19c19,21
<     openFirewall = lib.mkEnableOption "Open the firewall port (default 45876).";
---
>     openFirewall = (lib.mkEnableOption "") // {
>       description = "Whether to open the firewall port (default 45876).";
>     };
22c24
<       type = lib.types.attrs;
---
>       type = lib.types.attrsOf lib.types.str;
47c49
<       description = "Beszel Agent";
---
>       description = "Beszel Server Monitoring Agent";
80a83
>         User = "beszel-agent";
86,87c89,90
<         ProtectControlGroups = true;
<         ProtectHome = true;
---
>         ProtectControlGroups = "strict";
>         ProtectHome = "read-only";

From 0bfad254ceb474554c9e4dea6d6a01937010e3cf Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Mon, 13 Oct 2025 12:52:20 +0900
Subject: [PATCH] nixos/tests/beszel: init

---
 nixos/tests/all-tests.nix          |   1 +
 nixos/tests/beszel.nix             | 119 +++++++++++++++++++++++++++++
 pkgs/by-name/be/beszel/package.nix |   6 +-
 3 files changed, 125 insertions(+), 1 deletion(-)
 create mode 100644 nixos/tests/beszel.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e471baaf7849..c879ec56938b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -260,6 +260,7 @@ in
   beanstalkd = runTest ./beanstalkd.nix;
   bees = runTest ./bees.nix;
   benchexec = runTest ./benchexec.nix;
+  beszel = runTest ./beszel.nix;
   binary-cache = runTest {
     imports = [ ./binary-cache.nix ];
     _module.args.compression = "zstd";
diff --git a/nixos/tests/beszel.nix b/nixos/tests/beszel.nix
new file mode 100644
index 000000000000..77a4a32a3747
--- /dev/null
+++ b/nixos/tests/beszel.nix
@@ -0,0 +1,119 @@
+{ pkgs, lib, ... }:
+{
+  name = "beszel";
+  meta.maintainers = with lib.maintainers; [ h7x4 ];
+
+  nodes = {
+    hubHost =
+      { config, pkgs, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.1/24";
+        };
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+        };
+
+        services.beszel.hub = {
+          enable = true;
+          host = "10.0.0.1";
+        };
+
+        networking.firewall.allowedTCPPorts = [
+          config.services.beszel.hub.port
+        ];
+
+        environment.systemPackages = [
+          config.services.beszel.hub.package
+        ];
+      };
+
+    agentHost =
+      { config, pkgs, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.2/24";
+        };
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+        };
+
+        environment.systemPackages = with pkgs; [ jq ];
+
+        specialisation."agent".configuration = {
+          services.beszel.agent = {
+            enable = true;
+            environment.HUB_URL = "http://10.0.0.1:8090";
+            environment.KEY_FILE = "/var/lib/beszel-agent/id_ed25519.pub";
+            environment.TOKEN_FILE = "/var/lib/beszel-agent/token";
+            openFirewall = true;
+          };
+        };
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    let
+      hubCfg = nodes.hubHost.services.beszel.hub;
+      agentCfg = nodes.agentHost.specialisation."agent".configuration.services.beszel.agent;
+    in
+    ''
+      import json
+
+      start_all()
+
+      with subtest("Start hub"):
+        hubHost.wait_for_unit("beszel-hub.service")
+        hubHost.wait_for_open_port(${toString hubCfg.port}, "${toString hubCfg.host}")
+
+      with subtest("Register user"):
+        agentHost.succeed('curl -f --json \'${
+          builtins.toJSON {
+            email = "admin@example.com";
+            password = "password";
+          }
+        }\' "${agentCfg.environment.HUB_URL}/api/beszel/create-user"')
+        user = json.loads(agentHost.succeed('curl -f --json \'${
+          builtins.toJSON {
+            identity = "admin@example.com";
+            password = "password";
+          }
+        }\' ${agentCfg.environment.HUB_URL}/api/collections/users/auth-with-password').strip())
+
+      with subtest("Install agent credentials"):
+        agentHost.succeed("mkdir -p \"$(dirname '${agentCfg.environment.KEY_FILE}')\" \"$(dirname '${agentCfg.environment.TOKEN_FILE}')\"")
+        sshkey = agentHost.succeed(f"curl -H 'Authorization: {user["token"]}' -f ${agentCfg.environment.HUB_URL}/api/beszel/getkey | jq -r .key").strip()
+        utoken = agentHost.succeed(f"curl -H 'Authorization: {user["token"]}' -f ${agentCfg.environment.HUB_URL}/api/beszel/universal-token | jq -r .token").strip()
+        agentHost.succeed(f"echo '{sshkey}' > '${agentCfg.environment.KEY_FILE}'")
+        agentHost.succeed(f"echo '{utoken}' > '${agentCfg.environment.TOKEN_FILE}'")
+
+      with subtest("Register agent in hub"):
+        agentHost.succeed(f'curl -H \'Authorization: {user["token"]}\' -f --json \'{${
+          builtins.toJSON {
+            "host" = "10.0.0.2";
+            "name" = "agent";
+            "pkey" = "{sshkey}";
+            "port" = "45876";
+            "tkn" = "{utoken}";
+            "users" = ''{user['record']['id']}'';
+          }
+        }}\' "${agentCfg.environment.HUB_URL}/api/collections/systems/records"')
+
+      with subtest("Start agent"):
+        agentHost.succeed("/run/current-system/specialisation/agent/bin/switch-to-configuration switch")
+        agentHost.wait_for_unit("beszel-agent.service")
+        agentHost.wait_until_succeeds("journalctl -eu beszel-agent --grep 'SSH connection established'")
+        agentHost.wait_until_succeeds(f'curl -H \'Authorization: {user["token"]}\' -f ${agentCfg.environment.HUB_URL}/api/collections/systems/records | grep agentHost')
+    '';
+}
diff --git a/pkgs/by-name/be/beszel/package.nix b/pkgs/by-name/be/beszel/package.nix
index 628592190f4d..39e50c6da52f 100644
--- a/pkgs/by-name/be/beszel/package.nix
+++ b/pkgs/by-name/be/beszel/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   nix-update-script,
   buildNpmPackage,
+  nixosTests,
 }:
 buildGoModule rec {
   pname = "beszel";
@@ -64,7 +65,10 @@ buildGoModule rec {
     mv $out/bin/hub $out/bin/beszel-hub
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.nixos = nixosTests.beszel;
+  };
 
   meta = {
     homepage = "https://github.com/henrygd/beszel";
-- 
2.50.1