add nixos vm test for matrix-ops-bot module

flake.nix

@@ -220,6 +220,9 @@
           ruff = ruffCheck;
           pyright = pyrightCheck;
         }
+        // pkgs.lib.optionalAttrs pkgs.stdenv.isLinux {
+          nixos-module = pkgs.testers.runNixOSTest (import ./nix/tests/matrix-ops-bot.nix self);
+        }
       );
 
       devShells = forAllSystems (pkgs: {

nix/tests/matrix-ops-bot.nix

@@ -0,0 +1,52 @@
+self: {
+  name = "matrix-ops-bot-nixos-module";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ self.nixosModules.default ];
+
+      environment.systemPackages = [ pkgs.curl ];
+
+      environment.etc."matrix-ops-bot/config.json".text = builtins.toJSON {
+        routing_keys = [ ];
+        log_level = "INFO";
+        matrix = {
+          homeserver = "http://127.0.0.1:9";
+          user_id = "@ops-bot:example.invalid";
+          password = "not-a-real-password";
+          device_name = "nixos-test";
+          store_path = "/var/lib/matrix-ops-bot/matrix";
+          verify_ssl = false;
+        };
+      };
+
+      environment.etc."matrix-ops-bot/bot.env".text = ''
+        BOT_LOG_LEVEL=DEBUG
+      '';
+
+      services.matrix-ops-bot = {
+        enable = true;
+        port = 1111;
+        configFile = "/etc/matrix-ops-bot/config.json";
+        envFile = "/etc/matrix-ops-bot/bot.env";
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("matrix-ops-bot.service")
+    machine.wait_for_open_port(1111)
+
+    unit = machine.succeed("systemctl cat matrix-ops-bot.service")
+    assert "DynamicUser=true" in unit, unit
+    assert "StateDirectory=matrix-ops-bot" in unit, unit
+    assert "LoadCredential=config.json:/etc/matrix-ops-bot/config.json" in unit, unit
+    assert "LoadCredential=bot.env:/etc/matrix-ops-bot/bot.env" in unit, unit
+
+    machine.succeed("test -f /run/credentials/matrix-ops-bot.service/config.json")
+    machine.succeed("test -f /run/credentials/matrix-ops-bot.service/bot.env")
+
+    machine.succeed("curl -sf http://127.0.0.1:1111/ | grep -F '\"message\":\"Hello World\"'")
+  '';
+}