these 18 derivations will be built:
  /nix/store/jl29dv1rwjz4rywxlfv0ckb7yc0z7jlg-system-path.drv
  /nix/store/aydwq8vghyh9s84q3g7afjmjl2lfp7fb-dbus-1.drv
  /nix/store/i2rc28c2gwnvabh7w6x5fapglir3bxj1-X-Restart-Triggers-dbus-broker.drv
  /nix/store/fjg7w781wqicz2dgsydl4ijz7a6wbsjs-unit-dbus-broker.service.drv
  /nix/store/8kchpbfddq5sl56x5l0f7nk6d77wi04z-system-units.drv
  /nix/store/867pjzm1w8gczjx3f86xmjqaridmypys-unit-dbus-broker.service.drv
  /nix/store/n185zr01z4dsg1f217zpx0jsh3jlhnir-user-units.drv
  /nix/store/74kkzkx2z5nfh656pdcvx71ff64yx6pg-etc.drv
  /nix/store/2698nyc0mqv53qzs1wg9fy1qkq7wanjz-activate.drv
  /nix/store/r1dx5wknigs5r4w3da5i5rr29k4zxnrm-nixos-system-machine-test.drv
  /nix/store/1can4wjz5zqj1myim379g7k980v5r3ar-closure-info.drv
  /nix/store/qd5j6nig7aw81byqclrcz1bck1yygyl6-system-units.drv
  /nix/store/wg6rlp2nm8894v0zd3wwpk6jn58vy04s-etc.drv
  /nix/store/nczpw9y752d7lf1b8qa4i57pdy8zk17c-activate.drv
  /nix/store/qji2ni5zdzb58bgbxxmjfy2apyi4s7kb-nixos-system-router-test.drv
  /nix/store/hwyfm4z42j62qpbp5rjg5z7k98asqw9g-closure-info.drv
  /nix/store/8llbjqzfn0ifs28dg6h0wf3y0bdyz1qx-nixos-test-driver-user-firewall-nftables.drv
  /nix/store/0kzipp1k8v4bw4gylvxnjbsaf4jhmdq5-container-test-run-user-firewall-nftables.drv
building '/nix/store/jl29dv1rwjz4rywxlfv0ckb7yc0z7jlg-system-path.drv'
system-path> structuredAttrs is enabled
system-path> created 1669 symlinks in user environment
building '/nix/store/aydwq8vghyh9s84q3g7afjmjl2lfp7fb-dbus-1.drv'
building '/nix/store/i2rc28c2gwnvabh7w6x5fapglir3bxj1-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/867pjzm1w8gczjx3f86xmjqaridmypys-unit-dbus-broker.service.drv'
building '/nix/store/fjg7w781wqicz2dgsydl4ijz7a6wbsjs-unit-dbus-broker.service.drv'
building '/nix/store/n185zr01z4dsg1f217zpx0jsh3jlhnir-user-units.drv'
building '/nix/store/8kchpbfddq5sl56x5l0f7nk6d77wi04z-system-units.drv'
building '/nix/store/74kkzkx2z5nfh656pdcvx71ff64yx6pg-etc.drv'
building '/nix/store/2698nyc0mqv53qzs1wg9fy1qkq7wanjz-activate.drv'
building '/nix/store/r1dx5wknigs5r4w3da5i5rr29k4zxnrm-nixos-system-machine-test.drv'
nixos-system-machine-test> structuredAttrs is enabled
building '/nix/store/1can4wjz5zqj1myim379g7k980v5r3ar-closure-info.drv'
closure-info> structuredAttrs is enabled
building '/nix/store/hwyfm4z42j62qpbp5rjg5z7k98asqw9g-closure-info.drv'
closure-info> structuredAttrs is enabled
building '/nix/store/8llbjqzfn0ifs28dg6h0wf3y0bdyz1qx-nixos-test-driver-user-firewall-nftables.drv'
nixos-test-driver-user-firewall-nftables> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-user-firewall-nftables> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-user-firewall-nftables> Success: no issues found in 1 source file
building '/nix/store/0kzipp1k8v4bw4gylvxnjbsaf4jhmdq5-container-test-run-user-firewall-nftables.drv' on 'ssh-ng://builder@build-x86-01.clan.lol'
building '/nix/store/0kzipp1k8v4bw4gylvxnjbsaf4jhmdq5-container-test-run-user-firewall-nftables.drv'
container-test-run-user-firewall-nftables> additionally exposed symbols:
container-test-run-user-firewall-nftables>     machine, router,
container-test-run-user-firewall-nftables>     start_all, machines, driver, Machine, wait_for_signal
container-test-run-user-firewall-nftables> Starting machine
container-test-run-user-firewall-nftables> Starting router
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> <<< NixOS Stage 2 >>>
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> booting system configuration /nix/store/89s45s75s7743c42pv8va31fqd9p1zyb-nixos-system-machine-test
container-test-run-user-firewall-nftables> running activation script...
