{
  pkgs,
  lib,
  self,
}:

pkgs.testers.runNixOSTest {
  name = "arr-init-integration";

  nodes.machine =
    { pkgs, lib, ... }:
    let
      mocks = import ./lib/mocks.nix { inherit pkgs; };
    in
    {
      imports = [ self.nixosModules.default ];

      system.stateVersion = "24.11";

      virtualisation.memorySize = 4096;

      environment.systemPackages = with pkgs; [
        curl
        jq
        gnugrep
      ];

      systemd.services.mock-qbittorrent = mocks.mkMockQbittorrent {
        initialCategories = {
          tv = {
            name = "tv";
            savePath = "/downloads";
          };
          movies = {
            name = "movies";
            savePath = "/downloads";
          };
        };
        before = [
          "sonarr-init.service"
          "radarr-init.service"
        ];
      };

      systemd.tmpfiles.rules = [
        "d /media/tv 0755 sonarr sonarr -"
        "d /media/movies 0755 radarr radarr -"
      ];

      services.sonarr = {
        enable = true;
        dataDir = "/var/lib/sonarr/.config/NzbDrone";
        settings.server.port = lib.mkDefault 8989;
      };

      services.radarr = {
        enable = true;
        dataDir = "/var/lib/radarr/.config/Radarr";
        settings.server.port = lib.mkDefault 7878;
      };

      services.prowlarr = {
        enable = true;
      };

      services.bazarr = {
        enable = true;
        listenPort = 6767;
      };

      services.arrInit.sonarr = {
        enable = true;
        serviceName = "sonarr";
        dataDir = "/var/lib/sonarr/.config/NzbDrone";
        port = 8989;
        downloadClients = [
          {
            name = "qBittorrent";
            implementation = "QBittorrent";
            configContract = "QBittorrentSettings";
            protocol = "torrent";
            fields = {
              host = "127.0.0.1";
              port = 6011;
              useSsl = false;
              tvCategory = "tv";
            };
          }
        ];
        rootFolders = [ "/media/tv" ];
      };

      services.arrInit.radarr = {
        enable = true;
        serviceName = "radarr";
        dataDir = "/var/lib/radarr/.config/Radarr";
        port = 7878;
        downloadClients = [
          {
            name = "qBittorrent";
            implementation = "QBittorrent";
            configContract = "QBittorrentSettings";
            protocol = "torrent";
            fields = {
              host = "127.0.0.1";
              port = 6011;
              useSsl = false;
              movieCategory = "movies";
            };
          }
        ];
        rootFolders = [ "/media/movies" ];
      };

      services.arrInit.prowlarr = {
        enable = true;
        serviceName = "prowlarr";
        dataDir = "/var/lib/prowlarr";
        port = 9696;
        apiVersion = "v1";
        syncedApps = [
          {
            name = "Sonarr";
            implementation = "Sonarr";
            configContract = "SonarrSettings";
            prowlarrUrl = "http://localhost:9696";
            baseUrl = "http://localhost:8989";
            apiKeyFrom = "/var/lib/sonarr/.config/NzbDrone/config.xml";
            # syncCategories omitted — auto-detected from Prowlarr API
            serviceName = "sonarr";
          }
          {
            name = "Radarr";
            implementation = "Radarr";
            configContract = "RadarrSettings";
            prowlarrUrl = "http://localhost:9696";
            baseUrl = "http://localhost:7878";
            apiKeyFrom = "/var/lib/radarr/.config/Radarr/config.xml";
            # syncCategories omitted — auto-detected from Prowlarr API
            serviceName = "radarr";
          }
        ];
      };

      services.bazarrInit = {
        enable = true;
        dataDir = "/var/lib/bazarr";
        port = 6767;
        sonarr = {
          enable = true;
          dataDir = "/var/lib/sonarr/.config/NzbDrone";
          port = 8989;
          serviceName = "sonarr";
        };
        radarr = {
          enable = true;
          dataDir = "/var/lib/radarr/.config/Radarr";
          port = 7878;
          serviceName = "radarr";
        };
      };
    };

  testScript = ''
    start_all()

