nixpkgs/nixos/tests/vault-agent.nix

import ./make-test-python.nix ({ pkgs, ... }: {
  name = "vault-agent";

  nodes.machine = { config, pkgs, ... }: {
    services.vault-agent.instances.example.settings = {
      vault.address = config.environment.variables.VAULT_ADDR;

      auto_auth = [{
        method = [{
          type = "token_file";
          config.token_file_path = pkgs.writeText "vault-token" config.environment.variables.VAULT_TOKEN;
        }];
      }];

      template = [{
        contents = ''
          {{- with secret "secret/example" }}
          {{ .Data.data.key }}"
          {{- end }}
        '';
        perms = "0600";
        destination = "/example";
      }];
    };

    services.vault = {
      enable = true;
      dev = true;
      devRootTokenID = config.environment.variables.VAULT_TOKEN;
    };

    environment = {
      systemPackages = [ pkgs.vault ];
      variables = {
        VAULT_ADDR = "http://localhost:8200";
        VAULT_TOKEN = "root";
      };
    };
  };

  testScript = ''
    machine.wait_for_unit("vault.service")
    machine.wait_for_open_port(8200)

    machine.wait_until_succeeds('vault kv put secret/example key=example')

    machine.wait_for_unit("vault-agent-example.service")

    machine.wait_for_file("/example")
    machine.succeed('grep "example" /example')
  '';
})