let
  certs = import ./common/acme/server/snakeoil-certs.nix;
  domain = certs.domain;
in

{
  name = "wstunnel";

  nodes = {
    server = {
      virtualisation.vlans = [ 1 ];

      security.pki.certificateFiles = [ certs.ca.cert ];

      networking = {
        useNetworkd = true;
        useDHCP = false;
        firewall.enable = false;
      };

      systemd.network.networks."01-eth1" = {
        name = "eth1";
        networkConfig.Address = "10.0.0.1/24";
      };

      services.wstunnel = {
        enable = true;
        servers.my-server = {
          listen = {
            host = "10.0.0.1";
            port = 443;
          };
          tlsCertificate = certs.${domain}.cert;
          tlsKey = certs.${domain}.key;
        };
      };
    };

    client = {
      virtualisation.vlans = [ 1 ];

      security.pki.certificateFiles = [ certs.ca.cert ];

      networking = {
        useNetworkd = true;
        useDHCP = false;
        firewall.enable = false;
        extraHosts = ''
          10.0.0.1 ${domain}
        '';
      };

      systemd.network.networks."01-eth1" = {
        name = "eth1";
        networkConfig.Address = "10.0.0.2/24";
      };

      services.wstunnel = {
        enable = true;
        clients.my-client = {
          autoStart = false;
          connectTo = "wss://${domain}:443";
          localToRemote = [
            "tcp://8080:localhost:2080"
          ];
          remoteToLocal = [
            "tcp://2081:localhost:8081"
          ];
        };
      };
    };
  };

  testScript = /* python */ ''
    start_all()
    server.wait_for_unit("wstunnel-server-my-server.service")
    client.wait_for_open_port(443, "10.0.0.1")

    client.systemctl("start wstunnel-client-my-client.service")
    client.wait_for_unit("wstunnel-client-my-client.service")

    with subtest("connection from client to server"):
      server.succeed("nc -l 2080 >/tmp/msg &")
      client.sleep(1)
      client.succeed('nc -w1 localhost 8080 <<<"Hello from client"')
      server.succeed('grep "Hello from client" /tmp/msg')

    with subtest("connection from server to client"):
      client.succeed("nc -l 8081 >/tmp/msg &")
      server.sleep(1)
      server.succeed('nc -w1 localhost 2081 <<<"Hello from server"')
      client.succeed('grep "Hello from server" /tmp/msg')

    client.systemctl("stop wstunnel-client-my-client.service")
  '';
}