import ./make-test-python.nix ({ lib, pkgs, ... }:

let
  # Note: For some reason Privoxy can't issue valid
  # certificates if the CA is generated using gnutls :(
  certs = pkgs.runCommand "example-certs"
    { buildInputs = [ pkgs.openssl ]; }
    ''
      mkdir $out

      # generate CA keypair
      openssl req -new -nodes -x509 \
        -extensions v3_ca -keyout $out/ca.key \
        -out $out/ca.crt -days 365 \
        -subj "/O=Privoxy CA/CN=Privoxy CA"

      # generate server key/signing request
      openssl genrsa -out $out/server.key 3072
      openssl req -new -key $out/server.key \
        -out server.csr -sha256 \
        -subj "/O=An unhappy server./CN=example.com"

      # sign the request/generate the certificate
      openssl x509 -req -in server.csr -CA $out/ca.crt \
      -CAkey $out/ca.key -CAcreateserial -out $out/server.crt \
      -days 500 -sha256
    '';
in

{
  name = "privoxy";
  meta = with lib.maintainers; {
    maintainers = [ rnhmjoj ];
  };

  nodes.machine = { ... }: {
    services.nginx.enable = true;
    services.nginx.virtualHosts."example.com" = {
      addSSL = true;
      sslCertificate = "${certs}/server.crt";
      sslCertificateKey = "${certs}/server.key";
      locations."/".root = pkgs.writeTextFile
        { name = "bad-day";
          destination = "/how-are-you/index.html";
          text = "I've had a bad day!\n";
        };
      locations."/ads".extraConfig = ''
        return 200 "Hot Nixpkgs PRs in your area. Click here!\n";
      '';
    };

    services.privoxy = {
      enable = true;
      inspectHttps = true;
      settings = {
        ca-cert-file = "${certs}/ca.crt";
        ca-key-file  = "${certs}/ca.key";
        debug = 65536;
      };
      userActions = ''
        {+filter{positive}}
        example.com

        {+block{Fake ads}}
        example.com/ads
      '';
      userFilters = ''
        FILTER: positive This is a filter example.
        s/bad/great/ig
      '';
    };

    security.pki.certificateFiles = [ "${certs}/ca.crt" ];

    networking.hosts."::1" = [ "example.com" ];
    networking.proxy.httpProxy = "http://localhost:8118";
    networking.proxy.httpsProxy = "http://localhost:8118";
  };

  nodes.machine_socks4  = { ... }: { services.privoxy = { enable = true; settings.forward-socks4  = "/ 127.0.0.1:9050 ."; }; };
  nodes.machine_socks4a = { ... }: { services.privoxy = { enable = true; settings.forward-socks4a = "/ 127.0.0.1:9050 ."; }; };
  nodes.machine_socks5  = { ... }: { services.privoxy = { enable = true; settings.forward-socks5  = "/ 127.0.0.1:9050 ."; }; };
  nodes.machine_socks5t = { ... }: { services.privoxy = { enable = true; settings.forward-socks5t = "/ 127.0.0.1:9050 ."; }; };

  testScript =
    ''
      with subtest("Privoxy is running"):
          machine.wait_for_unit("privoxy")
          machine.wait_for_open_port(8118)
          machine.succeed("curl -f http://config.privoxy.org")

      with subtest("Privoxy can filter http requests"):
          machine.wait_for_open_port(80)
          assert "great day" in machine.succeed(
              "curl -sfL http://example.com/how-are-you? | tee /dev/stderr"
          )

      with subtest("Privoxy can filter https requests"):
          machine.wait_for_open_port(443)
          assert "great day" in machine.succeed(
              "curl -sfL https://example.com/how-are-you? | tee /dev/stderr"
          )

      with subtest("Blocks are working"):
          machine.wait_for_open_port(443)
          machine.fail("curl -f https://example.com/ads 1>&2")
          machine.succeed("curl -f https://example.com/PRIVOXY-FORCE/ads 1>&2")

      with subtest("Temporary certificates are cleaned"):
          # Count current certificates
          machine.succeed("test $(ls /run/privoxy/certs | wc -l) -gt 0")
          # Forward in time 12 days, trigger the timer..
          machine.succeed("date -s \"$(date --date '12 days')\"")
          machine.systemctl("start systemd-tmpfiles-clean")
          # ...and count again
          machine.succeed("test $(ls /run/privoxy/certs | wc -l) -eq 0")

      with subtest("Privoxy supports socks upstream proxies"):
          for m in [machine_socks4, machine_socks4a, machine_socks5, machine_socks5t]:
              m.wait_for_unit("privoxy")
              m.wait_for_open_port(8118)
              # We expect a 503 error because the dummy upstream proxy is not reachable.
              # In issue #265654, instead privoxy segfaulted causing curl to exit with "Empty reply from server".
              m.succeed("http_proxy=http://localhost:8118 curl -v http://does-not-exist/ 2>&1 | grep 'HTTP/1.1 503'")
    '';
})