    # Wait for services to start
    machine.wait_for_unit("mock-qbittorrent.service")
    machine.wait_until_succeeds("curl -sf http://localhost:6011/api/v2/app/version", timeout=30)
    machine.wait_for_unit("sonarr.service")
    machine.wait_for_unit("radarr.service")
    machine.wait_for_unit("prowlarr.service")
    machine.wait_for_unit("bazarr.service")

    # Wait for Sonarr API to be ready (config.xml is auto-generated on first start)
    machine.wait_until_succeeds(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
        "curl -sf http://localhost:8989/api/v3/system/status -H \"X-Api-Key: $API_KEY\"",
        timeout=120,
    )

    # Wait for Radarr API to be ready
    machine.wait_until_succeeds(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
        "curl -sf http://localhost:7878/api/v3/system/status -H \"X-Api-Key: $API_KEY\"",
        timeout=120,
    )

    # Wait for Prowlarr API to be ready
    machine.wait_until_succeeds(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
        "curl -sf http://localhost:9696/api/v1/system/status -H \"X-Api-Key: $API_KEY\"",
        timeout=180,
    )

    # Ensure init services run after config.xml exists
    machine.succeed("systemctl restart sonarr-init.service")
    machine.succeed("systemctl restart radarr-init.service")
    machine.wait_for_unit("sonarr-init.service")
    machine.wait_for_unit("radarr-init.service")

    # Verify Sonarr download clients
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
        "curl -sf http://localhost:8989/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.name == \"qBittorrent\")'"
    )

    # Verify Sonarr root folders
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
        "curl -sf http://localhost:8989/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.path == \"/media/tv\")'"
    )

    # Verify Radarr download clients
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
        "curl -sf http://localhost:7878/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.name == \"qBittorrent\")'"
    )

    # Verify Radarr root folders
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
        "curl -sf http://localhost:7878/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.path == \"/media/movies\")'"
    )

    # Restart prowlarr-init now that all config.xml files exist
    machine.succeed("systemctl restart prowlarr-init.service")
    machine.wait_for_unit("prowlarr-init.service")

    # Verify Sonarr registered as synced app in Prowlarr
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.name == \"Sonarr\")'"
    )

    # Verify Radarr registered as synced app in Prowlarr
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.name == \"Radarr\")'"
    )

    # Verify auto-detected syncCategories are non-empty for Sonarr (TV: 5xxx)
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.name == \"Sonarr\") | .fields[] | select(.name == \"syncCategories\") | .value | length > 0'"
    )

    # Verify auto-detected syncCategories contain parent TV category (5000)
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.name == \"Sonarr\") | .fields[] | select(.name == \"syncCategories\") | .value | map(select(. == 5000)) | length > 0'"
    )

    # Verify auto-detected syncCategories are non-empty for Radarr (Movies: 2xxx)
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.name == \"Radarr\") | .fields[] | select(.name == \"syncCategories\") | .value | length > 0'"
    )

    # Verify auto-detected syncCategories contain parent Movies category (2000)
    machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
        "jq -e '.[] | select(.name == \"Radarr\") | .fields[] | select(.name == \"syncCategories\") | .value | map(select(. == 2000)) | length > 0'"
    )

    # Idempotency test: restart init services and verify no duplicate entries
    machine.succeed("systemctl restart sonarr-init.service")
    machine.succeed("systemctl restart radarr-init.service")
    machine.succeed("systemctl restart prowlarr-init.service")

    # Verify Sonarr still has exactly 1 download client
    result = machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
        "curl -sf http://localhost:8989/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
        "jq '. | length'"
    ).strip()
    assert result == "1", f"Expected 1 Sonarr download client, got {result}"

