depot/third_party/nixpkgs/nixos/tests/guix/publish.nix

# Testing out the substitute server with two machines in a local network. As a
# bonus, we'll also test a feature of the substitute server being able to
# advertise its service to the local network with Avahi.

import ../make-test-python.nix (
  { pkgs, lib, ... }:
  let
    publishPort = 8181;
    inherit (builtins) toString;
  in
  {
    name = "guix-publish";

    meta.maintainers = with lib.maintainers; [ foo-dogsquared ];

    nodes =
      let
        commonConfig =
          { config, ... }:
          {
            # We'll be using '--advertise' flag with the
            # substitute server which requires Avahi.
            services.avahi = {
              enable = true;
              nssmdns4 = true;
              publish = {
                enable = true;
                userServices = true;
              };
            };
          };
      in
      {
        server =
          {
            config,
            lib,
            pkgs,
            ...
          }:
          {
            imports = [ commonConfig ];

            services.guix = {
              enable = true;
              publish = {
                enable = true;
                port = publishPort;

                generateKeyPair = true;
                extraArgs = [ "--advertise" ];
              };
            };

            networking.firewall.allowedTCPPorts = [ publishPort ];
          };

        client =
          {
            config,
            lib,
            pkgs,
            ...
          }:
          {
            imports = [ commonConfig ];

            services.guix = {
              enable = true;

              # Force to only get all substitutes from the local server. We don't
              # have anything in the Guix store directory and we cannot get
              # anything from the official substitute servers anyways.
              substituters.urls = [ "http://server.local:${toString publishPort}" ];

              extraArgs = [
                # Enable autodiscovery of the substitute servers in the local
                # network. This machine shouldn't need to import the signing key from
                # the substitute server since it is automatically done anyways.
                "--discover=yes"
              ];
            };
          };
      };

    testScript = ''
      import pathlib

      start_all()

      scripts_dir = pathlib.Path("/etc/guix/scripts")

      for machine in machines:
        machine.wait_for_unit("multi-user.target")
        machine.wait_for_unit("guix-daemon.service")
        machine.wait_for_unit("avahi-daemon.service")

      server.wait_for_unit("guix-publish.service")
      server.wait_for_open_port(${toString publishPort})
      server.succeed("curl http://localhost:${toString publishPort}/")

      # Now it's the client turn to make use of it.
      substitute_server = "http://server.local:${toString publishPort}"
      client.systemctl("start network-online.target")
      client.wait_for_unit("network-online.target")
      response = client.succeed(f"curl {substitute_server}")
      assert "Guix Substitute Server" in response

      # Authorizing the server to be used as a substitute server.
      client.succeed(f"curl -O {substitute_server}/signing-key.pub")
      client.succeed("guix archive --authorize < ./signing-key.pub")

      # Since we're using the substitute server with the `--advertise` flag, we
      # might as well check it.
      client.succeed("avahi-browse --resolve --terminate _guix_publish._tcp | grep '_guix_publish._tcp'")
    '';
  }
)