let
  common =
    { pkgs, ... }:
    {
      networking.firewall.enable = false;
      networking.useDHCP = false;
      # for a host utility with IPv6 support
      environment.systemPackages = [ pkgs.bind ];
    };
in
import ./make-test-python.nix (
  { pkgs, ... }:
  {
    name = "nsd";
    meta = with pkgs.lib.maintainers; {
      maintainers = [ aszlig ];
    };

    nodes = {
      clientv4 =
        { lib, nodes, ... }:
        {
          imports = [ common ];
          networking.nameservers = lib.mkForce [
            (lib.head nodes.server.config.networking.interfaces.eth1.ipv4.addresses).address
          ];
          networking.interfaces.eth1.ipv4.addresses = [
            {
              address = "192.168.0.2";
              prefixLength = 24;
            }
          ];
        };

      clientv6 =
        { lib, nodes, ... }:
        {
          imports = [ common ];
          networking.nameservers = lib.mkForce [
            (lib.head nodes.server.config.networking.interfaces.eth1.ipv6.addresses).address
          ];
          networking.interfaces.eth1.ipv4.addresses = [
            {
              address = "dead:beef::2";
              prefixLength = 24;
            }
          ];
        };

      server =
        { lib, ... }:
        {
          imports = [ common ];
          networking.interfaces.eth1.ipv4.addresses = [
            {
              address = "192.168.0.1";
              prefixLength = 24;
            }
          ];
          networking.interfaces.eth1.ipv6.addresses = [
            {
              address = "dead:beef::1";
              prefixLength = 64;
            }
          ];
          services.nsd.enable = true;
          services.nsd.rootServer = true;
          services.nsd.interfaces = lib.mkForce [ ];
          services.nsd.keys."tsig.example.com." = {
            algorithm = "hmac-sha256";
            keyFile = pkgs.writeTextFile {
              name = "tsig.example.com.";
              text = "aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=";
            };
          };
          services.nsd.zones."example.com.".data = ''
            @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
            ipv4 A 1.2.3.4
            ipv6 AAAA abcd::eeff
            deleg NS ns.example.com
            ns A 192.168.0.1
            ns AAAA dead:beef::1
          '';
          services.nsd.zones."example.com.".provideXFR = [ "0.0.0.0 tsig.example.com." ];
          services.nsd.zones."deleg.example.com.".data = ''
            @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
            @ A 9.8.7.6
            @ AAAA fedc::bbaa
          '';
          services.nsd.zones.".".data = ''
            @ SOA ns.example.com noc.example.com 666 7200 3600 1209600 3600
            root A 1.8.7.4
            root AAAA acbd::4
          '';
        };
    };

    testScript = ''
      start_all()

      clientv4.wait_for_unit("network.target")
      clientv6.wait_for_unit("network.target")
      server.wait_for_unit("nsd.service")

      with subtest("server tsig.example.com."):
          expected_tsig = "  secret: \"aR3FJA92+bxRSyosadsJ8Aeeav5TngQW/H/EF9veXbc=\"\n"
          tsig=server.succeed("cat /var/lib/nsd/private/tsig.example.com.")
          assert expected_tsig == tsig, f"Expected /var/lib/nsd/private/tsig.example.com. to contain '{expected_tsig}', but found '{tsig}'"

      def assert_host(type, rr, query, expected):
          self = clientv4 if type == 4 else clientv6
          out = self.succeed(f"host -{type} -t {rr} {query}").rstrip()
          self.log(f"output: {out}")
          import re
          assert re.search(
              expected, out
          ), f"DNS IPv{type} query on {query} gave '{out}' instead of '{expected}'"


      for ipv in 4, 6:
          with subtest(f"IPv{ipv}"):
              assert_host(ipv, "a", "example.com", "has no [^ ]+ record")
              assert_host(ipv, "aaaa", "example.com", "has no [^ ]+ record")

              assert_host(ipv, "soa", "example.com", "SOA.*?noc\.example\.com")
              assert_host(ipv, "a", "ipv4.example.com", "address 1.2.3.4$")
              assert_host(ipv, "aaaa", "ipv6.example.com", "address abcd::eeff$")

              assert_host(ipv, "a", "deleg.example.com", "address 9.8.7.6$")
              assert_host(ipv, "aaaa", "deleg.example.com", "address fedc::bbaa$")

              assert_host(ipv, "a", "root", "address 1.8.7.4$")
              assert_host(ipv, "aaaa", "root", "address acbd::4$")
    '';
  }
)