nixpkgs/nixos/tests/miniflux.nix

{ pkgs, lib, ... }:

let
  port = 3142;
  username = "alice";
  password = "correcthorsebatterystaple";
  defaultPort = 8080;
  defaultUsername = "admin";
  defaultPassword = "password";
  adminCredentialsFile = pkgs.writeText "admin-credentials" ''
    ADMIN_USERNAME=${defaultUsername}
    ADMIN_PASSWORD=${defaultPassword}
  '';
  customAdminCredentialsFile = pkgs.writeText "admin-credentials" ''
    ADMIN_USERNAME=${username}
    ADMIN_PASSWORD=${password}
  '';
  postgresPassword = "correcthorsebatterystaple";
  postgresPasswordFile = pkgs.writeText "pgpass" ''
    *:*:*:*:${postgresPassword}
  '';

in
{
  name = "miniflux";
  meta.maintainers = [ ];

  nodes = {
    default =
      { ... }:
      {
        security.apparmor.enable = true;
        services.miniflux = {
          enable = true;
          inherit adminCredentialsFile;
        };
      };

    withoutSudo =
      { ... }:
      {
        security.apparmor.enable = true;
        services.miniflux = {
          enable = true;
          inherit adminCredentialsFile;
        };
        security.sudo.enable = false;
      };

    customized =
      { ... }:
      {
        security.apparmor.enable = true;
        services.miniflux = {
          enable = true;
          config = {
            CLEANUP_FREQUENCY = "48";
            LISTEN_ADDR = "localhost:${toString port}";
          };
          adminCredentialsFile = customAdminCredentialsFile;
        };
      };

    postgresTcp =
      {
        config,
        pkgs,
        lib,
        ...
      }:
      {
        services.postgresql = {
          enable = true;
          initialScript = pkgs.writeText "init-postgres" ''
            CREATE USER miniflux WITH PASSWORD '${postgresPassword}';
            CREATE DATABASE miniflux WITH OWNER miniflux;
          '';
          enableTCPIP = true;
          authentication = ''
            host sameuser miniflux samenet scram-sha-256
          '';
        };
        systemd.services.postgresql-setup.postStart = lib.mkAfter ''
          $PSQL -tAd miniflux -c 'CREATE EXTENSION hstore;'
        '';
        networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
      };
    externalDb =
      { ... }:
      {
        security.apparmor.enable = true;
        services.miniflux = {
          enable = true;
          createDatabaseLocally = false;
          inherit adminCredentialsFile;
          config = {
            DATABASE_URL = "user=miniflux host=postgresTcp dbname=miniflux sslmode=disable";
            PGPASSFILE = "/run/miniflux/pgpass";
          };
        };
        systemd.services.miniflux.preStart = ''
          cp ${postgresPasswordFile} /run/miniflux/pgpass
          chmod 600 /run/miniflux/pgpass
        '';
      };
  };
  testScript = ''
    def runTest(machine, port, user):
      machine.wait_for_unit("miniflux.service")
      machine.wait_for_open_port(port)
      machine.succeed(f"curl --fail 'http://localhost:{port}/healthcheck' | grep OK")
      machine.succeed(
          f"curl 'http://localhost:{port}/v1/me' -u '{user}' -H Content-Type:application/json | grep '\"is_admin\":true'"
      )
      machine.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')

    default.start()
    withoutSudo.start()
    customized.start()
    postgresTcp.start()

    runTest(default, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
    runTest(withoutSudo, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
    runTest(customized, ${toString port}, "${username}:${password}")

    postgresTcp.wait_for_unit("postgresql.target")
    externalDb.start()
    runTest(externalDb, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
  '';
}