import ./make-test-python.nix (
  { pkgs, lib, ... }:

  let
    api_token = "f87f42114e44b63ad1b9e3c3d33d6fbe"; # random md5 hash
    wrong_api_token = "e68ba041fcf1eab923a7a6de3af5f726"; # another random md5 hash
  in
  {
    name = "librenms";
    meta.maintainers = lib.teams.wdz.members;

    nodes.librenms = {
      time.timeZone = "Europe/Berlin";

      environment.systemPackages = with pkgs; [
        curl
        jq
      ];

      services.librenms = {
        enable = true;
        hostname = "librenms";
        database = {
          createLocally = true;
          host = "localhost";
          database = "librenms";
          username = "librenms";
          passwordFile = pkgs.writeText "librenms-db-pass" "librenmsdbpass";
        };
        nginx = {
          default = true;
        };
        enableOneMinutePolling = true;
        settings = {
          enable_billing = true;
        };
      };

      # systemd oneshot to create a dummy admin user and a API token for testing
      systemd.services.lnms-api-init = {
        description = "LibreNMS API init";
        after = [ "librenms-setup.service" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
          User = "root";
          Group = "root";
        };
        script = ''
          API_USER_NAME=api
          API_TOKEN=${api_token} # random md5 hash

          # seeding database to get the admin roles
          ${pkgs.librenms}/artisan db:seed --force --no-interaction

          # we don't need to know the password, it just has to exist
          API_USER_PASS=$(${pkgs.pwgen}/bin/pwgen -s 64 1)
          ${pkgs.librenms}/artisan user:add $API_USER_NAME -r admin -p $API_USER_PASS
          API_USER_ID=$(${pkgs.mariadb}/bin/mysql -D librenms -N -B -e "SELECT user_id FROM users WHERE username = '$API_USER_NAME';")

          ${pkgs.mariadb}/bin/mysql -D librenms -e "INSERT INTO api_tokens (user_id, token_hash, description) VALUES ($API_USER_ID, '$API_TOKEN', 'API User')"
        '';
      };
    };

    nodes.snmphost = {

      services.snmpd = {
        enable = true;
        openFirewall = true;

        configText = ''
          com2sec readonly default public

          group MyROGroup v2c        readonly
          view all    included  .1                               80
          access MyROGroup ""      any       noauth    exact  all    none   none

          syslocation Testcity, Testcountry
          syscontact Testi mc Test <test@example.com>
        '';

      };
    };

    testScript = ''
      start_all()

      snmphost.wait_for_unit("snmpd.service")

      librenms.wait_for_unit("lnms-api-init.service")
      librenms.wait_for_open_port(80)

      # Test that we can authenticate against the API
      librenms.succeed("curl --fail -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0")
      librenms.fail("curl --fail -H 'X-Auth-Token: ${wrong_api_token}' http://localhost/api/v0")

      # add snmphost as a device
      librenms.succeed("curl --fail -X POST -d '{\"hostname\":\"snmphost\",\"version\":\"v2c\",\"community\":\"public\"}' -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices")

      # wait until snmphost gets polled
      librenms.wait_until_succeeds("test $(curl -H 'X-Auth-Token: ${api_token}' http://localhost/api/v0/devices/snmphost | jq -Mr .devices[0].last_polled) != 'null'")
    '';
  }
)