container-test-run-user-firewall-nftables> setting up /etc...
container-test-run-user-firewall-nftables> 2: host0@if3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
container-test-run-user-firewall-nftables>     link/ether 0e:74:26:22:81:c2 brd ff:ff:ff:ff:ff:ff link-netnsid 0
container-test-run-user-firewall-nftables> starting systemd...
container-test-run-user-firewall-nftables> systemd 260.2 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)
container-test-run-user-firewall-nftables> Detected virtualization systemd-nspawn.
container-test-run-user-firewall-nftables> Detected architecture x86-64.
container-test-run-user-firewall-nftables> Detected first boot.
container-test-run-user-firewall-nftables> Initializing machine ID from container UUID.
container-test-run-user-firewall-nftables> Applying preset policy.
container-test-run-user-firewall-nftables> Populated /etc with preset unit settings.
container-test-run-user-firewall-nftables> Queued start job for default target Multi-User System.
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> <<< Welcome to NixOS test (x86_64) - console >>>
container-test-run-user-firewall-nftables> + systemd-run /bin/sh -c '/nix/store/mhv491ysr5xqajfipq4r18wcqhjw4smz-coreutils-9.11/bin/sleep 999999999 && echo a9ecd9f4-0d83-42e1-8542-e878e97f7c74'
container-test-run-user-firewall-nftables> Running as unit: run-p225-i68110812.service; invocation ID: 649d4fb137fd46d4b45cc59dbba64bbc
container-test-run-user-firewall-nftables> To attach to container machine run on the same machine that runs the test:
container-test-run-user-firewall-nftables>   sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*a9ecd9f4-0d83-42e1-8542-e878e97f7c74') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> To inject external network and continue test, run:
container-test-run-user-firewall-nftables> sudo /nix/store/kxdkzc079hlg9ifg4lhjvyi2w7qwpshx-python3-3.13.14/bin/python3.13 /nix/store/2mpsgxkix8jnd10l3xpq0aqfx6h4dd5k-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py a9ecd9f4-0d83-42e1-8542-e878e97f7c74
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> <<< NixOS Stage 2 >>>
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> booting system configuration /nix/store/490kv0an61h5n3syn6i8rhz07w0s8hjf-nixos-system-router-test
container-test-run-user-firewall-nftables> running activation script...
container-test-run-user-firewall-nftables> setting up /etc...
container-test-run-user-firewall-nftables> 2: host0@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
container-test-run-user-firewall-nftables>     link/ether a6:24:31:fe:b9:6d brd ff:ff:ff:ff:ff:ff link-netnsid 0
container-test-run-user-firewall-nftables> starting systemd...
container-test-run-user-firewall-nftables> systemd 260.2 running in system mode (+PAM +AUDIT -SELINUX +APPARMOR +IMA +IPE +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +LIBARCHIVE)
container-test-run-user-firewall-nftables> Detected virtualization systemd-nspawn.
container-test-run-user-firewall-nftables> Detected architecture x86-64.
container-test-run-user-firewall-nftables> Detected first boot.
container-test-run-user-firewall-nftables> Initializing machine ID from container UUID.
container-test-run-user-firewall-nftables> Applying preset policy.
container-test-run-user-firewall-nftables> Populated /etc with preset unit settings.
container-test-run-user-firewall-nftables> Queued start job for default target Multi-User System.
