movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-09 19:13:26 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixosTests.nginx-modsecurity: migrate to runTest

Browse source 
Part of #386873
This commit is contained in:
Piotr Kwiecinski 2025-03-29 23:52:25 +01:00
parent af2b019d25
commit 9a3d7473c4
No known key found for this signature in database
GPG key ID: EC0DE1CB9D5258B4
2 changed files with 46 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nixos/tests/all-tests.nix
View file

@ -804,7 +804,7 @@ in {
nginx-globalredirect = runTest ./nginx-globalredirect.nix;
nginx-http3 = handleTest ./nginx-http3.nix {};
nginx-mime = runTest ./nginx-mime.nix;
nginx-modsecurity = handleTest ./nginx-modsecurity.nix {};
nginx-modsecurity = runTest ./nginx-modsecurity.nix;
nginx-moreheaders = handleTest ./nginx-moreheaders.nix {};
nginx-njs = handleTest ./nginx-njs.nix {};
nginx-proxyprotocol = handleTest ./nginx-proxyprotocol {};

92
nixos/tests/nginx-modsecurity.nix
View file

@ -1,51 +1,49 @@
import ./make-test-python.nix (
{ pkgs, lib, ... }:
{
name = "nginx-modsecurity";
{ ... }:
{
name = "nginx-modsecurity";
nodes.machine =
{
config,
lib,
pkgs,
...
}:
{
services.nginx = {
enable = true;
additionalModules = [ pkgs.nginxModules.modsecurity ];
virtualHosts.localhost =
let
modsecurity_conf = pkgs.writeText "modsecurity.conf" ''
SecRuleEngine On
SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"
SecRule REQUEST_METHOD "HEAD" "id:100, phase:1, block"
SecRule REQUEST_FILENAME "secret.html" "id:101, phase:2, block"
'';
testroot = pkgs.runCommand "testroot" { } ''
mkdir -p $out
echo "<html><body>Hello World!</body></html>" > $out/index.html
echo "s3cret" > $out/secret.html
'';
in
{
root = testroot;
extraConfig = ''
modsecurity on;
modsecurity_rules_file ${modsecurity_conf};
'';
};
};
nodes.machine =
{
config,
lib,
pkgs,
...
}:
{
services.nginx = {
enable = true;
additionalModules = [ pkgs.nginxModules.modsecurity ];
virtualHosts.localhost =
let
modsecurity_conf = pkgs.writeText "modsecurity.conf" ''
SecRuleEngine On
SecDefaultAction "phase:1,log,auditlog,deny,status:403"
SecDefaultAction "phase:2,log,auditlog,deny,status:403"
SecRule REQUEST_METHOD "HEAD" "id:100, phase:1, block"
SecRule REQUEST_FILENAME "secret.html" "id:101, phase:2, block"
'';
testroot = pkgs.runCommand "testroot" { } ''
mkdir -p $out
echo "<html><body>Hello World!</body></html>" > $out/index.html
echo "s3cret" > $out/secret.html
'';
in
{
root = testroot;
extraConfig = ''
modsecurity on;
modsecurity_rules_file ${modsecurity_conf};
'';
};
};
testScript = ''
machine.wait_for_unit("nginx")
};
testScript = ''
machine.wait_for_unit("nginx")
response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
assert "Hello World!" in response
response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
assert "Hello World!" in response
machine.fail("curl -fvvv -X HEAD -s http://127.0.0.1/")
machine.fail("curl -fvvv -s http://127.0.0.1/secret.html")
'';
}
)
machine.fail("curl -fvvv -X HEAD -s http://127.0.0.1/")
machine.fail("curl -fvvv -s http://127.0.0.1/secret.html")
'';
}