# `checks.script-test-nats-render-config` — runs the queue server's
# `ExecStartPre`, ../host-modules/swarm-nats.nix's `renderConfig`, which writes
# the callout xkey into the config `nats-server` reads. The cases are in
# ./nats-render-config.sh.
#
# What runs is the rendered script. The one edit is its runtime directory,
# moved under the build directory because the sandbox has no writable
# `/var/lib`.
{
  pkgs,
  lib,
  self,
  nixosSystem,
}:
let
  inherit
    (import ../module-eval/lib.nix {
      inherit
        pkgs
        lib
        self
        nixosSystem
        ;
    })
    hive
    ;

  queue = hive {
    deploy.nats.enable = true;
    deploy.nats.autoGenerateCallout = false;
    deploy.nats.calloutUserPublicKey = "UTESTUSERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
    deploy.nats.calloutIssuerPublicKey = "ATESTISSUERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
    deploy.nats.calloutUserSeedFile = "/run/secrets/nats-user.seed";
    deploy.nats.calloutIssuerSeedFile = "/run/secrets/nats-issuer.seed";
    deploy.nats.authPackage = pkgs.emptyDirectory;
    deploy.nats.authBaoClientCertFile = "/etc/pki/nats-auth.pem";
    deploy.nats.authBaoClientKeyFile = "/etc/pki/nats-auth-key.pem";
  };
in
pkgs.runCommand "hyperhive-script-test-nats-render-config"
  {
    # `removePrefix` keeps the string context, and with it the script's store
    # path among this check's inputs. The `+` is systemd's, not the path's.
    RENDER = lib.removePrefix "+" queue.containers.swarm-nats.config.systemd.services.nats.serviceConfig.ExecStartPre;
    nativeBuildInputs = [ pkgs.jq ];
  }
  ''
    ${pkgs.bash}/bin/bash ${./nats-render-config.sh}
    touch "$out"
  ''