flake.nix

{
  description = "attest — NixOS test driver in elixir";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
    flake-parts.url = "github:hercules-ci/flake-parts";
    treefmt-nix = {
      url = "github:numtide/treefmt-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    firecracker-src = {
      url = "github:firecracker-microvm/firecracker/v1.15.0";
      flake = false;
    };
  };

  outputs =
    inputs@{ flake-parts, ... }:
    flake-parts.lib.mkFlake { inherit inputs; } {
      imports = [
        inputs.treefmt-nix.flakeModule
      ];

      systems = [
        "x86_64-linux"
        "aarch64-linux"
        "aarch64-darwin"
      ];

      perSystem =
        {
          config,
          self',
          inputs',
          pkgs,
          system,
          lib,
          ...
        }:
        let
          # headless erlang (no wx/gtk/webkitgtk, saves ~200MB closure)
          erlang = (pkgs.beam.override { wxSupport = false; }).interpreters.erlang_27;
          beamPackages = pkgs.beam.packagesWith erlang;
          elixir = beamPackages.elixir_1_17;

          # import package build
          packageSet = import ./nix/package.nix {
            inherit beamPackages;
            lib = pkgs.lib;
          };
          inherit (packageSet) attest;

          # patched firecracker from our fork (vsock snapshot/restore fix)
          firecracker-patched = pkgs.firecracker.overrideAttrs (old: {
            version = "1.16.0-dev";
            src = inputs.firecracker-src;
            cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
              src = inputs.firecracker-src;
              hash = "sha256-0RzHIivl1upuFeZjTJvTZXqHjirzmVEK2ySB4W6aiVA=";
            };
            checkFlags = old.checkFlags ++ [
              "--skip=env::tests::test_copy_exec_to_chroot"
            ];
          });
        in
        {
          checks = {
            inherit attest;

            # mix format check
            format =
              pkgs.runCommand "mix-format-check"
                {
                  nativeBuildInputs = [ elixir ];
                  src = ./.;
                }
                ''
                  cd $src
                  export ERL_FLAGS="+fnu"
                  export MIX_HOME=$TMPDIR/.mix
                  export HEX_HOME=$TMPDIR/.hex
                  mix format --check-formatted
                  touch $out
                '';

            # mix test - use all deps (including test deps)
            test = beamPackages.mixRelease {
              pname = "attest-tests";
              version = "0.1.0";
              src = attest.src;
              mixNixDeps = attest.passthru.testMixNixDeps;
              nativeBuildInputs = [
                pkgs.vde2
                pkgs.tesseract
                pkgs.imagemagick
              ];

              buildPhase = ''
                runHook preBuild
                export ERL_FLAGS="+fnu"
                MIX_ENV=test mix compile --no-deps-check
                runHook postBuild
              '';

              checkPhase = ''
                export ERL_FLAGS="+fnu"
                MIX_ENV=test mix test
              '';

              doCheck = true;

              installPhase = ''
                runHook preInstall
                touch $out
                runHook postInstall
              '';

              dontFixup = true;
            };

          }
          // lib.optionalAttrs pkgs.stdenv.isLinux (
            let
              integrationTests = import ./integration-tests {
                inherit pkgs;
                attest = attest;
              };
            in
            {
              # single-vm integration test (boot, execute, screenshot, shutdown)
              integration = integrationTests.basic;
              # multi-vm integration test (two VMs via Driver)
              integration-multi-vm = integrationTests.multi-vm;
              # make-test smoke test (nix wrapper end-to-end)
              make-test-smoke = import ./nix/make-test.nix {
                inherit pkgs;
                attest = attest;
                name = "smoke";
                nodes = {
                  machine = { };
                };
                testScript = ''
                  start_all.()
                  Attest.wait_for_unit(machine, "multi-user.target")
                  output = Attest.succeed(machine, "echo hello-from-make-test")

                  unless String.contains?(output, "hello-from-make-test") do
                    raise "unexpected output: #{inspect(output)}"
                  end
                '';
              };
              # multi-node make-test (two VMs, validates multi-node pipeline)
              make-test-multi = import ./nix/make-test.nix {
                inherit pkgs;
                attest = attest;
                name = "multi";
                nodes = {
                  server = { };
                  client = { };
                };
                testScript = ''
                  start_all.()
                  Attest.wait_for_unit(server, "multi-user.target")
                  Attest.wait_for_unit(client, "multi-user.target")