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> <<< Welcome to NixOS test (x86_64) - console >>>
container-test-run-user-firewall-nftables> + systemd-run /bin/sh -c '/nix/store/mhv491ysr5xqajfipq4r18wcqhjw4smz-coreutils-9.11/bin/sleep 999999999 && echo 808549e9-4dfc-40b1-915c-3f2858366b6b'
container-test-run-user-firewall-nftables> Running as unit: run-p209-i68110816.service; invocation ID: cb268f278e6e486f81c7b1b4749d7ed7
container-test-run-user-firewall-nftables> To attach to container router run on the same machine that runs the test:
container-test-run-user-firewall-nftables>   sudo nsenter --user --target $(\pgrep -f '^/bin/sh.*808549e9-4dfc-40b1-915c-3f2858366b6b') --mount --uts --ipc --net --pid --cgroup /bin/sh -c bash 
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> To inject external network and continue test, run:
container-test-run-user-firewall-nftables> sudo /nix/store/kxdkzc079hlg9ifg4lhjvyi2w7qwpshx-python3-3.13.14/bin/python3.13 /nix/store/2mpsgxkix8jnd10l3xpq0aqfx6h4dd5k-test-driver-0.0.1/lib/python3.13/site-packages/test_driver/inject_network.py 808549e9-4dfc-40b1-915c-3f2858366b6b
container-test-run-user-firewall-nftables> + systemctl --no-pager show multi-user.target
container-test-run-user-firewall-nftables> + systemctl --no-pager show nginx.service
container-test-run-user-firewall-nftables> + systemctl --no-pager show multi-user.target
container-test-run-user-firewall-nftables> + systemctl --no-pager show nginx.service
container-test-run-user-firewall-nftables> + ip -4 addr show eth1
container-test-run-user-firewall-nftables> + grep -oP '(?<=inet\s)\d+(\.\d+){3}'
container-test-run-user-firewall-nftables> + ip -6 addr show eth1
container-test-run-user-firewall-nftables> + grep -oP '(?<=inet6\s)[0-9a-f:]+'
container-test-run-user-firewall-nftables> + grep -v '^fe80'
container-test-run-user-firewall-nftables> + head -1
container-test-run-user-firewall-nftables> Router IPv4: 192.168.1.2
container-test-run-user-firewall-nftables> Router IPv6: 2001:db8:1::2
container-test-run-user-firewall-nftables> + systemctl restart nftables
container-test-run-user-firewall-nftables> + systemctl --no-pager show nftables.service
container-test-run-user-firewall-nftables> + nft list table inet user-firewall
container-test-run-user-firewall-nftables> table inet user-firewall {
container-test-run-user-firewall-nftables> 	chain output {
container-test-run-user-firewall-nftables> 		type filter hook output priority filter; policy accept;
container-test-run-user-firewall-nftables> 		oifname "lo" counter packets 0 bytes 0 accept comment "allow lo"
container-test-run-user-firewall-nftables> 		oifname "tun*" counter packets 0 bytes 0 accept comment "allow tun*"
container-test-run-user-firewall-nftables> 		oifname "tap*" counter packets 0 bytes 0 accept comment "allow tap*"
container-test-run-user-firewall-nftables> 		oifname "wg*" counter packets 0 bytes 0 accept comment "allow wg*"
container-test-run-user-firewall-nftables> 		oifname "tailscale*" counter packets 0 bytes 0 accept comment "allow tailscale*"
container-test-run-user-firewall-nftables> 		oifname "zt*" counter packets 0 bytes 0 accept comment "allow zt*"
container-test-run-user-firewall-nftables> 		oifname "vpn*" counter packets 0 bytes 0 accept comment "allow vpn*"
container-test-run-user-firewall-nftables> 		oifname "ipsec*" counter packets 0 bytes 0 accept comment "allow ipsec*"
container-test-run-user-firewall-nftables> 		oifname "nebula*" counter packets 0 bytes 0 accept comment "allow nebula*"
container-test-run-user-firewall-nftables> 		oifname "tinc*" counter packets 0 bytes 0 accept comment "allow tinc*"
container-test-run-user-firewall-nftables> 		oifname "edge*" counter packets 0 bytes 0 accept comment "allow edge*"
container-test-run-user-firewall-nftables> 		oifname "hyprspace" counter packets 0 bytes 0 accept comment "allow hyprspace"
