anchor.diff:          assert "users" in groups
   
       slave.fail("systemctl is-enabled jenkins.service")
  +
  +    with subtest("jobs are declarative"):
  +        # Check that jobs are created on disk.
  +        master.wait_for_unit("jenkins-job-builder")
  +        master.wait_until_fails("systemctl is-active jenkins-job-builder")
  +        master.wait_until_succeeds("test -f /var/lib/jenkins/jobs/job-1/config.xml")
  +        master.wait_until_succeeds("test -f /var/lib/jenkins/jobs/folder-1/config.xml")
  +        master.wait_until_succeeds("test -f /var/lib/jenkins/jobs/folder-1/jobs/job-2/config.xml")
  +
  +        # Wait until jenkins is ready, reload configuration and verify it also
  +        # sees the jobs.
  +        master.succeed("curl --fail ${jenkinsUrl}/cli")
  +        master.succeed("curl ${jenkinsUrl}/jnlpJars/jenkins-cli.jar -O")
  +        master.succeed("${pkgs.jre}/bin/java -jar jenkins-cli.jar -s ${jenkinsUrl} -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword) reload-configuration")
  +        out = master.succeed("${pkgs.jre}/bin/java -jar jenkins-cli.jar -s ${jenkinsUrl} -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword) list-jobs")
  +        jobs = [x.strip() for x in out.splitlines()]
  +        # Seeing jobs inside folders requires the Folders plugin
  +        # (https://plugins.jenkins.io/cloudbees-folder/), which we don't have
  +        # in this vanilla jenkins install, so limit ourself to non-folder jobs.
  +        assert jobs == ['job-1'], f"jobs != ['job-1']: {jobs}"
  +
  +        master.succeed(
  +            "${configWithoutJobs}/bin/switch-to-configuration test >&2"
  +        )
  +
  +        # Check that jobs are removed from disk.
  +        master.wait_for_unit("jenkins-job-builder")
  +        master.wait_until_fails("systemctl is-active jenkins-job-builder")
  +        master.wait_until_fails("test -f /var/lib/jenkins/jobs/job-1/config.xml")
  +        master.wait_until_fails("test -f /var/lib/jenkins/jobs/folder-1/config.xml")
  +        master.wait_until_fails("test -f /var/lib/jenkins/jobs/folder-1/jobs/job-2/config.xml")
  +
  +        # Reload jenkins' configuration and verify it also sees the jobs as removed.
  +        master.succeed("${pkgs.jre}/bin/java -jar jenkins-cli.jar -s ${jenkinsUrl} -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword) reload-configuration")
  +        out = master.succeed("${pkgs.jre}/bin/java -jar jenkins-cli.jar -s ${jenkinsUrl} -auth admin:$(cat /var/lib/jenkins/secrets/initialAdminPassword) list-jobs")
  +        jobs = [x.strip() for x in out.splitlines()]
  +        assert jobs == [], f"jobs != []: {jobs}"
     '';
   })
  
positive.code: 
    };
  
    testScript = ''
      start_all()
  
      master.wait_for_unit("jenkins")
  
negative.code: #   1. jenkins service starts on master node
  #   2. jenkins user can be extended on both master and slave
  #   3. jenkins service not started on slave node
  #   4. declarative jobs can be added and removed
  
  import ./make-test-python.nix ({ pkgs, ...} : {
    name = "jenkins";
  