import ./make-test-python.nix ({ pkgs, lib, ... }:
  let
    tls-cert =
      pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
        openssl req \
          -x509 -newkey rsa:4096 -sha256 -days 365 \
          -nodes -out cert.pem -keyout key.pem \
          -subj '/CN=headscale' -addext "subjectAltName=DNS:headscale"

        mkdir -p $out
        cp key.pem cert.pem $out
      '';
  in {
    name = "headscale";
    meta.maintainers = with lib.maintainers; [ misterio77 ];

    nodes = let
      headscalePort = 8080;
      stunPort = 3478;
      peer = {
        services.tailscale.enable = true;
        security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
      };
    in {
      peer1 = peer;
      peer2 = peer;

      headscale = {
        services = {
          headscale = {
            enable = true;
            port = headscalePort;
            settings = {
              server_url = "https://headscale";
              ip_prefixes = [ "100.64.0.0/10" ];
              derp.server = {
                enabled = true;
                region_id = 999;
                stun_listen_addr = "0.0.0.0:${toString stunPort}";
              };
            };
          };
          nginx = {
            enable = true;
            virtualHosts.headscale = {
              addSSL = true;
              sslCertificate = "${tls-cert}/cert.pem";
              sslCertificateKey = "${tls-cert}/key.pem";
              locations."/" = {
                proxyPass = "http://127.0.0.1:${toString headscalePort}";
                proxyWebsockets = true;
              };
            };
          };
        };
        networking.firewall = {
          allowedTCPPorts = [ 80 443 ];
          allowedUDPPorts = [ stunPort ];
        };
        environment.systemPackages = [ pkgs.headscale ];
      };
    };

    testScript = ''
      start_all()
      headscale.wait_for_unit("headscale")
      headscale.wait_for_open_port(443)

      # Create headscale user and preauth-key
      headscale.succeed("headscale users create test")
      authkey = headscale.succeed("headscale preauthkeys -u test create --reusable")

      # Connect peers
      up_cmd = f"tailscale up --login-server 'https://headscale' --auth-key {authkey}"
      peer1.execute(up_cmd)
      peer2.execute(up_cmd)

      # Check that they are reachable from the tailnet
      peer1.wait_until_succeeds("tailscale ping peer2")
      peer2.wait_until_succeeds("tailscale ping peer1")
    '';
  })