cockpit: 330 -> 331 (#368886)

Author: GaetanLepage

nixos/modules/services/monitoring/cockpit.nix

@@ -53,171 +53,8 @@ in {
 
     networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
 
-    # units are in reverse sort order if you ls $out/lib/systemd/system
-    # all these units are basically verbatim translated from upstream
-
-    # Translation from $out/lib/systemd/system/systemd-cockpithttps.slice
-    systemd.slices.system-cockpithttps = {
-      description = "Resource limits for all [email protected] instances";
-      sliceConfig = {
-        TasksMax = 200;
-        MemoryHigh = "75%";
-        MemoryMax = "90%";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/[email protected]
-    systemd.sockets."cockpit-wsinstance-https@" = {
-      unitConfig = {
-        Description = "Socket for Cockpit Web Service https instance %I";
-        BindsTo = [ "cockpit.service" "cockpit-wsinstance-https@%i.service" ];
-        # clean up the socket after the service exits, to prevent fd leak
-        # this also effectively prevents a DoS by starting arbitrarily many sockets, as
-        # the services are resource-limited by system-cockpithttps.slice
-        Documentation = "man:cockpit-ws(8)";
-      };
-      socketConfig = {
-        ListenStream = "/run/cockpit/wsinstance/https@%i.sock";
-        SocketUser = "root";
-        SocketMode = "0600";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/[email protected]
-    systemd.services."cockpit-wsinstance-https@" = {
-      description = "Cockpit Web Service https instance %I";
-      bindsTo = [ "cockpit.service"];
-      path = [ cfg.package ];
-      documentation = [ "man:cockpit-ws(8)" ];
-      serviceConfig = {
-        Slice = "system-cockpithttps.slice";
-        ExecStart = "${cfg.package}/libexec/cockpit-ws --for-tls-proxy --port=0";
-        User = "root";
-        Group = "";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-wsinstance-http.socket
-    systemd.sockets.cockpit-wsinstance-http = {
-      unitConfig = {
-        Description = "Socket for Cockpit Web Service http instance";
-        BindsTo = "cockpit.service";
-        Documentation = "man:cockpit-ws(8)";
-      };
-      socketConfig = {
-        ListenStream = "/run/cockpit/wsinstance/http.sock";
-        SocketUser = "root";
-        SocketMode = "0600";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-wsinstance-https-factory.socket
-    systemd.sockets.cockpit-wsinstance-https-factory = {
-      unitConfig = {
-        Description = "Socket for Cockpit Web Service https instance factory";
-        BindsTo = "cockpit.service";
-        Documentation = "man:cockpit-ws(8)";
-      };
-      socketConfig = {
-        ListenStream = "/run/cockpit/wsinstance/https-factory.sock";
-        Accept = true;
-        SocketUser = "root";
-        SocketMode = "0600";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/[email protected]
-    systemd.services."cockpit-wsinstance-https-factory@" = {
-      description = "Cockpit Web Service https instance factory";
-      documentation = [ "man:cockpit-ws(8)" ];
-      path = [ cfg.package ];
-      serviceConfig = {
-        ExecStart = "${cfg.package}/libexec/cockpit-wsinstance-factory";
-        User = "root";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-wsinstance-http.service
-    systemd.services."cockpit-wsinstance-http" = {
-      description = "Cockpit Web Service http instance";
-      bindsTo = [ "cockpit.service" ];
-      path = [ cfg.package ];
-      documentation = [ "man:cockpit-ws(8)" ];
-      serviceConfig = {
-        ExecStart = "${cfg.package}/libexec/cockpit-ws --no-tls --port=0";
-        User = "root";
-        Group = "";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit.socket
-    systemd.sockets."cockpit" = {
-      unitConfig = {
-        Description = "Cockpit Web Service Socket";
-        Documentation = "man:cockpit-ws(8)";
-        Wants = "cockpit-motd.service";
-      };
-      socketConfig = {
-        ListenStream = cfg.port;
-        ExecStartPost = [
-          "-${cfg.package}/share/cockpit/motd/update-motd \"\" localhost"
-          "-${pkgs.coreutils}/bin/ln -snf active.motd /run/cockpit/motd"
-        ];
-        ExecStopPost = "-${pkgs.coreutils}/bin/ln -snf inactive.motd /run/cockpit/motd";
-      };
-      wantedBy = [ "sockets.target" ];
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit.service
-    systemd.services."cockpit" = {
-      description = "Cockpit Web Service";
-      documentation = [ "man:cockpit-ws(8)" ];
-      restartIfChanged = true;
-      path = with pkgs; [ coreutils cfg.package ];
-      requires = [ "cockpit.socket" "cockpit-wsinstance-http.socket" "cockpit-wsinstance-https-factory.socket" ];
-      after = [ "cockpit-wsinstance-http.socket" "cockpit-wsinstance-https-factory.socket" ];
-      environment = {
-        G_MESSAGES_DEBUG = "cockpit-ws,cockpit-bridge";
-      };
-      serviceConfig = {
-        RuntimeDirectory="cockpit/tls";
-        ExecStartPre = [
-          # cockpit-tls runs in a more constrained environment, these + means that these commands
-          # will run with full privilege instead of inside that constrained environment
-          # See https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart= for details
-          "+${cfg.package}/libexec/cockpit-certificate-ensure --for-cockpit-tls"
-        ];
-        ExecStart = "${cfg.package}/libexec/cockpit-tls";
-        User = "root";
-        Group = "";
-        NoNewPrivileges = true;
-        ProtectSystem = "strict";
-        ProtectHome = true;
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectKernelTunables = true;
-        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
-        MemoryDenyWriteExecute = true;
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-motd.service
-    # This part basically implements a motd state machine:
-    # - If cockpit.socket is enabled then /run/cockpit/motd points to /run/cockpit/active.motd
-    # - If cockpit.socket is disabled then /run/cockpit/motd points to /run/cockpit/inactive.motd
-    # - As cockpit.socket is disabled by default, /run/cockpit/motd points to /run/cockpit/inactive.motd
-    # /run/cockpit/active.motd is generated dynamically by cockpit-motd.service
-    systemd.services."cockpit-motd" = {
-      path = with pkgs; [ nettools ];
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${cfg.package}/share/cockpit/motd/update-motd";
-      };
-      description = "Cockpit motd updater service";
-      documentation = [ "man:cockpit-ws(8)" ];
-      wants = [ "network.target" ];
-      after = [ "network.target" "cockpit.socket" ];
-    };
+    systemd.packages = [ cfg.package ];
+    systemd.sockets.cockpit.wantedBy = [ "multi-user.target" ];
 