container-test-run-user-firewall-nftables> 		oifname "ham0" counter packets 0 bytes 0 accept comment "allow ham0"
container-test-run-user-firewall-nftables> 		oifname "easytier" counter packets 0 bytes 0 accept comment "allow easytier"
container-test-run-user-firewall-nftables> 		oifname "mycelium" counter packets 0 bytes 0 accept comment "allow mycelium"
container-test-run-user-firewall-nftables> 		meta skuid 1002 counter packets 0 bytes 0 reject comment "blocked user bob"
container-test-run-user-firewall-nftables> 	}
container-test-run-user-firewall-nftables> }
container-test-run-user-firewall-nftables> machine: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080
container-test-run-user-firewall-nftables> + runuser -u alice -- curl -s http://127.0.0.1:8080
container-test-run-user-firewall-nftables> (finished: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080, in 0.01 seconds)
container-test-run-user-firewall-nftables> + runuser -u alice -- curl -s http://192.168.1.2
container-test-run-user-firewall-nftables> + runuser -u alice -- curl -s 'http://[2001:db8:1::2]'
container-test-run-user-firewall-nftables> + runuser -u bob -- curl -s http://127.0.0.1:8080
container-test-run-user-firewall-nftables> + runuser -u bob -- curl -s --connect-timeout 2 http://192.168.1.2
container-test-run-user-firewall-nftables> + echo EXIT_CODE=7
container-test-run-user-firewall-nftables> + runuser -u bob -- curl -s --connect-timeout 2 'http://[2001:db8:1::2]'
container-test-run-user-firewall-nftables> + echo EXIT_CODE=7
container-test-run-user-firewall-nftables> + nft list table inet user-firewall
container-test-run-user-firewall-nftables> + systemctl --no-pager show setup-wg0-interface.service
container-test-run-user-firewall-nftables> + systemctl --no-pager show nginx.service
container-test-run-user-firewall-nftables> machine: waiting for success: nc -z 10.100.0.2 8081
container-test-run-user-firewall-nftables> + nc -z 10.100.0.2 8081
container-test-run-user-firewall-nftables> Connection to 10.100.0.2 8081 port [tcp/sunproxyadmin] succeeded!
container-test-run-user-firewall-nftables> (finished: waiting for success: nc -z 10.100.0.2 8081, in 0.01 seconds)
container-test-run-user-firewall-nftables> + ip link show wg0
container-test-run-user-firewall-nftables> + ip addr show wg0
container-test-run-user-firewall-nftables> + runuser -u alice -- curl -s --interface wg0 http://10.100.0.2:8081/
container-test-run-user-firewall-nftables> + runuser -u alice -- curl -s --interface wg0 'http://[fd00::2]:8081/'
container-test-run-user-firewall-nftables> + runuser -u bob -- curl -s --interface wg0 http://10.100.0.2:8081/
container-test-run-user-firewall-nftables> + runuser -u bob -- curl -s --interface wg0 'http://[fd00::2]:8081/'
container-test-run-user-firewall-nftables> + nft list table inet user-firewall
container-test-run-user-firewall-nftables> + grep -E 'oifname.*wg'
container-test-run-user-firewall-nftables> 		oifname "wg*" counter packets 0 bytes 0 accept comment "allow wg*"
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> 

post-build step Upload to niks3: ok
time=2026-08-10T10:17:03.710Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)"
time=2026-08-10T10:17:12.435Z level=WARN msg="Request returned retryable status, retrying" attempt=1 max_attempts=6 backoff=100ms status=500 url="https://s3.eu-central-003.backblazeb2.com/clan-cache-geninf/log/0kzipp1k8v4bw4gylvxnjbsaf4jhmdq5-container-test-run-user-firewall-nftables.drv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=003eaae730241090000000009%2F20260810%2Feu-central-003%2Fs3%2Faws4_request&X-Amz-Date=20260810T101703Z&X-Amz-Expires=18000&X-Amz-SignedHeaders=host&X-Amz-Signature=efcaaf1f38128e5c87a52bc602b7e58b036fe6104c91b453c26a2f55bec384ed"
time=2026-08-10T10:17:12.742Z level=INFO msg="Uploading 1 narinfos"
time=2026-08-10T10:17:12.850Z level=INFO msg="Upload complete. (9.206s)"