Commit 8dade1f7 authored by Andreas Stührk's avatar Andreas Stührk Committed by pennae
Browse files

nixos/envoy: add option `requireValidConfig` to make config validation errors non-fatal 



Co-authored-by: default avatarVincent Haupert <vincent@yaxi.tech>
parent 84220a70

nixos/modules/services/networking/envoy.nix

+13 −4
Original line number Diff line number Diff line
@@ -6,12 +6,11 @@ let 
  cfg = config.services.envoy;

  format = pkgs.formats.json { };

  conf = format.generate "envoy.json" cfg.settings;

  validateConfig = file:

  validateConfig = required: file:

    pkgs.runCommand "validate-envoy-conf" { } ''

      ${cfg.package}/bin/envoy --log-level error --mode validate -c "${file}"

      ${cfg.package}/bin/envoy --log-level error --mode validate -c "${file}" ${lib.optionalString (!required) "|| true"}

      cp "${file}" "$out"

    '';



in



{
@@ -20,6 +19,16 @@ in 


    package = mkPackageOptionMD pkgs "envoy" { };



    requireValidConfig = mkOption {

      type = types.bool;

      default = true;

      description = lib.mdDoc ''

        Whether a failure during config validation at build time is fatal.

        When the config can't be checked during build time, for example when it includes

        other files, disable this option.

      '';

    };



    settings = mkOption {

      type = format.type;

      default = { };
@@ -55,7 +64,7 @@ in 
      requires = [ "network-online.target" ];

      wantedBy = [ "multi-user.target" ];

      serviceConfig = {

        ExecStart = "${cfg.package}/bin/envoy -c ${validateConfig conf}";

        ExecStart = "${cfg.package}/bin/envoy -c ${validateConfig cfg.requireValidConfig conf}";

        CacheDirectory = [ "envoy" ];

        LogsDirectory = [ "envoy" ];

        Restart = "no";

nixos/tests/envoy.nix

+27 −6
Original line number Diff line number Diff line
@@ -22,12 +22,33 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : { 
        clusters = [];

      };

    };

    specialisation = {

      withoutConfigValidation.configuration = { ... }: {

        services.envoy = {

          requireValidConfig = false;

          settings.admin.access_log_path = lib.mkForce "/var/log/envoy/access.log";

        };

      };

    };

  };



  testScript = ''

  testScript = { nodes, ... }:

    let

      specialisations = "${nodes.machine.system.build.toplevel}/specialisation";

    in

    ''

      machine.start()



      with subtest("envoy.service starts and responds with ready"):

        machine.wait_for_unit("envoy.service")

        machine.wait_for_open_port(80)

        machine.wait_until_succeeds("curl -fsS localhost:80/ready")



      with subtest("envoy.service works with config path not available at eval time"):

        machine.succeed('${specialisations}/withoutConfigValidation/bin/switch-to-configuration test')

        machine.wait_for_unit("envoy.service")

        machine.wait_for_open_port(80)

        machine.wait_until_succeeds("curl -fsS localhost:80/ready")

        machine.succeed('test -f /var/log/envoy/access.log')

    '';

})