feat(zfs): add declarative management for ZFS datasets and integration tests

tests/zfs_integration.py

@@ -0,0 +1,56 @@
+# The NixOS test driver provides these globals at runtime.
+# ruff: noqa: F821
+
+import tomllib
+from pathlib import Path
+
+snapshot_config_path = Path("@snapshot_config@")
+
+machine.start()
+machine.wait_for_unit("multi-user.target")
+machine.wait_for_unit("zfs_manager.service")
+
+with subtest("zfs_manager creates parents before children"):
+    machine.succeed("zfs list testpool/parent")
+    machine.succeed("zfs list testpool/parent/child")
+    machine.succeed("zfs list testpool/secure/child")
+
+with subtest("declared properties are reconciled"):
+    machine.succeed('test "$(zfs get -H -o value atime testpool)" = off')
+    machine.succeed('test "$(zfs get -H -o value compression testpool)" = lz4')
+    machine.succeed('test "$(zfs get -H -o value recordsize testpool/parent/child)" = 16K')
+    machine.succeed('test "$(zfs get -H -o value sync testpool/parent/child)" = disabled')
+
+    machine.succeed("zfs set sync=standard testpool/parent/child")
+    machine.succeed("systemctl restart zfs_manager.service")
+    machine.succeed('test "$(zfs get -H -o value sync testpool/parent/child)" = disabled')
+
+with subtest("externally created encryption roots are verified"):
+    machine.succeed('test "$(zfs get -H -o value encryption testpool/secure)" = aes-256-gcm')
+    machine.succeed('test "$(zfs get -H -o value keyformat testpool/secure)" = hex')
+    machine.succeed('test "$(zfs get -H -o value encryption testpool/secure/child)" = aes-256-gcm')
+
+with subtest("declared datasets inherit default snapshot retention"):
+    with snapshot_config_path.open("rb") as config_file:
+        snapshot_config = tomllib.load(config_file)
+
+    expected_default = {"15_min": 2, "hourly": 2, "daily": 2, "monthly": 2}
+    assert snapshot_config["default"] == expected_default
+    assert snapshot_config["testpool/parent"] == expected_default
+    assert snapshot_config["testpool/secure/child"] == expected_default
+    assert snapshot_config["testpool/secure"] == {
+        "15_min": 0,
+        "hourly": 0,
+        "daily": 0,
+        "monthly": 0,
+    }
+
+with subtest("snapshot deletion failures fail the systemd service"):
+    machine.succeed("zfs snapshot testpool/parent/child@auto_200001010015")
+    machine.succeed("zfs clone testpool/parent/child@auto_200001010015 testpool/dependent-clone")
+    machine.succeed("zfs snapshot testpool/parent/child@auto_200001010030")
+
+    machine.fail("systemctl start snapshot_manager.service")
+    machine.succeed("systemctl is-failed --quiet snapshot_manager.service")
+    machine.succeed("journalctl -u snapshot_manager.service --no-pager | grep -q 'snapshot has dependent clones'")
+    machine.fail("zfs list -H -t snapshot -o name | grep -q '^testpool/secure@auto_'")