diff --git a/nixos/lib/testing.nix b/nixos/lib/testing.nix
new file mode 100644
index 0000000000000000000000000000000000000000..de68dc1f92060912bcc4f7781501e5d36bd49b89
--- /dev/null
+++ b/nixos/lib/testing.nix
@@ -0,0 +1,23 @@
+{
+
+  /* Returns a string that runs tests from the Python code at the given path.
+
+     The Python code is loaded using *execfile* and the *test* global it
+     defines is called with the given keyword arguments.
+
+     Type: makeTestScript :: Path -> AttrSet -> String
+
+     Example:
+       testScript = (makeTestScript ./test_foo.py { x = "y"; });
+  */
+  makeTestScript = { testpath, kwargs ? {} }:
+    ''
+    # The driver runs pyflakes on this script before letting it
+    # run... Convince pyflakes that there is a `test` name.
+    test = None
+    with open("${testpath}") as testfile:
+        exec(testfile.read(), globals())
+    # For simple types, JSON is compatible with Python syntax!
+    test(**${builtins.toJSON kwargs})
+    '';
+}
diff --git a/nixos/tests/tahoe.nix b/nixos/tests/tahoe.nix
index e39fd6d3fcb776e8e5215bb1264e08e2b7306c1f..da6c5ee18246bceeb3921377bd6875489354ac70 100644
--- a/nixos/tests/tahoe.nix
+++ b/nixos/tests/tahoe.nix
@@ -1,5 +1,7 @@
-{ ... }:
-  {
+let
+  makeTestScript = (import ../lib/testing.nix).makeTestScript;
+in
+{
   nodes = {
     storage = { config, pkgs, ourpkgs, ... }: {
       imports = [
@@ -23,50 +25,7 @@
       };
     };
   };
-  testScript = ''
-  start_all()
-
-  # After the service starts, destroy the "created" marker to force it to
-  # re-create its internal state.
-  storage.wait_for_open_port(4001)
-  storage.succeed("systemctl stop tahoe.storage")
-  storage.succeed("rm /var/db/tahoe-lafs/storage.created")
-  storage.succeed("systemctl start tahoe.storage")
-
-  # After it starts up again, verify it has consistent internal state and a
-  # backup of the prior state.
-  storage.wait_for_open_port(4001)
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage ]")
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage.created ]")
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage.1 ]")
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage.1/private/node.privkey ]")
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage.1/private/node.pem ]")
-  storage.succeed("[ ! -e /var/db/tahoe-lafs/storage.2 ]")
-
-  # Stop it again, once again destroy the "created" marker, and this time also
-  # jam some partial state in the way that will need cleanup.
-  storage.succeed("systemctl stop tahoe.storage")
-  storage.succeed("rm /var/db/tahoe-lafs/storage.created")
-  storage.succeed("mkdir -p /var/db/tahoe-lafs/storage.atomic/partial")
-  try:
-    storage.succeed("systemctl start tahoe.storage")
-  except:
-    x, y = storage.execute("journalctl -u tahoe.storage")
-    storage.log(y)
-    raise
-
-  # After it starts up again, verify it has consistent internal state and
-  # backups of the prior two states.  It also has no copy of the inconsistent
-  # state because it could never have been used.
-  storage.wait_for_open_port(4001)
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage ]")
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage.created ]")
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage.1 ]")
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage.2 ]")
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage.2/private/node.privkey ]")
-  storage.succeed("[ -e /var/db/tahoe-lafs/storage.2/private/node.pem ]")
-  storage.succeed("[ ! -e /var/db/tahoe-lafs/storage.atomic ]")
-  storage.succeed("[ ! -e /var/db/tahoe-lafs/storage/partial ]")
-  storage.succeed("[ ! -e /var/db/tahoe-lafs/storage.3 ]")
-  '';
+  testScript = makeTestScript {
+    testpath = ./test_tahoe.py;
+  };
 }
diff --git a/nixos/tests/test_tahoe.py b/nixos/tests/test_tahoe.py
new file mode 100644
index 0000000000000000000000000000000000000000..c5190c78b04cb2cc59b5275e45869dd53e0e81c3
--- /dev/null
+++ b/nixos/tests/test_tahoe.py
@@ -0,0 +1,45 @@
+def test():
+    start_all()
+
+    # After the service starts, destroy the "created" marker to force it to
+    # re-create its internal state.
+    storage.wait_for_open_port(4001)
+    storage.succeed("systemctl stop tahoe.storage")
+    storage.succeed("rm /var/db/tahoe-lafs/storage.created")
+    storage.succeed("systemctl start tahoe.storage")
+
+    # After it starts up again, verify it has consistent internal state and a
+    # backup of the prior state.
+    storage.wait_for_open_port(4001)
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage ]")
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage.created ]")
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage.1 ]")
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage.1/private/node.privkey ]")
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage.1/private/node.pem ]")
+    storage.succeed("[ ! -e /var/db/tahoe-lafs/storage.2 ]")
+
+    # Stop it again, once again destroy the "created" marker, and this time also
+    # jam some partial state in the way that will need cleanup.
+    storage.succeed("systemctl stop tahoe.storage")
+    storage.succeed("rm /var/db/tahoe-lafs/storage.created")
+    storage.succeed("mkdir -p /var/db/tahoe-lafs/storage.atomic/partial")
+    try:
+        storage.succeed("systemctl start tahoe.storage")
+    except:
+        x, y = storage.execute("journalctl -u tahoe.storage")
+        storage.log(y)
+        raise
+
+    # After it starts up again, verify it has consistent internal state and
+    # backups of the prior two states.  It also has no copy of the inconsistent
+    # state because it could never have been used.
+    storage.wait_for_open_port(4001)
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage ]")
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage.created ]")
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage.1 ]")
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage.2 ]")
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage.2/private/node.privkey ]")
+    storage.succeed("[ -e /var/db/tahoe-lafs/storage.2/private/node.pem ]")
+    storage.succeed("[ ! -e /var/db/tahoe-lafs/storage.atomic ]")
+    storage.succeed("[ ! -e /var/db/tahoe-lafs/storage/partial ]")
+    storage.succeed("[ ! -e /var/db/tahoe-lafs/storage.3 ]")