{ pkgs }:
let
  #hello = pkgs.hello.overrideAttrs { pname = "custom-hello"; };
  inherit (pkgs) hello;
in
pkgs.testers.runNixOSTest (_: {
  name = "caching of upstream nar-store";
  nodes = {
    cache = {
      imports = [
        ./common
        ../modules
      ];

      system.extraDependencies = [ hello ];

      services = {
        tvix-binary-cache = {
          enable = true;
          enableNginx = true;
          nginx = {
            clientMaxBodySize = "50G";
            host = "cache";
          };
          caches = {
            cache = {
              port = 8000;
              remote-path-info-service-addr = "nix+http://localhost/upstream/"; # ?trusted-public-keys=${lib.escapeURL (builtins.readFile ./cache-keys/pubkey)}";
            };
          };
        };

        nginx = {
          virtualHosts.cache = {
            default = true;
            locations = {
              "/upstream".return = "302 /upstream/";
              "/upstream/".alias = "/srv/";
            };
          };
        };
      };
      networking.firewall.allowedTCPPorts = [ 80 ];
    };
    client =
      { lib, ... }:
      {
        imports = [ ./common ];
        nix.settings = {
          substituters = lib.mkForce [ "http://cache/cache" ];
          trusted-public-keys = lib.mkForce [ (builtins.readFile ./cache-keys/pubkey) ];
        };
      };
  };
  testScript = ''
    import time
    start_all()
    cache.wait_for_unit("nginx.service")
    cache.wait_for_unit("tvix-store-cache.service")
    time.sleep(1)

    def delete_and_substitute():
        client.succeed("nix-store --delete ${hello}")
        client.fail("stat ${hello}")
        client.succeed("nix-store -r ${hello}")
        client.succeed("stat ${hello}")

    with subtest("Upload"):
        cache.succeed("nix store sign -k ${./cache-keys/privkey} ${hello}")
        cache.succeed("nix copy --to file:///srv ${hello}")
        narHash = "${hello}"[11:11+32]
        out = cache.succeed(f"curl -f 'http://localhost/upstream/{narHash}.narinfo'")
        print(out)
        cache.succeed(f"curl -f 'http://localhost/cache/{narHash}.narinfo'")
    with subtest("Try to substitute from cache"):
        delete_and_substitute()
    with subtest("Check effective caching"):
        cache.succeed("rm -rf /srv")
        delete_and_substitute()
  '';
})