{ pkgs }:
let
  #hello = pkgs.hello.overrideAttrs { pname = "custom-hello"; };
  inherit (pkgs) hello;
in
pkgs.testers.runNixOSTest (_: {
  name = "cache substitution test";
  nodes = {
    cache = {
      imports = [
        ./common
        ../modules
      ];

      system.extraDependencies = [ hello ];

      services.tvix-binary-cache = {
        enable = true;
        enableNginx = true;
        nginx = {
          clientMaxBodySize = "50G";
          host = "cache";
        };
        caches = {
          cache.port = 8000;
        };
      };

      services.nginx.virtualHosts.cache = {
        default = true;
      };
      networking.firewall.allowedTCPPorts = [ 80 ];
    };
    client =
      { lib, ... }:
      {
        imports = [ ./common ];
        nix.settings = {
          substituters = lib.mkForce [ "http://cache/cache" ];
          trusted-public-keys = lib.mkForce [ (builtins.readFile ./cache-keys/pubkey) ];
        };
      };
  };
  testScript = ''
    import time
    start_all()
    cache.wait_for_unit("nginx.service")
    cache.wait_for_unit("tvix-store-cache.service")
    time.sleep(1)
    with subtest("Nar bridge home"):
        cache.succeed("curl -f http://127.0.0.1/cache/nix-cache-info")
    with subtest("Path signature and copy"):
        # Sign
        cache.succeed("nix store sign -k ${./cache-keys/privkey} ${hello}")
        cache.succeed("nix copy --to 'http://127.0.0.1/cache/?compression=none' ${hello}")
    with subtest("Substitution"):
        client.succeed("nix-store --delete ${hello}")
        client.fail("stat ${hello}")
        client.succeed("nix-store -r ${hello}")
        client.succeed("stat ${hello}")
  '';
})