let
  ldapDomain = "example.org";
  ldapSuffix = "dc=example,dc=org";

  ldapRootUser = "admin";
  ldapRootPassword = "foobar";

  testUser = "alice";
  testPassword = "verySecure";
  testGroup = "netbox-users";
in
import ../make-test-python.nix (
  {
    lib,
    pkgs,
    netbox,
    ...
  }:
  {
    name = "netbox";

    meta = with lib.maintainers; {
      maintainers = [
        minijackson
      ];
    };

    nodes.machine =
      { config, ... }:
      {
        virtualisation.memorySize = 2048;
        services.netbox = {
          enable = true;
          package = netbox;
          secretKeyFile = pkgs.writeText "secret" ''
            abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
          '';

          enableLdap = true;
          ldapConfigPath = pkgs.writeText "ldap_config.py" ''
            import ldap
            from django_auth_ldap.config import LDAPSearch, PosixGroupType

            AUTH_LDAP_SERVER_URI = "ldap://localhost/"

            AUTH_LDAP_USER_SEARCH = LDAPSearch(
                "ou=accounts,ou=posix,${ldapSuffix}",
                ldap.SCOPE_SUBTREE,
                "(uid=%(user)s)",
            )

            AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
                "ou=groups,ou=posix,${ldapSuffix}",
                ldap.SCOPE_SUBTREE,
                "(objectClass=posixGroup)",
            )
            AUTH_LDAP_GROUP_TYPE = PosixGroupType()

            # Mirror LDAP group assignments.
            AUTH_LDAP_MIRROR_GROUPS = True

            # For more granular permissions, we can map LDAP groups to Django groups.
            AUTH_LDAP_FIND_GROUP_PERMS = True
          '';
        };

        services.nginx = {
          enable = true;

          recommendedProxySettings = true;

          virtualHosts.netbox = {
            default = true;
            locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}";
            locations."/static/".alias = "/var/lib/netbox/static/";
          };
        };

        # Adapted from the sssd-ldap NixOS test
        services.openldap = {
          enable = true;
          settings = {
            children = {
              "cn=schema".includes = [
                "${pkgs.openldap}/etc/schema/core.ldif"
                "${pkgs.openldap}/etc/schema/cosine.ldif"
                "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
                "${pkgs.openldap}/etc/schema/nis.ldif"
              ];
              "olcDatabase={1}mdb" = {
                attrs = {
                  objectClass = [
                    "olcDatabaseConfig"
                    "olcMdbConfig"
                  ];
                  olcDatabase = "{1}mdb";
                  olcDbDirectory = "/var/lib/openldap/db";
                  olcSuffix = ldapSuffix;
                  olcRootDN = "cn=${ldapRootUser},${ldapSuffix}";
                  olcRootPW = ldapRootPassword;
                };
              };
            };
          };
          declarativeContents = {
            ${ldapSuffix} = ''
              dn: ${ldapSuffix}
              objectClass: top
              objectClass: dcObject
              objectClass: organization
              o: ${ldapDomain}

              dn: ou=posix,${ldapSuffix}
              objectClass: top
              objectClass: organizationalUnit

              dn: ou=accounts,ou=posix,${ldapSuffix}
              objectClass: top
              objectClass: organizationalUnit

              dn: uid=${testUser},ou=accounts,ou=posix,${ldapSuffix}
              objectClass: person
              objectClass: posixAccount
              userPassword: ${testPassword}
              homeDirectory: /home/${testUser}
              uidNumber: 1234
              gidNumber: 1234
              cn: ""
              sn: ""

              dn: ou=groups,ou=posix,${ldapSuffix}
              objectClass: top
              objectClass: organizationalUnit

              dn: cn=${testGroup},ou=groups,ou=posix,${ldapSuffix}
              objectClass: posixGroup
              gidNumber: 2345
              memberUid: ${testUser}
            '';
          };
        };

        users.users.nginx.extraGroups = [ "netbox" ];

        networking.firewall.allowedTCPPorts = [ 80 ];
      };

    testScript =
      let
        changePassword = pkgs.writeText "change-password.py" ''
          from users.models import User
          u = User.objects.get(username='netbox')
          u.set_password('netbox')
          u.save()
        '';
      in
      ''
        from typing import Any, Dict
        import json

        start_all()
        machine.wait_for_unit("netbox.target")
        machine.wait_until_succeeds("journalctl --since -1m --unit netbox --grep Listening")

        with subtest("Home screen loads"):
            machine.succeed(
                "curl -sSfL http://[::1]:8001 | grep '<title>Home | NetBox</title>'"
            )

        with subtest("Staticfiles are generated"):
            machine.succeed("test -e /var/lib/netbox/static/netbox.js")

        with subtest("Superuser can be created"):
            machine.succeed(
                "netbox-manage createsuperuser --noinput --username netbox --email netbox@example.com"
            )
            # Django doesn't have a "clean" way of inputting the password from the command line
            machine.succeed("cat '${changePassword}' | netbox-manage shell")

