{ pkgs }:
let
  inherit (pkgs) hello;
in
pkgs.testers.runNixOSTest (_: {
  name = "caching of upstream nar-store";
  nodes = {
    cache = {
      imports = [
        ./common
        ../modules
      ];

      system.extraDependencies = [ hello ];

      services.tvix-binary-cache = {
        enable = true;
        enableNginx = true;
        nginx = {
          clientMaxBodySize = "50G";
          host = "cache";
        };
        caches = {
          cache = {
            port = 8000;
            path-info-service-addr = "nix+http://localhost/upstream/"; # ?trusted-public-keys=${lib.escapeURL (builtins.readFile ./cache-keys/pubkey)}";
          };
          upstream = {
            port = 8001;
            blob-service-addr = "objectstore+file://%S/tvix-store-upstream/blobs.object-store";
            directory-service-addr = "sled://%S/tvix-store-upstream/directories.sled";
          };
        };
      };

      services.nginx = {
        virtualHosts.cache = {
          default = true;
        };
      };
      networking.firewall.allowedTCPPorts = [ 80 ];
    };
    client =
      { lib, ... }:
      {
        imports = [ ./common ];
        nix.settings = {
          substituters = lib.mkForce [ "http://cache/cache" ];
          trusted-public-keys = lib.mkForce [ (builtins.readFile ./cache-keys/pubkey) ];
        };
      };
  };
  testScript = ''
    import time
    start_all()
    cache.wait_for_unit("nginx.service")
    cache.wait_for_unit("tvix-store-cache.service")
    cache.wait_for_unit("tvix-store-upstream.service")
    time.sleep(1)

    def delete_and_substitute():
        client.succeed("nix-store --delete ${hello}")
        client.fail("stat ${hello}")
        client.succeed("nix-store -r ${hello}")
        client.succeed("stat ${hello}")

    with subtest("Upload"):
        cache.succeed("nix store sign -k ${./cache-keys/privkey} ${hello}")
        cache.succeed("nix copy --to 'http://localhost/upstream/?compression=none' ${hello}")
        narHash = "${hello}"[11:11+32]
        cache.succeed(f"curl -f 'http://localhost/upstream/{narHash}.narinfo'")
        cache.succeed(f"curl -f 'http://localhost/cache/{narHash}.narinfo'")
    with subtest("Try to substitute from cache"):
        delete_and_substitute()
    with subtest("Check effective caching"):
        cache.succeed("systemctl stop tvix-store-upstream.service")
        delete_and_substitute()
  '';
})