With this patch I essentially get the expected list of maintainers for changes in
nixos-tests.
The downside of this approach is that the CI facility assumes that
there's at most a single definition of `meta.maintainers`, however it
can be more in a module-system context.
For simplicity, just use the first definition location for the time
being.
Verified with
let
lib = import ./lib;
maintainers = import ./ci/eval/compare/maintainers.nix { inherit lib; };
in
maintainers {
changedFiles = [
"nixos/tests/matrix/matrix-authentication-service.nix"
];
affectedAttrPaths = map (lib.splitString ".") [
"nixosTests.matrix-authentication-service"
];
}
After fixing the registration bug I determined that the module was way
too verbose and did not need to provide all of the options provided in
the application. I've stopped explicitly declaring all options that
aren't needed to make a basic version of the module function. The
assertions have also been updated to mirror this fact and will alert a
user when the specific required options are unset. A new documnetation
file was also added as this module, like other mautrix modules, is quite
complex and may need more explaining.
`vhost-device-vsock`[1] is a custom implementation of AF_VSOCK, but the
application on the host-side uses a UNIX domain-socket. This gives us
the following nice properties:
* We don't need to do `--arg sandbox-paths /dev/vhost-vsock` anymore for
debugging builds within the sandbox. That means, untrusted users can
also debug these kinds of tests now.
* This prevents CID conflicts on the host-side, i.e. there's no need for
using `sshBackdoor.vsockOffset` for tests anymore.
A big shout-out goes to Allison Karlitskaya, the developer of test.thing[2]
who talked about this approach to do AF_VSOCK on All Systems Go 2025.
This patch requires systemd 258[3] because this contains `vhost-mux` in
its SSH config which is needed to connect to the VMs from now on.
To not blow up the patches even more, this only uses AF_VSOCK for the
debugger. A potential follow-up for the future would be a removal of the
current `backdoor.service` and replace it entirely by this
functionality.
The internal implementation tries to be consistent with how VLANs and
machines are handled, i.e. the processes are started when the Driver's
context is entered and cleaned up in __exit__().
I decided to push the process management and creation of sockets for
vhost-device-vsock into its own class, that's an implementation detail
and not a concern for the test-driver. In fact, `vhost-device-vsock` is
something we can drop once QEMU implements native support for using
AF_UNIX on the host-side[4]. `VsockPair` is its own class since
returning e.g. a triple of `(Path, Path, Int)` would be ambiguous in
what is the guest and what the host path (and frankly, I found it hard
to distinguish the two when reading the docs of `vhost-device-vsock`
initially).
Finally, now that we can do the SSH backdoor without adding additional
devices to the sandbox, I figured, it's time to write a test-case for
it.
[1] https://github.com/rust-vmm/vhost-device/blob/main/vhost-device-vsock/README.md
[2] https://codeberg.org/lis/test.thing
[3] https://github.com/NixOS/nixpkgs/pull/427968
[4] https://gitlab.com/qemu-project/qemu/-/issues/2095
- It lacks a consistent and transparent baseline or standard,
- It may introduce unexpected breakage or degrade performance without clear benefit,
- It is difficult to manage user expectations, especially since the implications of enabling it are not always obvious,
- and as multiple contributors have noted, it is often more of a “grab bag” of settings than a cohesive security policy.
This very basic documentation page contains a small introduction to Xen taken from my previous writeup at the NixOS Wiki, and some instructions on how to import the domU profile and enable Dom0.
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Adds a nixos module for configuring `pkgs.nextcloud-spreed-signaling`
and running it as a systemd service. This allows setting up a "High
Performance Backend" for use with Nextcloud Talk.