        machine.wait_for_unit("network.target")

        with subtest("Home screen loads from nginx"):
            machine.succeed(
                "curl -sSfL http://localhost | grep '<title>Home | NetBox</title>'"
            )

        with subtest("Staticfiles can be fetched"):
            machine.succeed("curl -sSfL http://localhost/static/netbox.js")
            machine.succeed("curl -sSfL http://localhost/static/docs/")

        def login(username: str, password: str):
            encoded_data = json.dumps({"username": username, "password": password})
            uri = "/users/tokens/provision/"
            result = json.loads(
                machine.succeed(
                    "curl -sSfL "
                    "-X POST "
                    "-H 'Accept: application/json' "
                    "-H 'Content-Type: application/json' "
                    f"'http://localhost/api{uri}' "
                    f"--data '{encoded_data}'"
                )
            )
            return result["key"]

        with subtest("Can login"):
            auth_token = login("netbox", "netbox")

        def get(uri: str):
            return json.loads(
                machine.succeed(
                    "curl -sSfL "
                    "-H 'Accept: application/json' "
                    f"-H 'Authorization: Token {auth_token}' "
                    f"'http://localhost/api{uri}'"
                )
            )

        def delete(uri: str):
            return machine.succeed(
                "curl -sSfL "
                f"-X DELETE "
                "-H 'Accept: application/json' "
                f"-H 'Authorization: Token {auth_token}' "
                f"'http://localhost/api{uri}'"
            )


        def data_request(uri: str, method: str, data: Dict[str, Any]):
            encoded_data = json.dumps(data)
            return json.loads(
                machine.succeed(
                    "curl -sSfL "
                    f"-X {method} "
                    "-H 'Accept: application/json' "
                    "-H 'Content-Type: application/json' "
                    f"-H 'Authorization: Token {auth_token}' "
                    f"'http://localhost/api{uri}' "
                    f"--data '{encoded_data}'"
                )
            )

        def post(uri: str, data: Dict[str, Any]):
          return data_request(uri, "POST", data)

        def patch(uri: str, data: Dict[str, Any]):
          return data_request(uri, "PATCH", data)

        with subtest("Can create objects"):
            result = post("/dcim/sites/", {"name": "Test site", "slug": "test-site"})
            site_id = result["id"]

            # Example from:
            # http://netbox.extra.cea.fr/static/docs/integrations/rest-api/#creating-a-new-object
            post("/ipam/prefixes/", {"prefix": "192.0.2.0/24", "site": site_id})

            result = post(
                "/dcim/manufacturers/",
                {"name": "Test manufacturer", "slug": "test-manufacturer"}
            )
            manufacturer_id = result["id"]

            # Had an issue with device-types before NetBox 3.4.0
            result = post(
                "/dcim/device-types/",
                {
                    "model": "Test device type",
                    "manufacturer": manufacturer_id,
                    "slug": "test-device-type",
                },
            )
            device_type_id = result["id"]

        with subtest("Can list objects"):
            result = get("/dcim/sites/")

            assert result["count"] == 1
            assert result["results"][0]["id"] == site_id
            assert result["results"][0]["name"] == "Test site"
            assert result["results"][0]["description"] == ""

            result = get("/dcim/device-types/")
            assert result["count"] == 1
            assert result["results"][0]["id"] == device_type_id
            assert result["results"][0]["model"] == "Test device type"

        with subtest("Can update objects"):
            new_description = "Test site description"
            patch(f"/dcim/sites/{site_id}/", {"description": new_description})
            result = get(f"/dcim/sites/{site_id}/")
            assert result["description"] == new_description

        with subtest("Can delete objects"):
            # Delete a device-type since no object depends on it
            delete(f"/dcim/device-types/{device_type_id}/")

            result = get("/dcim/device-types/")
            assert result["count"] == 0

        with subtest("Can use the GraphQL API"):
            encoded_data = json.dumps({
                "query": "query { prefix_list { prefix, site { id, description } } }",
            })
            result = json.loads(
                machine.succeed(
                    "curl -sSfL "
                    "-H 'Accept: application/json' "
                    "-H 'Content-Type: application/json' "
                    f"-H 'Authorization: Token {auth_token}' "
                    "'http://localhost/graphql/' "
                    f"--data '{encoded_data}'"
                )
            )

            assert len(result["data"]["prefix_list"]) == 1
            assert result["data"]["prefix_list"][0]["prefix"] == "192.0.2.0/24"
            assert result["data"]["prefix_list"][0]["site"]["id"] == str(site_id)
            assert result["data"]["prefix_list"][0]["site"]["description"] == new_description

        with subtest("Can login with LDAP"):
            machine.wait_for_unit("openldap.service")
            login("alice", "${testPassword}")

        with subtest("Can associate LDAP groups"):
            result = get("/users/users/?username=${testUser}")

            assert result["count"] == 1
            assert any(group["name"] == "${testGroup}" for group in result["results"][0]["groups"])
      '';
  }
)