cluster/services/wireguard: test in simulacrum

cluster/services/wireguard/default.nix

@@ -93,5 +93,9 @@ in
       nodes = config.services.wireguard.nodes.mesh;
       shared = false;
     };
+    simulacrum = {
+      enable = true;
+      settings = ./test.nix;
+    };
   };
 }

cluster/services/wireguard/test.nix

@@ -0,0 +1,25 @@
+{ cluster, lib, ... }:
+
+{
+  testScript = ''
+    ${lib.pipe cluster.config.services.wireguard.nodes.mesh [
+      (map (node: /*python*/ ''
+        ${node}.wait_for_unit("wireguard-wgmesh.target")
+      ''))
+      (lib.concatStringsSep "\n")
+    ]}
+
+    ${lib.pipe cluster.config.services.wireguard.nodes.mesh [
+      (map (node: /*python*/ ''
+        with subtest("${node} can reach all other nodes"):
+          ${lib.pipe (cluster.config.services.wireguard.otherNodes.mesh node) [
+            (map (peer: /*python*/ ''
+              ${node}.succeed("ping -c3 ${cluster.config.hostLinks.${peer}.mesh.extra.meshIp}")
+            ''))
+            (lib.concatStringsSep "\n  ")
+          ]}
+      ''))
+      (lib.concatStringsSep "\n")
+    ]}
+  '';
+}