                  server_out = Attest.succeed(server, "hostname")
                  client_out = Attest.succeed(client, "hostname")

                  unless String.contains?(server_out, "server") do
                    raise "server hostname mismatch: #{inspect(server_out)}"
                  end

                  unless String.contains?(client_out, "client") do
                    raise "client hostname mismatch: #{inspect(client_out)}"
                  end
                '';
              };
              # firecracker make-test smoke test (ext4 rootfs, vmlinux, vsock backdoor)
              firecracker-smoke = import ./nix/firecracker/make-test.nix {
                inherit pkgs;
                attest = attest;
                name = "fc-smoke";
                nodes = {
                  machine = { };
                };
                testScript = ''
                  start_all.()
                  Attest.wait_for_unit(machine, "multi-user.target")
                  output = Attest.succeed(machine, "echo hello-from-firecracker")

                  unless String.contains?(output, "hello-from-firecracker") do
                    raise "unexpected output: #{inspect(output)}"
                  end
                '';
              };
              # snapshot/restore
              firecracker-snapshot = import ./nix/firecracker/make-test.nix {
                inherit pkgs;
                attest = attest;
                name = "fc-snapshot";
                splitStore = true;
                nodes.machine = {
                  # FC snapshot/restore only works with guest kernels 5.10 and 6.1
                  # (newer kernels triple-fault ~1s after restore)
                  # https://github.com/firecracker-microvm/firecracker/blob/main/docs/kernel-policy.md
                  boot.kernelPackages = pkgs.linuxPackages_6_1;
                };
                testScript = ''
                  start_all.()
                  Attest.wait_for_unit(machine, "multi-user.target")
                  Attest.snapshot_create(machine, "/tmp/snap")
                  Attest.snapshot_restore(machine, "/tmp/snap")
                  result = Attest.succeed(machine, "echo restored-ok")

                  unless String.contains?(result, "restored-ok") do
                    raise "unexpected output after restore: #{inspect(result)}"
                  end
                '';
              };
              # pre-built snapshot: VM boots from cached snapshot (~128ms restore)
              firecracker-prebuilt = import ./nix/firecracker/make-test.nix {
                inherit pkgs;
                attest = attest;
                name = "fc-prebuilt";
                splitStore = true;
                usePrebuiltSnapshots = true;
                nodes.machine = {
                  boot.kernelPackages = pkgs.linuxPackages_6_1;
                };
                testScript = ''
                  start_all.()

                  # VM should already be at multi-user.target (restored from snapshot)
                  output = Attest.succeed(machine, "systemctl is-active multi-user.target")

                  unless String.trim(output) == "active" do
                    raise "multi-user.target was not active: #{inspect(output)}"
                  end

                  output = Attest.succeed(machine, "echo hello-from-prebuilt-snapshot")
                  unless String.contains?(output, "hello-from-prebuilt-snapshot") do
                    raise "unexpected: #{inspect(output)}"
                  end
                '';
              };
              # firecracker split-store smoke test (erofs nix store + minimal rootfs)
              firecracker-split = import ./nix/firecracker/make-test.nix {
                inherit pkgs;
                attest = attest;
                name = "fc-split";
                splitStore = true;
                nodes = {
                  machine = { };
                };
                testScript = ''
                  start_all.()
                  Attest.wait_for_unit(machine, "multi-user.target")
                  output = Attest.succeed(machine, "echo hello-from-split-store")

                  unless String.contains?(output, "hello-from-split-store") do
                    raise "unexpected output: #{inspect(output)}"
                  end

                  # verify nix store is an overlay mount
                  mount_out = Attest.succeed(machine, "mount | grep '/nix/store'")

                  unless String.contains?(mount_out, "overlay") do
                    raise "nix store not overlay-mounted: #{inspect(mount_out)}"
                  end
                '';
              };
              # firecracker multi-VM networking test (bridge + TAP)
              firecracker-network = import ./nix/firecracker/make-test.nix {
                inherit pkgs;
                attest = attest;
                name = "fc-net";
                splitStore = true;
                enableNetwork = true;
                nodes = {
                  alice =
                    { pkgs, ... }:
                    {
                      environment.systemPackages = [ pkgs.iputils ];
                    };
                  bob =
                    { pkgs, ... }:
                    {
                      environment.systemPackages = [ pkgs.iputils ];
                    };
                };
                testScript = ''
                  start_all.()

