{ pkgs, serverPkg, clientPkg }:
{
  name = "lightscale-lab-controlplane-ha";
  nodes = {
    node1 = { ... }: {
      networking.hostName = "node1";
      networking.usePredictableInterfaceNames = false;
      virtualisation.vlans = [ 1 ];
      networking.interfaces.eth1.useDHCP = false;
      networking.interfaces.eth1.ipv4.addresses = [
        { address = "10.0.0.1"; prefixLength = 24; }
      ];
      networking.firewall.enable = false;
      boot.kernelModules = [ "wireguard" ];
      services.postgresql = {
        enable = true;
        package = pkgs.postgresql_16;
        settings = {
          listen_addresses = pkgs.lib.mkForce "*";
        };
        authentication = ''
          local all all trust
          host all all 127.0.0.1/32 trust
        '';
        initialScript = pkgs.writeText "lightscale-init.sql" ''
          CREATE ROLE lightscale LOGIN;
          CREATE DATABASE lightscale OWNER lightscale;
        '';
      };
      environment.systemPackages = [
        serverPkg
        clientPkg
        pkgs.iproute2
        pkgs.iputils
        pkgs.netcat-openbsd
        pkgs.curl
      ];
    };
    node2 = { ... }: {
      networking.hostName = "node2";
      networking.usePredictableInterfaceNames = false;
      virtualisation.vlans = [ 1 ];
      networking.interfaces.eth1.useDHCP = false;
      networking.interfaces.eth1.ipv4.addresses = [
        { address = "10.0.0.2"; prefixLength = 24; }
      ];
      networking.firewall.enable = false;
      boot.kernelModules = [ "wireguard" ];
      environment.systemPackages = [
        clientPkg
        pkgs.iproute2
        pkgs.iputils
        pkgs.netcat-openbsd
        pkgs.curl
      ];
    };
  };

  testScript = ''
    start_all()
    node1.wait_for_unit("multi-user.target")
    node2.wait_for_unit("multi-user.target")

    node1.wait_for_unit("postgresql.service")
    node1.wait_for_open_port(5432, timeout=120)

    node1.wait_until_succeeds("ip -4 addr show dev eth1 | grep -q '10.0.0.1/24'")
    node2.wait_until_succeeds("ip -4 addr show dev eth1 | grep -q '10.0.0.2/24'")

    node1.succeed("touch /tmp/lightscale-server-1.log")
    node1.succeed("touch /tmp/lightscale-server-2.log")
    node1.execute("sh -c 'tail -n +1 -f /tmp/lightscale-server-1.log >/dev/console 2>&1 &'")
    node1.execute("sh -c 'tail -n +1 -f /tmp/lightscale-server-2.log >/dev/console 2>&1 &'")

    db_url = "postgres://lightscale@127.0.0.1/lightscale?sslmode=disable"

    node1.succeed(
        "systemd-run --no-block --unit=lightscale-server-1 --service-type=simple "
        "--property=Restart=on-failure --property=RestartSec=1 "
        "--property=TimeoutStartSec=30 "
        "--property=StandardOutput=append:/tmp/lightscale-server-1.log "
        "--property=StandardError=append:/tmp/lightscale-server-1.log "
        "--setenv=RUST_LOG=info -- "
        "lightscale-server --listen 10.0.0.1:8080 "
        + f"--db-url '{db_url}'"
    )
    node1.succeed(
        "systemd-run --no-block --unit=lightscale-server-2 --service-type=simple "
        "--property=Restart=on-failure --property=RestartSec=1 "
        "--property=TimeoutStartSec=30 "
        "--property=StandardOutput=append:/tmp/lightscale-server-2.log "
        "--property=StandardError=append:/tmp/lightscale-server-2.log "
        "--setenv=RUST_LOG=info -- "
        "lightscale-server --listen 10.0.0.1:8081 "
        + f"--db-url '{db_url}'"
    )

    node1.wait_for_unit("lightscale-server-1.service")
    node1.wait_for_unit("lightscale-server-2.service")
    node1.wait_for_open_port(8080, addr="10.0.0.1", timeout=120)
    node1.wait_for_open_port(8081, addr="10.0.0.1", timeout=120)

    import json

    net = json.loads(node1.succeed(
        "curl -sSf -X POST http://10.0.0.1:8080/v1/networks "
        "-H 'content-type: application/json' "
        "-d '{\"name\":\"ha\",\"bootstrap_token_ttl_seconds\":600," \
        "\"bootstrap_token_uses\":10,\"bootstrap_token_tags\":[\"ha\"]}'"
    ))
    token = net["bootstrap_token"]["token"]

    node1.succeed("systemctl stop lightscale-server-1.service")
    node1.wait_until_fails("curl -sSf http://10.0.0.1:8080/healthz")

    node2.succeed(
        "lightscale-client --profile ha --config /tmp/ls-config.json "
        "init http://10.0.0.1:8080,http://10.0.0.1:8081"
    )
    node2.succeed(
        "lightscale-client --profile ha --config /tmp/ls-config.json "
        "--state-dir /tmp/ls-state register --node-name node2 -- " + token
    )
    node2.succeed(
        "lightscale-client --profile ha --config /tmp/ls-config.json "
        "--state-dir /tmp/ls-state heartbeat --endpoint 10.0.0.2:51820"
    )
    node2.succeed(
        "lightscale-client --profile ha --config /tmp/ls-config.json "
        "--state-dir /tmp/ls-state netmap | grep -q 'peers:'"
    )
  '';
}