    # Verify Sonarr still has exactly 1 root folder
    result = machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
        "curl -sf http://localhost:8989/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
        "jq '. | length'"
    ).strip()
    assert result == "1", f"Expected 1 Sonarr root folder, got {result}"

    # Verify Radarr still has exactly 1 download client
    result = machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
        "curl -sf http://localhost:7878/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
        "jq '. | length'"
    ).strip()
    assert result == "1", f"Expected 1 Radarr download client, got {result}"

    # Verify Radarr still has exactly 1 root folder
    result = machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/radarr/.config/Radarr/config.xml) && "
        "curl -sf http://localhost:7878/api/v3/rootfolder -H \"X-Api-Key: $API_KEY\" | "
        "jq '. | length'"
    ).strip()
    assert result == "1", f"Expected 1 Radarr root folder, got {result}"

    # Verify Prowlarr still has exactly 2 synced apps
    result = machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
        "jq '. | length'"
    ).strip()
    assert result == "2", f"Expected 2 Prowlarr synced apps, got {result}"

    # Wait for Bazarr to generate config.yaml
    machine.wait_until_succeeds(
        "test -f /var/lib/bazarr/config/config.yaml",
        timeout=120,
    )

    # Wait for Bazarr API to be ready
    machine.wait_until_succeeds(
        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
        "curl -sf http://localhost:6767/api/system/status -H \"X-API-KEY: $API_KEY\"",
        timeout=120,
    )

    # Restart bazarr-init now that config.yaml exists
    machine.succeed("systemctl restart bazarr-init.service")
    machine.wait_for_unit("bazarr-init.service")

    # Verify Sonarr provider configured in Bazarr
    machine.succeed(
        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
        "curl -sf http://localhost:6767/api/system/settings -H \"X-API-KEY: $API_KEY\" | "
        "jq -e '.general.use_sonarr == true and (.sonarr.apikey // \"\") != \"\"'"
    )

    # Verify Radarr provider configured in Bazarr
    machine.succeed(
        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
        "curl -sf http://localhost:6767/api/system/settings -H \"X-API-KEY: $API_KEY\" | "
        "jq -e '.general.use_radarr == true and (.radarr.apikey // \"\") != \"\"'"
    )

    # Idempotency: restart bazarr-init and verify no duplicate config
    machine.succeed("systemctl restart bazarr-init.service")
    machine.wait_for_unit("bazarr-init.service")

    machine.succeed(
        "API_KEY=$(awk '/^auth:/{f=1} f && /apikey:/{gsub(/.*apikey: /, \"\"); print; exit}' /var/lib/bazarr/config/config.yaml) && "
        "curl -sf http://localhost:6767/api/system/settings -H \"X-API-KEY: $API_KEY\" | "
        "jq -e '.general.use_sonarr == true and (.sonarr.apikey // \"\") != \"\"'"
    )

    # Third run: verify counts are still correct (full idempotency)
    machine.succeed("systemctl restart sonarr-init.service")
    machine.succeed("systemctl restart radarr-init.service")
    machine.succeed("systemctl restart prowlarr-init.service")
    machine.succeed("systemctl restart bazarr-init.service")

    # Verify counts are still correct after third run
    result = machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/sonarr/.config/NzbDrone/config.xml) && "
        "curl -sf http://localhost:8989/api/v3/downloadclient -H \"X-Api-Key: $API_KEY\" | "
        "jq '. | length'"
    ).strip()
    assert result == "1", f"Expected 1 Sonarr download client after third run, got {result}"

    result = machine.succeed(
        "API_KEY=$(grep -oP '(?<=<ApiKey>)[^<]+' /var/lib/prowlarr/config.xml) && "
        "curl -sf http://localhost:9696/api/v1/applications -H \"X-Api-Key: $API_KEY\" | "
        "jq '. | length'"
    ).strip()
    assert result == "2", f"Expected 2 Prowlarr synced apps after third run, got {result}"
  '';
}