# `checks.script-test-attic-init` — runs ../host-modules/lib/attic-init.nix's two
# scripts, as the cache's host units run them, against stub `bao`, `openssl`,
# `atticadm`, `attic`, `curl` and `systemctl`. The cases are in ./attic-init.sh.
#
# What runs is the rendered script, behind the same helpers the units put in
# front of it.
{
  pkgs,
  ...
}:
let
  init = import ../host-modules/lib/attic-init.nix { inherit (pkgs) lib; } {
    jwtPath = "secret/swarm/services/attic/jwt-secret";
    pullPath = "secret/swarm/services/attic/pull-token";
    pushPath = "secret/swarm/services/attic/push-token";
    cache = "grid";
    endpoint = "http://127.0.0.1:8910";
    configFile = "@DIR@/server.toml";
    envFile = "@DIR@/secrets/server.env";
    machine = "swarm-attic";
    unit = "swarm-attic";
  };
  render =
    name: body:
    pkgs.writeText name ''
      set -euo pipefail
      ${import ../host-modules/lib/atomic-write-secret.nix { }}
      ${import ../host-modules/lib/refresh-consumer.nix { }}
      ${init.prelude}
      ${body}
    '';
in
pkgs.runCommand "hyperhive-script-test-attic-init"
  {
    ENSURE_JWT = render "ensure-jwt.sh" init.ensureJwt;
    PROVISION = render "provision.sh" init.provision;
  }
  ''
    ${pkgs.bash}/bin/bash ${./attic-init.sh}
    touch "$out"
  ''