Merge #103633: kresd service: switch .listenDoH

... to new implementation - and a couple other improvements.
This commit is contained in:
Vladimír Čunát 2020-11-17 20:06:55 +01:00
commit bdcd2d82ee
No known key found for this signature in database
GPG Key ID: E747DF1F9575A3AA
2 changed files with 14 additions and 10 deletions

View File

@ -23,18 +23,14 @@ let
'';
configFile = pkgs.writeText "kresd.conf" (
optionalString (cfg.listenDoH != []) ''
modules.load('http')
''
""
+ concatMapStrings (mkListen "dns") cfg.listenPlain
+ concatMapStrings (mkListen "tls") cfg.listenTLS
+ concatMapStrings (mkListen "doh") cfg.listenDoH
+ concatMapStrings (mkListen "doh2") cfg.listenDoH
+ cfg.extraConfig
);
package = if cfg.listenDoH == []
then pkgs.knot-resolver # never force `extraFeatures = false`
else pkgs.knot-resolver.override { extraFeatures = true; };
package = pkgs.knot-resolver;
in {
meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
@ -92,7 +88,7 @@ in {
default = [];
example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
description = ''
Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 8484).
Addresses and ports on which kresd should provide DNS over HTTPS/2 (see RFC 8484).
For detailed syntax see ListenStream in man systemd.socket.
'';
};

View File

@ -3,6 +3,7 @@
, runCommand, pkgconfig, meson, ninja, makeWrapper
# build+runtime deps.
, knot-dns, luajitPackages, libuv, gnutls, lmdb, systemd, dns-root-data
, nghttp2, libcap_ng # optionals, in principle
# test-only deps.
, cmocka, which, cacert
, extraFeatures ? false /* catch-all if defaults aren't enough */
@ -11,7 +12,7 @@ let # un-indented, over the whole file
result = if extraFeatures then wrapped-full else unwrapped;
inherit (stdenv.lib) optional optionals;
inherit (stdenv.lib) optional optionals optionalString;
lua = luajitPackages;
unwrapped = stdenv.mkDerivation rec {
@ -38,6 +39,11 @@ unwrapped = stdenv.mkDerivation rec {
# ExecStart can't be overwritten in overrides.
# We need that to use wrapped executable and correct config file.
sed '/^ExecStart=/d' -i systemd/kresd@.service.in
''
# some tests have issues with network sandboxing, apparently
+ optionalString doInstallCheck ''
echo 'os.exit(77)' > daemon/lua/trust_anchors.test/bootstrap.test.lua
sed '/^[[:blank:]]*test_dstaddr,$/d' -i tests/config/doh2.test.lua
'';
preConfigure = ''
@ -49,6 +55,7 @@ unwrapped = stdenv.mkDerivation rec {
# http://knot-resolver.readthedocs.io/en/latest/build.html#requirements
buildInputs = [ knot-dns lua.lua libuv gnutls lmdb ]
++ optional stdenv.isLinux systemd # passing sockets, sd_notify
++ [ nghttp2 libcap_ng ]
## optional dependencies; TODO: libedit, dnstap
;
@ -67,11 +74,12 @@ unwrapped = stdenv.mkDerivation rec {
postInstall = ''
rm "$out"/lib/libkres.a
rm "$out"/lib/knot-resolver/upgrade-4-to-5.lua # not meaningful on NixOS
'' + optionalString stdenv.targetPlatform.isLinux ''
rm -r "$out"/lib/sysusers.d/ # ATM more likely to harm than help
'';
doInstallCheck = with stdenv; hostPlatform == buildPlatform;
installCheckInputs = [ cmocka which cacert lua.cqueues lua.basexx ];
installCheckInputs = [ cmocka which cacert lua.cqueues lua.basexx lua.http ];
installCheckPhase = ''
meson test --print-errorlogs
'';