From 964464c056726f37df160788e85e2cc9f31fbf9d Mon Sep 17 00:00:00 2001
From: marshmallow <git@althaea.zone>
Date: Fri, 28 Nov 2025 14:46:13 +1100
Subject: [PATCH] add test for rolling back

---
 tests/nix/default.nix                     |  1 +
 tests/nix/suite/test_rollback/default.nix | 20 ++++++++++++++++++++
 tests/nix/suite/test_rollback/hive.nix    | 15 +++++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 tests/nix/suite/test_rollback/default.nix
 create mode 100644 tests/nix/suite/test_rollback/hive.nix

diff --git a/tests/nix/default.nix b/tests/nix/default.nix
index b10cc6b..4eb17c9 100644
--- a/tests/nix/default.nix
+++ b/tests/nix/default.nix
@@ -30,6 +30,7 @@ in
     ./suite/test_local_deploy
     ./suite/test_keys
     ./suite/test_stdin
+    ./suite/test_rollback
   ];
   options.wire.testing = mkOption {
     type = attrsOf (
diff --git a/tests/nix/suite/test_rollback/default.nix b/tests/nix/suite/test_rollback/default.nix
new file mode 100644
index 0000000..85d5918
--- /dev/null
+++ b/tests/nix/suite/test_rollback/default.nix
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright 2024-2025 wire Contributors
+
+{
+  wire.testing.test_remote_deploy = {
+    nodes.deployer = {
+      _wire.deployer = true;
+    };
+    nodes.receiver = {
+      _wire.receiver = true;
+    };
+    testScript = ''
+      with subtest("Deploy broken config"):
+        deployer.fail(f"wire apply --on receiver --no-progress --path {TEST_DIR}/hive.nix --no-keys -vvv >&2")
+
+      with subtest("Configuration must revert"):
+        receiver.wait_for_unit("sshd.service")
+    '';
+  };
+}
diff --git a/tests/nix/suite/test_rollback/hive.nix b/tests/nix/suite/test_rollback/hive.nix
new file mode 100644
index 0000000..fef4bb0
--- /dev/null
+++ b/tests/nix/suite/test_rollback/hive.nix
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright 2024-2025 wire Contributors
+
+let
+  inherit (import ../utils.nix { testName = "test_rollback-@IDENT@"; }) makeHive mkHiveNode;
+in
+makeHive {
+  meta.nixpkgs = import <nixpkgs> { localSystem = "x86_64-linux"; };
+
+  receiver = mkHiveNode { hostname = "receiver"; } {
+    environment.etc."identity".text = "first";
+
+    services.openssh.enable = false;
+  };
+}
-- 
2.51.2