WIP: test: Set up service tests

configuration/nginx/default.nix

@@ -1,4 +1,9 @@
-{ lib, ... }:
+{
+  flake-inputs,
+  pkgs,
+  lib,
+  ...
+}:
 {
   imports = [
     ./logging.nix
@@ -10,13 +15,64 @@
     description = "The base domain name to append to virtual domain names";
   };
 
-  config.services.nginx = {
-    enable = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedProxySettings = true;
-    clientMaxBodySize = "10G";
-    statusPage = true; # For metrics, should be accessible only from localhost
+  config = {
+    services.nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedProxySettings = true;
+      clientMaxBodySize = "10G";
+      statusPage = true; # For metrics, should be accessible only from localhost
+    };
+
+    serviceTests =
+      let
+        testHostConfig =
+          { config, ... }:
+          {
+            _module.args = { inherit flake-inputs; };
+            imports = [
+              ./.
+              ../../modules/serviceTests/mocks.nix
+              flake-inputs.sops-nix.nixosModules.sops
+            ];
+
+            services.nginx = {
+              domain = "testHost";
+
+              virtualHosts."${config.services.nginx.domain}" = {
+                useACMEHost = "tlater.net";
+                forceSSL = true;
+                enableHSTS = true;
+                locations."/".return = "200 ok";
+              };
+            };
+          };
+      in
+      {
+        hstsIsSet = pkgs.testers.runNixOSTest {
+          name = "assert-hsts";
+          nodes = {
+            testHost = testHostConfig;
+
+            client =
+              { pkgs, ... }:
+              {
+                environment.systemPackages = [ pkgs.curl ];
+              };
+          };
+
+          testScript = ''
+            start_all()
+
+            testHost.wait_for_unit("nginx")
+            testHost.succeed("systemctl start network-online.target")
+            testHost.wait_for_unit("network-online.target")
+
+            client.succeed("curl http://testHost")
+          '';
+        };
+      };
   };
 }