ip_prefixes = [ "100.64.0.0/10" ];

              derp.server = {

                enabled = true;

                region_id = 999;

                stun_listen_addr = "0.0.0.0:${toString stunPort}";

              };

            };

          };

          nginx = {

            enable = true;

            virtualHosts.headscale = {

              addSSL = true;

              sslCertificate = "${tls-cert}/cert.pem";

              sslCertificateKey = "${tls-cert}/key.pem";

              locations."/" = {

                proxyPass = "http://127.0.0.1:${toString headscalePort}";

                proxyWebsockets = true;

              };

            };

          };

        };

        networking.firewall = {

          allowedTCPPorts = [ 80 443 ];

          allowedUDPPorts = [ stunPort ];

        };

        environment.systemPackages = [ pkgs.headscale ];

      };

    };

    testScript = ''

    machine.wait_for_unit("headscale")

    machine.wait_for_open_port(8080)

    # Test basic functionality

    machine.succeed("headscale namespaces create test")

    machine.succeed("headscale preauthkeys -u test create")

      start_all()

      headscale.wait_for_unit("headscale")

      headscale.wait_for_open_port(443)

      # Create headscale user and preauth-key

      headscale.succeed("headscale users create test")

      authkey = headscale.succeed("headscale preauthkeys -u test create --reusable")

      # Connect peers

      up_cmd = f"tailscale up --login-server 'https://headscale' --auth-key {authkey}"

      peer1.execute(up_cmd)

      peer2.execute(up_cmd)

      # Check that they are reachable from the tailnet

      peer1.wait_until_succeeds("tailscale ping peer2")

      peer2.wait_until_succeeds("tailscale ping peer1")

    '';

  })

  buildGoModule,

  fetchFromGitHub,

  installShellFiles,

  nixosTests,

}:

buildGoModule rec {

  pname = "headscale";

      --zsh <($out/bin/headscale completion zsh)

  '';

  passthru.tests = { inherit (nixosTests) headscale; };

  meta = with lib; {

    homepage = "https://github.com/juanfont/headscale";

    description = "An open source, self-hosted implementation of the Tailscale control server";