let
  generateNodeConf =
    {
      lib,
      pkgs,
      config,
      privk,
      pubk,
      systemdCreds,
      peerId,
      nodeId,
      ...
    }:
    {
      imports = [ common/user-account.nix ];
      systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
      networking.useNetworkd = true;
      networking.useDHCP = false;
      networking.firewall.enable = false;
      virtualisation.vlans = [ 1 ];
      environment.systemPackages = with pkgs; [ wireguard-tools ];
      environment.etc."credstore/network.wireguard.private" = lib.mkIf systemdCreds { text = privk; };
      systemd.network = {
        enable = true;
        config = {
          routeTables.custom = 23;
        };
        netdevs = {
          "90-wg0" = {
            netdevConfig = {
              Kind = "wireguard";
              Name = "wg0";
            };
            wireguardConfig = {
              # Test storing wireguard private key using systemd credentials.
              PrivateKey = lib.mkIf systemdCreds "@network.wireguard.private";

              # NOTE: we're storing the wireguard private key in the
              #       store for this test. Do not do this in the real
              #       world. Keep in mind the nix store is
              #       world-readable.
              PrivateKeyFile = lib.mkIf (!systemdCreds) (pkgs.writeText "wg0-priv" privk);
              ListenPort = 51820;
              FirewallMark = 42;
            };
            wireguardPeers = [
              {
                Endpoint = "192.168.1.${peerId}:51820";
                PublicKey = pubk;
                PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU=";
                AllowedIPs = [ "10.0.0.${peerId}/32" ];
                PersistentKeepalive = 15;
              }
            ];
          };
        };
        networks = {
          "99-nope" = {
            matchConfig.Name = "eth*";
            linkConfig.Unmanaged = true;
          };
          "90-wg0" = {
            matchConfig = {
              Name = "wg0";
            };
            address = [ "10.0.0.${nodeId}/32" ];
            routes = [
              {
                Gateway = "10.0.0.${nodeId}";
                Destination = "10.0.0.0/24";
              }
              {
                Gateway = "10.0.0.${nodeId}";
                Destination = "10.0.0.0/24";
                Table = "custom";
              }
            ];
          };
          "30-eth1" = {
            matchConfig = {
              Name = "eth1";
            };
            address = [
              "192.168.1.${nodeId}/24"
              "fe80::${nodeId}/64"
            ];
            routingPolicyRules = [
              {
                Table = 10;
                IncomingInterface = "eth1";
                Family = "both";
              }
              {
                Table = 20;
                OutgoingInterface = "eth1";
              }
              {
                Table = 30;
                From = "192.168.1.1";
                To = "192.168.1.2";
                SourcePort = 666;
                DestinationPort = 667;
              }
              {
                Table = 40;
                IPProtocol = "tcp";
                InvertRule = true;
              }
              {
                Table = 50;
                IncomingInterface = "eth1";
                Family = "ipv4";
              }
              {
                Table = 60;
                FirewallMark = 4;
              }
              {
                Table = 70;
                FirewallMark = "16/0x1f";
              }
            ];
          };
        };
      };
    };
in
import ./make-test-python.nix (
  { pkgs, ... }:
  {
    name = "networkd";
    meta = with pkgs.lib.maintainers; {
      maintainers = [ picnoir ];
    };
    nodes = {
      node1 =
        { pkgs, ... }@attrs:
        let
          localConf = {
            privk = "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
            pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
            systemdCreds = false;
            nodeId = "1";
            peerId = "2";
          };
        in
        generateNodeConf (attrs // localConf);

      node2 =
        { pkgs, ... }@attrs:
        let
          localConf = {
            privk = "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
            pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
            systemdCreds = true;
            nodeId = "2";
            peerId = "1";
          };
        in
        generateNodeConf (attrs // localConf);
    };
    testScript = ''
      start_all()
      node1.systemctl("start systemd-networkd-wait-online@eth1.service")
      node1.systemctl("start systemd-networkd-wait-online.service")
      node1.wait_for_unit("systemd-networkd-wait-online@eth1.service")
      node1.wait_for_unit("systemd-networkd-wait-online.service")
      node2.systemctl("start systemd-networkd-wait-online@eth1.service")
      node2.systemctl("start systemd-networkd-wait-online.service")
      node2.wait_for_unit("systemd-networkd-wait-online@eth1.service")
      node2.wait_for_unit("systemd-networkd-wait-online.service")

      # ================================
      # Networkd Config
      # ================================
      node1.succeed("grep RouteTable=custom:23 /etc/systemd/networkd.conf")
      node1.succeed("sudo ip route show table custom | grep '10.0.0.0/24 via 10.0.0.1 dev wg0 proto static'")

      # ================================
      # Wireguard
      # ================================
      node1.succeed("ping -c 5 10.0.0.2")
      node2.succeed("ping -c 5 10.0.0.1")
      # Is the fwmark set?
      node2.succeed("wg | grep -q 42")

      # ================================
      # Routing Policies
      # ================================
      # Testing all the routingPolicyRuleConfig members:
      # Table + IncomingInterface
      node1.succeed("sudo ip rule | grep 'from all iif eth1 lookup 10'")
      # OutgoingInterface
      node1.succeed("sudo ip rule | grep 'from all oif eth1 lookup 20'")
      # From + To + SourcePort + DestinationPort
      node1.succeed(
          "sudo ip rule | grep 'from 192.168.1.1 to 192.168.1.2 sport 666 dport 667 lookup 30'"
      )
      # IPProtocol + InvertRule
      node1.succeed("sudo ip rule | grep 'not from all ipproto tcp lookup 40'")
      # FirewallMark without a mask
      node1.succeed("sudo ip rule | grep 'from all fwmark 0x4 lookup 60'")
      # FirewallMark with a mask
      node1.succeed("sudo ip rule | grep 'from all fwmark 0x10/0x1f lookup 70'")
    '';
  }
)
