nixos/all-tests.nix: Add readOnlyPkgs module

nixos/lib/testing/nodes.nix

@@ -17,6 +17,7 @@ let
               virtualisation.qemu.package = testModuleArgs.config.qemu.package;
             })
           ({
+            key = "nodes.nix-pkgs";
             config = {
               # Ensure we do not use aliases. Ideally this is only set
               # when the test framework is used by Nixpkgs NixOS tests.

nixos/tests/all-tests.nix

@@ -65,6 +65,27 @@ let
     runTestOn
     ;
 
+  # Using a single instance of nixpkgs makes test evaluation faster.
+  # To make sure we don't accidentally depend on a modified pkgs, we make the
+  # related options read-only. We need to test the right configuration.
+  #
+  # If your service depends on a nixpkgs setting, first try to avoid that, but
+  # otherwise, you can remove the readOnlyPkgs import and test your service as
+  # usual.
+  readOnlyPkgs =
+    # TODO: We currently accept this for nixosTests, so that the `pkgs` argument
+    #       is consistent with `pkgs` in `pkgs.nixosTests`. Can we reinitialize
+    #       it with `allowAliases = false`?
+    # warnIf pkgs.config.allowAliases "nixosTests: pkgs includes aliases."
+    {
+      _class = "nixosTest";
+      defaults = {
+        nixpkgs.pkgs = pkgs;
+        imports = [ ../modules/misc/nixpkgs/read-only.nix ];
+        disabledModules = [{ key = "nodes.nix-pkgs"; }];
+      };
+    };
+
 in {
 
   # Testing the test driver