Merge pull request flyingcircusio#1194 from flyingcircusio/phil/PL-13…

…3251_fix-varnish-reload-with-cold-vcls

[PL-133251] fix varnish reload

changelog.d/20241209_153315_phil-fix-varnish-reload_scriv.md

@@ -0,0 +1,15 @@
+<!--
+A new changelog entry.
+Delete placeholder items that do not apply. Empty sections will be removed
+automatically during release.
+Leave the XX.XX as is: this is a placeholder and will be automatically filled
+correctly during the release and helps when backporting over multiple platform
+branches.
+-->
+
+### Impact
+
+
+### NixOS XX.XX platform
+
+- Fix a bug in the reload script for the varnish service that only occurs when there are cold VCLs to be discarded. An error in the templating would lead to attempting to run a varnish admin instruction (vcl.discard in this case) as a shell command. (PL-133251)

nixos/services/varnish/default.nix

@@ -189,7 +189,7 @@ in {
 
         if [ ! -z "$coldvcls" ]; then
           for vcl in "$coldvcls"; do
-            $vadm vcl.discard $vcl
+            ${vadm} vcl.discard $vcl
           done
         fi
       '';

tests/webproxy.nix

@@ -1,6 +1,14 @@
 import ./make-test-python.nix ({ pkgs, testlib, ... }: let
   varnishport = 8008;
   serverport = 8080;
+
+  cold_testvcl = pkgs.writeText "test_vcl" ''
+      vcl 4.0;
+      backend test_another_cold_vcl {
+        .host = "127.0.0.1";
+        .port = "200";
+      }
+  '';
 in {
   name = "webproxy";
   nodes = {
@@ -132,6 +140,20 @@ in {
       webproxy_old_varnish.systemctl("reload varnish")
       webproxy_old_varnish.wait_until_succeeds(f"{curl} | grep -q 'Hello World!'")
 
+    with subtest("varnish reloads with cold vcl and the cold vcl is discarded"):
+      webproxy.succeed("varnishadm vcl.list | grep \"0 boot\"")
+      webproxy.succeed("varnishadm vcl.state boot cold")
+      webproxy.systemctl("reload varnish")
+      webproxy.fail("varnishadm vcl.list | grep cold")
+
+    with subtest("varnish reloads with multiple cold vcls and the cold vcls are discarded"):
+      webproxy.systemctl("restart varnish")
+      webproxy.succeed("varnishadm vcl.list | grep \"0 boot\"")
+      webproxy.succeed("varnishadm vcl.state boot cold")
+      webproxy.succeed("varnishadm vcl.load another_cold_vcl ${cold_testvcl} cold")
+      webproxy.systemctl("reload varnish")
+      webproxy.fail("varnishadm vcl.list | grep \" cold \"")
+
     with subtest("varnish with broken config should fail to switch"):
       # switching to a different specialisation requires a reboot, otherwise `/run/current-system/specialisation/` is empty
       # reboot is broken since it doesn't set `booted = False` and the VM will not boot with `booted = True`