TIN-539: NixOS VM tests for ser2net, NUT, and tailscale modules - #2
Open
Jess Sullivan (Jesssullivan) wants to merge 1 commit into
Open
TIN-539: NixOS VM tests for ser2net, NUT, and tailscale modules#2Jess Sullivan (Jesssullivan) wants to merge 1 commit into
Jess Sullivan (Jesssullivan) wants to merge 1 commit into
Conversation
Adds pkgs.testers.runNixOSTest coverage for the three modules named in
the ticket, using virtual hardware so no physical serial adapter, UPS,
or Tailscale account is needed:
- tests/vm/ser2net.nix: a socat PTY pair stands in for the serial
device; asserts the generated /etc/ser2net/ser2net.yaml carries the
module's own port/device/description, the firewall opens the
configured port, and connecting over TCP reaches the configured
serial device (proven via the connection banner, since ser2net sends
it immediately on accept before any serial-side bytes flow).
- tests/vm/nut.nix: NUT netserver mode against the dummy-ups driver
(file-backed simulated readings, no real UPS). Verified the module
internals against the live nixpkgs source
(nixos/modules/services/monitoring/ups.nix, nixos-24.11) rather than
assuming them: NUT_CONFPATH is hardcoded to /etc/nut, the relevant
systemd units are upsd.service/upsdrv.service/upsmon.service (upsdrv
is one oneshot registering every configured UPS, not one unit per
UPS), and passwordFile is the only auth option -- there is no
plaintext `password`.
- tests/vm/tailscale.nix: tailscaled starts without an auth key
(asserts an unauthenticated status rather than attempting a real
join), firewall trusts tailscale0, and IPv4/IPv6 forwarding are
enabled by useRoutingFeatures = "server" (read from
/proc/sys/net/{ipv4,ipv6}/conf/all/forwarding, matching exactly what
the nixpkgs module sets rather than a generic guess).
- tests/vm/integration.nix: all three on one machine, asserting the
configured ports are disjoint by construction and each service
starts and stays reachable alongside the other two.
None of these import modules/nut-server or hosts/common/tailscale.nix
directly -- both wire config.sops.secrets.*.path, which needs live
sops-nix secrets this hermetic VM does not have. Each test
reconstructs the same power.ups / services.tailscale shape with a
plaintext/writeText stand-in for the secret, which exercises the same
module logic the production config does.
Wired into flake.nix's checks output as
checks.x86_64-linux.{vm-ser2net,vm-nut,vm-tailscale,vm-integration},
gated to x86_64-linux only (VM tests need KVM; there is no CI signal
that aarch64 runners here have it, and a check that silently no-ops on
arches that lack KVM would be exactly the gate-theater failure mode
TIN-3457 warns about -- this is an explicit restriction, not an
omission). Added a "NixOS VM tests" step to the existing
.github/workflows/ci.yml `check` job's nix build sequence.
Not verified locally, by design: this session's environment does not
build or evaluate Nix (bazel/nix build is out of scope here). Every
new file passed nix-instantiate --parse (syntax only) plus statix and
deadnix (both directly available, no build needed) with zero findings.
The one thing genuinely unverifiable without a live run: the `check`
job runs on the self-hosted `tinyland-nix` ARC runner, not GitHub's
own `ubuntu-latest` -- whether that runner pod has /dev/kvm passthrough
is unproven from here. Flagged inline in ci.yml so a KVM-availability
failure reads as an infra question for tinyland-nix's owner, not a
defect in the tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
pkgs.testers.runNixOSTestcoverage for the ser2net, NUT, andTailscale modules named in TIN-539, using virtual hardware (socat PTY,
dummy-ups driver, keyless tailscaled) so no physical serial adapter, UPS,
or Tailscale account is needed. Wires the four new checks
(
vm-ser2net,vm-nut,vm-tailscale,vm-integration) intoflake.nixand adds a "NixOS VM tests" step to.github/workflows/ci.yml,gated to
x86_64-linuxonly.Related to TIN-539
Validation
Nix builds); every new file passed
nix-instantiate --parseplusstatix/deadnixwith zero findings.tinyland-nixARC runner pod has
/dev/kvmpassthrough for thecheckjob toactually run these VM tests. Flagged inline in
ci.ymlso aKVM-availability failure reads as an infra question for the runner's
owner, not a defect in the tests themselves.
createCommitOnBranch; pushing the.github/workflows/ci.ymlchange required the keyring OAuth tokenfallback (
env -u GH_TOKEN -u GITHUB_TOKEN) since this repo's defaultPAT lacks
workflowscope.sid/initial-scaffoldtip;touched-file diff against the local commit is byte-identical post-push.