     systemd.tmpfiles.rules = [ # From $out/lib/tmpfiles.d/cockpit-tmpfiles.conf
       "C /run/cockpit/inactive.motd 0640 root root - ${cfg.package}/share/cockpit/motd/inactive.motd"

nixos/tests/cockpit.nix

@@ -67,14 +67,14 @@ import ./make-test-python.nix (
                     log("Opening homepage")
                     driver.get("https://server:9090")
 
-                    wait = WebDriverWait(driver, 60)
 
-
-                    def wait_elem(by, query):
+                    def wait_elem(by, query, timeout=10):
+                        wait = WebDriverWait(driver, timeout)
                         wait.until(EC.presence_of_element_located((by, query)))
 
 
-                    def wait_title_contains(title):
+                    def wait_title_contains(title, timeout=10):
+                        wait = WebDriverWait(driver, timeout)
                         wait.until(EC.title_contains(title))
 
 
@@ -121,6 +121,12 @@ import ./make-test-python.nix (
 
                     assert "Web console is running in limited access mode" in driver.page_source
 
+                    log("Clicking the sudo button")
+                    driver.switch_to.default_content()
+                    driver.find_element(By.CSS_SELECTOR, 'button.ct-locked').click()
+                    log("Checking that /nonexistent is not a thing")
+                    assert '/nonexistent' not in driver.page_source
+
                     driver.close()
                   '';
             in
@@ -136,12 +142,8 @@ import ./make-test-python.nix (
     testScript = ''
       start_all()
 
+      server.wait_for_unit("sockets.target")
       server.wait_for_open_port(9090)
-      server.wait_for_unit("network.target")
-      server.wait_for_unit("multi-user.target")
-      server.systemctl("start", "polkit")
-
-      client.wait_for_unit("multi-user.target")
 
       client.succeed("curl -k https://server:9090 -o /dev/stderr")
       print(client.succeed("whoami"))