mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
7526e9ab32
vagrant up makes a throwaway CA and a client certificate in .vagrant/tls/.pki/libvirt with the host's openssl (Vagrant puts its own first on PATH). Each compute signs its server certificate for its address, asks for SASL over TLS like over TCP, and listens on 16514. libvirt takes a client certificate from $HOME/.pki/libvirt, so the README's second run uses HOME=.vagrant/tls with TEST_LIBVIRT_TYPE=3 and leaves the user's own certificates alone.
73 lines
3.8 KiB
Ruby
73 lines
3.8 KiB
Ruby
# Two disposable compute nodes for the live tests (README: Running tests), so
|
|
# that migration runs between them: AlmaLinux 10 with nested KVM, set up by
|
|
# dev/libvirt-bootstrap.sh, with a SASL user for TCP and the host user's SSH
|
|
# key for root (SASL user wvc, password wvc-test). The empty second disk
|
|
# /dev/vdb is for the LVM tests (TEST_LIBVIRT_LVM_DEVICE); each also serves a
|
|
# 1 GiB iSCSI LUN on 127.0.0.1 for the iSCSI tests (TEST_LIBVIRT_ISCSI_TARGET),
|
|
# and accepts TLS logins (SASL) with a certificate from a throwaway CA.
|
|
|
|
# The CA is made here once; each compute signs its own certificate with it.
|
|
# The client certificate sits where libvirt looks with HOME=.vagrant/tls.
|
|
pki = File.join(__dir__, ".vagrant/tls/.pki/libvirt")
|
|
unless File.exist?(File.join(pki, "clientcert.pem"))
|
|
# the host's openssl, not the one Vagrant puts first on PATH
|
|
Vagrant::Util::Env.with_original_env do
|
|
system("sh", "-ec", <<-SH, pki, exception: true)
|
|
mkdir -p "$0" && cd "$0"
|
|
openssl req -x509 -newkey rsa:3072 -nodes -keyout cakey.pem -out cacert.pem -days 365 -subj /CN=wvc-test-ca
|
|
openssl req -new -newkey rsa:3072 -nodes -keyout clientkey.pem -subj /CN=wvc-test-client |
|
|
openssl x509 -req -CA cacert.pem -CAkey cakey.pem -days 365 -out clientcert.pem
|
|
SH
|
|
end
|
|
end
|
|
|
|
Vagrant.configure(2) do |config|
|
|
config.vm.box = "almalinux/10"
|
|
%w[compute1 compute2].each do |name|
|
|
config.vm.define(name) { |node| node.vm.hostname = "wvc-#{name}" }
|
|
end
|
|
config.vm.synced_folder ".", "/vagrant", disabled: true
|
|
config.vm.provider :libvirt do |v|
|
|
v.memory = 4096
|
|
v.cpus = 2
|
|
v.nested = true
|
|
v.cpu_mode = "host-passthrough"
|
|
v.video_type = "virtio" # EL10 hosts have no cirrus
|
|
v.storage :file, size: "4G"
|
|
end
|
|
# the bootstrap installs this checkout's gstfsd
|
|
config.vm.provision "file", source: "dev", destination: "/tmp/wvc/dev"
|
|
config.vm.provision "file", source: "conf", destination: "/tmp/wvc/conf"
|
|
config.vm.provision "file", source: "~/.ssh/id_ed25519.pub", destination: "/tmp/wvc/key.pub"
|
|
config.vm.provision "file", source: "#{pki}/cacert.pem", destination: "/tmp/wvc/cacert.pem"
|
|
config.vm.provision "file", source: "#{pki}/cakey.pem", destination: "/tmp/wvc/cakey.pem"
|
|
config.vm.provision "shell", inline: <<-SHELL
|
|
set -e
|
|
sh /tmp/wvc/dev/libvirt-bootstrap.sh
|
|
virsh pool-info default > /dev/null 2>&1 || { virsh pool-define-as default dir --target /var/lib/libvirt/images && virsh pool-autostart default && virsh pool-start default; }
|
|
echo wvc-test | saslpasswd2 -a libvirt -p wvc
|
|
install -d -m 700 /root/.ssh
|
|
cat /tmp/wvc/key.pub >> /root/.ssh/authorized_keys
|
|
dnf -y install targetcli
|
|
systemctl enable --now target
|
|
T=iqn.2026-10.test.wvc:lun
|
|
targetcli ls /iscsi/$T > /dev/null 2>&1 || {
|
|
targetcli /backstores/fileio create wvc /var/lib/wvc-iscsi.img 1G
|
|
targetcli /iscsi create $T
|
|
targetcli /iscsi/$T/tpg1/portals delete 0.0.0.0 3260
|
|
targetcli /iscsi/$T/tpg1/portals create 127.0.0.1 3260
|
|
targetcli /iscsi/$T/tpg1/luns create /backstores/fileio/wvc
|
|
targetcli /iscsi/$T/tpg1 set attribute generate_node_acls=1 demo_mode_write_protect=0
|
|
targetcli saveconfig
|
|
}
|
|
install -D -m 644 /tmp/wvc/cacert.pem /etc/pki/CA/cacert.pem
|
|
install -d /etc/pki/libvirt/private
|
|
echo "subjectAltName=IP:$(hostname -I | cut -d' ' -f1)" > /tmp/wvc/ext
|
|
openssl req -new -newkey rsa:3072 -nodes -keyout /etc/pki/libvirt/private/serverkey.pem -subj /CN=$(hostname) |
|
|
openssl x509 -req -CA /tmp/wvc/cacert.pem -CAkey /tmp/wvc/cakey.pem -days 365 -extfile /tmp/wvc/ext -out /etc/pki/libvirt/servercert.pem
|
|
sed -i 's/^#auth_tls = "none"/auth_tls = "sasl"/' /etc/libvirt/virtproxyd.conf
|
|
# a running service would keep the old settings and refuse a new socket
|
|
systemctl stop virtproxyd.service
|
|
systemctl enable --now virtproxyd-tls.socket
|
|
SHELL
|
|
end
|