Integration tests for nginx plugin (without root).

letsencrypt_nginx/configurator.py

@@ -80,8 +80,7 @@ class NginxConfigurator(common.Plugin):
         super(NginxConfigurator, self).__init__(*args, **kwargs)
 
         # Verify that all directories and files exist with proper permissions
-        if os.geteuid() == 0:
-            self._verify_setup()
+        self._verify_setup()
 
         # Files to save
         self.save_notes = ""
@@ -294,6 +293,12 @@ class NginxConfigurator(common.Plugin):
         """
         snakeoil_cert, snakeoil_key = self._get_snakeoil_paths()
         ssl_block = [['listen', '{0} ssl'.format(self.config.dvsni_port)],
+                     # access and error logs necessary for integration
+                     # testing (non-root)
+                     ['access_log', os.path.join(
+                         self.config.work_dir, 'access.log')],
+                     ['error_log', os.path.join(
+                         self.config.work_dir, 'error.log')],
                      ['ssl_certificate', snakeoil_cert],
                      ['ssl_certificate_key', snakeoil_key],
                      ['include', self.parser.loc["ssl_options"]]]

letsencrypt_nginx/dvsni.py

@@ -134,6 +134,12 @@ class NginxDvsni(common.Dvsni):
 
         block.extend([['server_name', achall.nonce_domain],
                       ['include', self.configurator.parser.loc["ssl_options"]],
+                      # access and error logs necessary for
+                      # integration testing (non-root)
+                      ['access_log', os.path.join(
+                          self.configurator.config.work_dir, 'access.log')],
+                      ['error_log', os.path.join(
+                          self.configurator.config.work_dir, 'error.log')],
                       ['ssl_certificate', self.get_cert_file(achall)],
                       ['ssl_certificate_key', achall.key.file],
                       [['location', '/'], [['root', document_root]]]])

letsencrypt_nginx/tests/configurator_test.py

@@ -111,12 +111,16 @@ class NginxConfiguratorTest(util.NginxTest):
 
         self.config.parser.load()
 
+        access_log = os.path.join(self.work_dir, "access.log")
+        error_log = os.path.join(self.work_dir, "error.log")
         self.assertEqual([[['server'],
                            [['listen', '69.50.225.155:9000'],
                             ['listen', '127.0.0.1'],
                             ['server_name', '.example.com'],
                             ['server_name', 'example.*'],
                             ['listen', '5001 ssl'],
+                            ['access_log', access_log],
+                            ['error_log', error_log],
                             ['ssl_certificate', 'example/cert.pem'],
                             ['ssl_certificate_key', 'example/key.pem'],
                             ['include',
@@ -132,6 +136,8 @@ class NginxConfiguratorTest(util.NginxTest):
                             [['root', 'html'],
                              ['index', 'index.html index.htm']]],
                            ['listen', '5001 ssl'],
+                           ['access_log', access_log],
+                           ['error_log', error_log],
                            ['ssl_certificate', '/etc/nginx/cert.pem'],
                            ['ssl_certificate_key', '/etc/nginx/key.pem'],
                            ['include',

tests/boulder-integration-nginx.sh

@@ -0,0 +1,50 @@
+#!/bin/sh -xe
+
+# prerequisite: apt-get install --no-install-recommends nginx-light openssl
+
+if [ "xxx$root" = "xxx" ];
+then
+    root="$(mktemp -d)"
+fi
+export root
+
+export PATH="/usr/sbin:$PATH"  # /usr/sbin/nginx
+
+echo "\nRoot integration tests directory: $root"
+store_flags="--config-dir $root/conf --work-dir $root/work"
+store_flags="$store_flags --logs-dir $root/logs"
+
+nginx_root="$root/nginx"
+mkdir $nginx_root
+root="$nginx_root" ./tests/nginx.conf.sh > $nginx_root/nginx.conf
+
+killall nginx || true
+nginx -c $nginx_root/nginx.conf
+
+common() {
+    # first three flags required, rest is handy defaults
+    letsencrypt \
+        --server "${SERVER:-http://localhost:4000/acme/new-reg}" \
+        --no-verify-ssl \
+        --dvsni-port 5001 \
+        $store_flags \
+        --text \
+        --agree-eula \
+        --email "" \
+        -vvvvvvv "$@"
+}
+
+test_nginx() {
+    common --configurator nginx \
+           --nginx-server-root $nginx_root \
+           "$@"
+}
+
+test_nginx --domains nginx.wtf run
+echo | openssl s_client -connect localhost:5001 \
+    | openssl x509 -out $root/nginx.pem
+diff -q $root/nginx.pem $root/conf/live/nginx.wtf/cert.pem
+
+# note: not reached if anything above fails, hence "killall" at the
+# top
+nginx -c $nginx_root/nginx.conf -s stop

tests/nginx.conf.sh

@@ -0,0 +1,67 @@
+# Based on
+# https://www.exratione.com/2014/03/running-nginx-as-a-non-root-user/
+# https://github.com/exratione/non-root-nginx/blob/9a77f62e5d5cb9c9026fd62eece76b9514011019/nginx.conf
+
+cat <<EOF
+# This error log will be written regardless of server scope error_log
+# definitions, so we have to set this here in the main scope.
+#
+# Even doing this, Nginx will still try to create the default error file, and
+# log a non-fatal error when it fails. After that things will work, however.
+error_log $root/error.log;
+
+# The pidfile will be written to /var/run unless this is set.
+pid $root/nginx.pid;
+
+worker_processes 1;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  # Set an array of temp and cache file options that will otherwise default to
+  # restricted locations accessible only to root.
+  client_body_temp_path $root/client_body;
+  fastcgi_temp_path $root/fastcgi_temp;
+  proxy_temp_path $root/proxy_temp;
+  #scgi_temp_path $root/scgi_temp;
+  #uwsgi_temp_path $root/uwsgi_temp;
+
+  # This should be turned off in a Virtualbox VM, as it can cause some
+  # interesting issues with data corruption in delivered files.
+  sendfile off;
+
+  tcp_nopush on;
+  tcp_nodelay on;
+  keepalive_timeout 65;
+  types_hash_max_size 2048;
+
+  include /etc/nginx/mime.types;
+  index index.html index.htm index.php;
+
+  log_format   main '\$remote_addr - \$remote_user [\$time_local] \$status '
+    '"\$request" \$body_bytes_sent "\$http_referer" '
+    '"\$http_user_agent" "\$http_x_forwarded_for"';
+
+  default_type application/octet-stream;
+
+  server {
+    # IPv4.
+    listen 8080;
+    # IPv6.
+    listen [::]:8080 default ipv6only=on;
+
+    root $root/webroot;
+
+    access_log $root/access.log;
+    error_log $root/error.log;
+
+    location / {
+      # First attempt to serve request as file, then as directory, then fall
+      # back to index.html.
+      try_files \$uri \$uri/ /index.html;
+    }
+  }
+}
+EOF