{ pkgs, runTest }:

let

  inherit (pkgs) lib;

  baseConfig = {
    networking.nameservers = [ "::1" ];
    services.bind = {
      enable = true;
      extraOptions = "empty-zones-enable no;";
      zones = lib.singleton {
        name = ".";
        master = true;
        file = pkgs.writeText "root.zone" ''
          $TTL 3600
          . IN SOA ns.example.org. admin.example.org. ( 1 3h 1h 1w 1d )
          . IN NS ns.example.org.

          ns.example.org. IN A    192.168.0.1
          ns.example.org. IN AAAA abcd::1

          1.0.168.192.in-addr.arpa IN PTR ns.example.org.
        '';
      };
    };
    services.dnsdist = {
      enable = true;
      listenPort = 5353;
      extraConfig = ''
        newServer({address="127.0.0.1:53", name="local-bind"})
      '';
    };
  };

in

{

  base = runTest {
    name = "dnsdist-base";
    meta.maintainers = with lib.maintainers; [ jojosch ];

    nodes.machine = baseConfig;

    testScript = ''
      machine.wait_for_unit("bind.service")
      machine.wait_for_open_port(53)
      machine.succeed("host -p 53 192.168.0.1 | grep -qF ns.example.org")

      machine.wait_for_unit("dnsdist.service")
      machine.wait_for_open_port(5353)
      machine.succeed("host -p 5353 192.168.0.1 | grep -qF ns.example.org")
    '';
  };

  dnscrypt = runTest {
    name = "dnsdist-dnscrypt";
    meta.maintainers = with lib.maintainers; [ rnhmjoj ];

    nodes.server = lib.mkMerge [
      baseConfig
      {
        networking.firewall.allowedTCPPorts = [ 443 ];
        networking.firewall.allowedUDPPorts = [ 443 ];
        services.dnsdist.dnscrypt.enable = true;
        services.dnsdist.dnscrypt.providerKey = pkgs.runCommand "dnscrypt-secret.key" { } ''
          echo 'R70+xqm7AaDsPtDgpSjSG7KHvEqVf6u6PZ+E3cGPbOwUQdg6/
                RIIpK6pHkINhrv7nxwIG5c7b/m5NJVT3A1AXQ==' | base64 -id > "$out"
        '';
      }
    ];

    nodes.client = {
      services.dnscrypt-proxy2.enable = true;
      services.dnscrypt-proxy2.upstreamDefaults = false;
      services.dnscrypt-proxy2.settings = {
        server_names = [ "server" ];
        listen_addresses = [ "[::1]:53" ];
        cache = false;
        # Computed using https://dnscrypt.info/stamps/
        static.server.stamp = "sdns://AQAAAAAAAAAADzE5Mi4xNjguMS4yOjQ0MyAUQdg6_RIIpK6pHkINhrv7nxwIG5c7b_m5NJVT3A1AXRYyLmRuc2NyeXB0LWNlcnQuc2VydmVy";
      };
      networking.nameservers = [ "::1" ];
    };

    testScript = ''
      with subtest("The DNSCrypt server is accepting connections"):
          server.wait_for_unit("bind.service")
          server.wait_for_unit("dnsdist.service")
          server.wait_for_open_port(443)
          almost_expiration = server.succeed("date --date '14min'").strip()

      with subtest("The DNSCrypt client can connect to the server"):
          client.wait_until_succeeds("journalctl -u dnscrypt-proxy2 --grep '\[server\] OK'")

      with subtest("DNS queries over UDP are working"):
          client.wait_for_open_port(53)
          client.succeed("host -U 192.168.0.1 | grep -qF ns.example.org")

      with subtest("DNS queries over TCP are working"):
          client.wait_for_open_port(53)
          client.succeed("host -T 192.168.0.1 | grep -qF ns.example.org")

      with subtest("The server rotates the ephemeral keys"):
          server.succeed(f"date -s '{almost_expiration}'")
          client.succeed(f"date -s '{almost_expiration}'")
          server.wait_until_succeeds("journalctl -u dnsdist --grep 'rotated certificate'")

      with subtest("The client can still connect to the server"):
          client.wait_until_succeeds("host -T 192.168.0.1")
          client.wait_until_succeeds("host -U 192.168.0.1")
    '';
  };
}