run attic as a swarm service with deploy.attic.enable

nix/script-tests/attic-init.nix

@@ -0,0 +1,41 @@
+# `checks.script-test-attic-init` — runs ../host-modules/lib/attic-init.nix's two
+# scripts, as the cache's host units run them, against stub `bao`, `openssl`,
+# `atticadm`, `attic`, `curl` and `systemctl`. The cases are in ./attic-init.sh.
+#
+# What runs is the rendered script, behind the same helpers the units put in
+# front of it.
+{
+  pkgs,
+  ...
+}:
+let
+  init = import ../host-modules/lib/attic-init.nix { inherit (pkgs) lib; } {
+    jwtPath = "secret/swarm/services/attic/jwt-secret";
+    pullPath = "secret/swarm/services/attic/pull-token";
+    pushPath = "secret/swarm/services/attic/push-token";
+    cache = "grid";
+    endpoint = "http://127.0.0.1:8910";
+    configFile = "@DIR@/server.toml";
+    envFile = "@DIR@/secrets/server.env";
+    machine = "swarm-attic";
+    unit = "swarm-attic";
+  };
+  render =
+    name: body:
+    pkgs.writeText name ''
+      set -euo pipefail
+      ${import ../host-modules/lib/atomic-write-secret.nix { }}
+      ${import ../host-modules/lib/refresh-consumer.nix { }}
+      ${init.prelude}
+      ${body}
+    '';
+in
+pkgs.runCommand "hyperhive-script-test-attic-init"
+  {
+    ENSURE_JWT = render "ensure-jwt.sh" init.ensureJwt;
+    PROVISION = render "provision.sh" init.provision;
+  }
+  ''
+    ${pkgs.bash}/bin/bash ${./attic-init.sh}
+    touch "$out"
+  ''