makeEc2Test's userData parameter is required but image-contents.nix
passes null, triggering a deprecation warning from writeText. Make
userData optional (defaulting to null) and create an empty user-data
file when it's not provided.
The decompression subtests restart fetch-ec2-metadata multiple times
in quick succession, hitting systemd's rate limiter. Reset the failure
counter before each restart.
The test hardcoded "/nixos.qcow2" but the actual output filename
is derived from image.baseName and image.extension (e.g.
"nixos-image-...-x86_64-linux.qcow2"). Use image.fileName to get
the correct path, matching the pattern in ec2-image.nix.
Also make the IMDS server's token validation conditional: when no
token file exists in the metadata directory, requests are served
without authentication. This supports both EC2 (IMDSv2 with tokens)
and OpenStack (plain GET) metadata fetchers.
- Extract imds-server derivation into common/imds-server.nix so both
ec2-image.nix and common/ec2.nix share the same definition.
- Update common/ec2.nix (makeEc2Test) to use the IMDSv2 server
instead of micro_httpd, and add token/instance-id to the metadata
directory so the full IMDSv2 flow works.
- Simplify ec2-image.nix to import from the shared definition.
- Preflight validation now validates against the endpoint that issued
the token (IMDS_BASE_URL) instead of re-scanning all endpoints. The
previous behavior could silently switch to a different endpoint and
wasted time retrying unreachable ones.
- Add local keyword to endpoint variables in get_imds_token and
preflight_imds_token to avoid polluting global scope.
micro_httpd returns 501 for PUT requests, so IMDSv2 token acquisition
was never actually tested. Replace it with a minimal Python IMDS server
that handles the full IMDSv2 flow: PUT for token, token validation on
GET requests, and file serving from a metadata directory.
This means the test now validates that:
- The fetcher correctly obtains an IMDSv2 token via PUT
- The token is passed on subsequent metadata GET requests
- Requests without a valid token are rejected (401)
Tests that the EC2 metadata fetcher falls back to the IPv6 IMDS
endpoint (fd00:ec2::254) when the IPv4 endpoint is unreachable.
Works around QEMU guestfwd being IPv4-only by running socat +
micro_httpd inside the guest on the IPv6 address, then blocking
IPv4 IMDS with iptables and re-running the fetcher.
Updates the EC2 IMDS metadata fetcher script to support IPv6 endpoints. If you start an instance in an IPv6 subnet, if the EC2 instance gets an IPv6 address before the IPv4 address (extremely common), systemd will trigger the IMDS fetcher script and fail to fetch your NixOS configuration, leaving you with a useless unconfigured EC2 instance. This at least allows the NixOS configuration to be fetched and applied.
Refactor try_decompress to use a decompress_cmd variable, making it
straightforward to add new compression formats. Add bzip2 support
and a corresponding NixOS test.
Verify that fetch-ec2-metadata correctly decompresses gzip-compressed
EC2 user data. Adds a test helper for reuse by subsequent compression
format tests.
- Declare `ftype` as local to avoid leaking into caller scope
- Skip decompression attempt on empty files
- Clean up temp file on decompression failure
Philip Taron