From 51b0a02e95f78c28c0a3fe94e9d44e6dd4b918be Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Thu, 29 Oct 2026 03:50:09 +0100
Subject: [PATCH] wait for the wg-hive peers before pinging in the vm test

---
 nix/vm-tests/wg-hive.nix | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/nix/vm-tests/wg-hive.nix b/nix/vm-tests/wg-hive.nix
index b909f438..a5dfcbfc 100644
--- a/nix/vm-tests/wg-hive.nix
+++ b/nix/vm-tests/wg-hive.nix
@@ -75,17 +75,25 @@ pkgs.testers.runNixOSTest {
   };
 
   testScript = ''
+    def wg_state(m):
+        return m.execute("wg show wg-hive; ip route; systemctl status 'wireguard-wg-hive*' --no-pager")[1]
+
     start_all()
-    for m in (h1, h2):
+    for m, peer_key in ((h1, "${pub "h2"}"), (h2, "${pub "h1"}")):
         m.wait_for_unit("wireguard-wg-hive.service")
         m.succeed("ip link show wg-hive")
+        # The interface unit is active before its peers are installed: each
+        # peer has its own unit, which runs after network-online.target. Until
+        # then the interface has no peer and a send fails with ENOKEY.
+        m.wait_until_succeeds(f"wg show wg-hive allowed-ips | grep -F {peer_key}")
 
     # Traffic makes the tunnel handshake.
-    h1.succeed("ping -c 3 -W 5 ${meshAddr.h2}")
-    h2.succeed("ping -c 3 -W 5 ${meshAddr.h1}")
+    for src, addr in ((h1, "${meshAddr.h2}"), (h2, "${meshAddr.h1}")):
+        status, out = src.execute(f"ping -c 3 -W 5 {addr}")
+        assert status == 0, f"ping {addr} failed:\n{out}\n{wg_state(src)}"
     for m in (h1, h2):
         stamps = m.succeed("wg show wg-hive latest-handshakes").split()
-        assert len(stamps) == 2 and int(stamps[1]) > 0, f"no handshake: {stamps}"
+        assert len(stamps) == 2 and int(stamps[1]) > 0, f"no handshake: {stamps}\n{wg_state(m)}"
 
     # The peer's mesh address is routed through the tunnel, its plain
     # address is not.