forked from Drift/pvv-nixos-config
Merge pull request 'treewide: run nginx -t on all nginx config files' (!32) from test-nginx-overlay into main
Reviewed-on: Drift/pvv-nixos-config#32
This commit is contained in:
commit
ae4ace9fa2
|
@ -64,7 +64,11 @@
|
||||||
|
|
||||||
pkgs = import nixpkgs {
|
pkgs = import nixpkgs {
|
||||||
inherit system;
|
inherit system;
|
||||||
overlays = [ ] ++ config.overlays or [ ];
|
overlays = [
|
||||||
|
(import ./overlays/nginx-test.nix
|
||||||
|
(builtins.attrNames self.nixosConfigurations.${name}.config.security.acme.certs)
|
||||||
|
)
|
||||||
|
] ++ config.overlays or [ ];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
(removeAttrs config [ "modules" "overlays" ])
|
(removeAttrs config [ "modules" "overlays" ])
|
||||||
|
|
|
@ -0,0 +1,28 @@
|
||||||
|
acme-certs: final: prev:
|
||||||
|
let
|
||||||
|
lib = final.lib;
|
||||||
|
crt = "${final.path}/nixos/tests/common/acme/server/acme.test.cert.pem";
|
||||||
|
key = "${final.path}/nixos/tests/common/acme/server/acme.test.key.pem";
|
||||||
|
in {
|
||||||
|
writers = prev.writers // {
|
||||||
|
writeNginxConfig = name: text: final.runCommandLocal name {
|
||||||
|
nginxConfig = prev.writers.writeNginxConfig name text;
|
||||||
|
nativeBuildInputs = [ final.bubblewrap ];
|
||||||
|
} ''
|
||||||
|
ln -s "$nginxConfig" "$out"
|
||||||
|
set +o pipefail
|
||||||
|
bwrap \
|
||||||
|
--ro-bind "${crt}" "/etc/certs/nginx.crt" \
|
||||||
|
--ro-bind "${key}" "/etc/certs/nginx.key" \
|
||||||
|
--ro-bind "/nix" "/nix" \
|
||||||
|
--ro-bind "/etc/hosts" "/etc/hosts" \
|
||||||
|
--dir "/run/nginx" \
|
||||||
|
--dir "/tmp" \
|
||||||
|
--dir "/var/log/nginx" \
|
||||||
|
${lib.concatMapStrings (name: "--ro-bind \"${crt}\" \"/var/lib/acme/${name}/fullchain.pem\" \\") acme-certs}
|
||||||
|
${lib.concatMapStrings (name: "--ro-bind \"${key}\" \"/var/lib/acme/${name}/key.pem\" \\") acme-certs}
|
||||||
|
${lib.concatMapStrings (name: "--ro-bind \"${crt}\" \"/var/lib/acme/${name}/chain.pem\" \\") acme-certs}
|
||||||
|
${lib.getExe final.nginx} -t -c "$out" |& grep "syntax is ok"
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
Loading…
Reference in New Issue