{
  name = "synapse-test";

  nodes.machine =
    {
      config,
      lib,
      pkgs,
      ...
    }:
    let
      cfg = config.services.matrix-synapse;

      keyFile = pkgs.writeText "livekit.key" "API Secret: secret";
    in
    {
      # fake sops module
      options.sops = lib.mkOption {
        type = lib.types.attrs;
        default = { };
      };

      imports = [
        ../../modules/nixos/matrix-synapse
        ../../modules/nixos/coturn
        ../../modules/nixos/maubot
      ];

      config = {
        services.matrix-synapse = {
          enable = true;
          coturn.enable = true;
          settings = {
            registration_shared_secret = "secret";
            turn_shared_secret = "turn-secret";
          };
        };

        services.coturn = {
          enable = true;
          no-tls = true;
          static-auth-secret = "turn-secret";
        };

        services.maubot = {
          enable = true;
          extraConfigFile = builtins.toString (
            pkgs.writeText "maubot-extra" ''
              homeservers:
                ${cfg.settings.server_name}:
                  url: http://127.0.0.1:${builtins.toString cfg.port}
                  secret: ${cfg.settings.registration_shared_secret}
              admins:
                alice: password
            ''
          );
        };

        services.livekit.keyFile = keyFile;
        services.lk-jwt-service.keyFile = keyFile;

        services.nginx.enable = true;
        networking.domain = "example.com";
        networking.firewall.enable = false; # simplify networking for test

        # Override SSL/ACME requirements for test
        services.nginx.virtualHosts."example.com".forceSSL = lib.mkForce false;
        services.nginx.virtualHosts."example.com".enableACME = lib.mkForce false;
      };
    };

  testScript = ''
    start_all()

    machine.wait_for_unit("default.target")

    machine.wait_for_unit("matrix-synapse.service")
    machine.wait_for_open_port(8008)

    machine.wait_for_unit("livekit.service")
    machine.wait_for_open_port(7880)

    machine.wait_for_unit("lk-jwt-service.service")
    machine.wait_for_open_port(8080)

    machine.wait_for_unit("coturn.service")
    machine.wait_for_open_port(3478)

    machine.wait_for_unit("maubot.service")
    machine.wait_for_open_port(29316)

    machine.succeed("curl -f http://localhost:8008/_matrix/client/versions")
    # machine.succeed("curl -f http://localhost:29316/_matrix/maubot/v1/logs") # TODO: add auth
  '';
}