                  # verify both VMs have IPs
                  alice_ip = Attest.succeed(alice, "ip -4 addr show eth0 | grep inet")
                  unless String.contains?(alice_ip, "192.168.1.1"), do: raise("alice should be .1")

                  bob_ip = Attest.succeed(bob, "ip -4 addr show eth0 | grep inet")
                  unless String.contains?(bob_ip, "192.168.1.2"), do: raise("bob should be .2")

                  # ping each other
                  Attest.succeed(alice, "ping -c 1 -W 3 192.168.1.2")
                  Attest.succeed(bob, "ping -c 1 -W 3 192.168.1.1")

                  # hostname resolution via /etc/hosts
                  Attest.succeed(alice, "ping -c 1 -W 3 bob")
                  Attest.succeed(bob, "ping -c 1 -W 3 alice")

                '';
              };
              # cloud-hypervisor make-test smoke test (ext4 rootfs, vmlinux, vsock)
              cloud-hypervisor-smoke = import ./nix/cloud-hypervisor/make-test.nix {
                inherit pkgs;
                attest = attest;
                name = "ch-smoke";
                nodes = {
                  machine = { };
                };
                testScript = ''
                  start_all.()
                  Attest.wait_for_unit(machine, "multi-user.target")
                  output = Attest.succeed(machine, "echo hello-from-cloud-hypervisor")

                  unless String.contains?(output, "hello-from-cloud-hypervisor") do
                    raise "unexpected output: #{inspect(output)}"
                  end
                '';
              };
              # cloud-hypervisor multi-VM networking test (bridge + TAP)
              cloud-hypervisor-network = import ./nix/cloud-hypervisor/make-test.nix {
                inherit pkgs;
                attest = attest;
                name = "ch-net";
                splitStore = true;
                enableNetwork = true;
                nodes = {
                  alice =
                    { pkgs, ... }:
                    {
                      environment.systemPackages = [ pkgs.iputils ];
                    };
                  bob =
                    { pkgs, ... }:
                    {
                      environment.systemPackages = [ pkgs.iputils ];
                    };
                };
                testScript = ''
                  start_all.()

                  alice_ip = Attest.succeed(alice, "ip -4 addr show eth0 | grep inet")
                  unless String.contains?(alice_ip, "192.168.1.1"), do: raise("alice should be .1")

                  bob_ip = Attest.succeed(bob, "ip -4 addr show eth0 | grep inet")
                  unless String.contains?(bob_ip, "192.168.1.2"), do: raise("bob should be .2")

                  Attest.succeed(alice, "ping -c 1 -W 3 192.168.1.2")
                  Attest.succeed(bob, "ping -c 1 -W 3 192.168.1.1")

                  Attest.succeed(alice, "ping -c 1 -W 3 bob")
                  Attest.succeed(bob, "ping -c 1 -W 3 alice")

                '';
              };
              perf-budget = import ./nix/perf-budget.nix {
                inherit pkgs;
                checks = self'.checks;
              };
            }
          );

          packages = {
            default = attest;
            inherit attest;
          }
          // lib.optionalAttrs pkgs.stdenv.isLinux {
            bench = import ./nix/bench.nix {
              inherit pkgs attest;
            };
          };

          devShells.default = import ./nix/devshell.nix {
            inherit pkgs elixir beamPackages;
            checks = self'.checks;
          };

          # treefmt configuration
          treefmt = {
            projectRootFile = "flake.nix";
            programs = {
              nixfmt.enable = true;
            };
            settings.formatter = {
              # custom mix format wrapper
              mix-format = {
                command = pkgs.writeShellApplication {
                  name = "mix-format";
                  runtimeInputs = [ elixir ];
                  text = ''
                    export MIX_HOME="''${TMPDIR:-/tmp}/.mix"
                    export HEX_HOME="''${TMPDIR:-/tmp}/.hex"
                    mix format "$@"
                  '';
                };
                includes = [
                  "*.ex"
                  "*.exs"
                ];
              };
            };
          };
        };

      flake = {
        # nixos module for running tests (future)
        # nixosModules.default = ./nix/module.nix;
      };
    };
}