add nixos test

default.nix

@@ -1,9 +1,9 @@
-with import <nixpkgs> {};
-  buildGoModule {
+{ pkgs ? import <nixpkgs> {} }:
+pkgs.buildGoModule {
     name = "systemd-vaultd";
     src = ./.;
     vendorSha256 = null;
-    meta = with lib; {
+    meta = with pkgs.lib; {
       description = "A proxy for secrets between systemd services and vault";
       homepage = "https://github.com/numtide/systemd-vaultd";
       license = licenses.mit;

nix/checks/nixos-test.nix

@@ -0,0 +1,25 @@
+{
+  makeTest ? import <nixpkgs/nixos/tests/make-test-python.nix>,
+  pkgs ? (import <nixpkgs> {}),
+}: let
+  makeTest' = args:
+    makeTest args {
+      inherit pkgs;
+      inherit (pkgs) system;
+    };
+in {
+  ssh-keys = makeTest' {
+    name = "unitests";
+    nodes.server = {pkgs, ...}: {
+      # Important to get the systemd service running for root
+      #environment.variables.XDG_RUNTIME_DIR = "/run/user/0";
+    };
+
+    testScript = ''
+      start_all()
+      server.succeed("machinectl shell .host ${pkgs.callPackage ./unittests.nix {}} >&2")
+      # machinectl does not passthru exit codes, so we have to check manually
+      server.succeed("[[ -f /tmp/success ]]")
+    '';
+  };
+}

nix/checks/unittests.nix

@@ -0,0 +1,22 @@
+{
+  writeShellScript,
+  python3,
+  pkgs,
+  lib,
+  coreutils,
+  systemd
+}: let
+  systemd-vaultd = pkgs.callPackage ../../default.nix {};
+in
+  writeShellScript "unittests" ''
+    set -eu -o pipefail
+    export PATH=${lib.makeBinPath [ python3.pkgs.pytest coreutils systemd ]}
+    export SYSTEMD_VAULTD_BIN=${systemd-vaultd}/bin/systemd-vaultd
+    export TMPDIR=$(mktemp -d)
+    trap 'rm -rf $TMPDIR' EXIT
+    cp --no-preserve=mode --preserve=timestamps -r ${../..} "$TMPDIR/source"
+    cd "$TMPDIR/source"
+    pytest -s ./tests
+    # we need this in our nixos tests
+    touch /tmp/success
+  ''