these 22 derivations will be built:
  /nix/store/0hh0q2la2ilrj3icbfbmwv72c4ackzvf-nftables-cleanup-deletions.drv
  /nix/store/11nrzy8dc6pvpjjr01ax74arfdjrpmsw-test-script.drv
  /nix/store/znr2fib5pv7vrxhfy9c55r02qdfmln12-nftables-deletions.drv
  /nix/store/25n2wf8ydkvyy43phj1p6s3isizwvy11-nftables-save-deletions.drv
  /nix/store/rplvwdq22pcvxadhv4cblinkb1ds094j-system-path.drv
  /nix/store/rn3g99z18cqwpq3b6mfk0g7m9s28nrjd-dbus-1.drv
  /nix/store/qhn4kz9jjk1l759zala5p9wihdk5rp5f-X-Restart-Triggers-dbus-broker.drv
  /nix/store/rx1zw9v25ylpj4isbg0qmbc869f1zzbh-unit-dbus-broker.service.drv
  /nix/store/gkipw060l5xdy3b4z6867g7gm4k12728-user-units.drv
  /nix/store/a7987km271ns7v53niicbka4mldcb5bb-unit-dbus-broker.service.drv
  /nix/store/4vwl196am36nz1r0j6bqm1hw6zpgq3dw-nftables-ensure-deletions.drv
  /nix/store/xnyk69sxyly2qbm9xd2r2m8wl6qjbsqv-passwd.drv
  /nix/store/icy8zcf2xvivwiq3d576vl29rm0377sc-nftables-rules.drv
  /nix/store/wgsg7niizhvs50kngpql5q9yw0lv5av9-unit-nftables.service.drv
  /nix/store/namskzgni4b86488hrnzji31lpb5mlxm-system-units.drv
  /nix/store/z4d5fmipqqma7kr7i45v17ndnwy99q3a-etc.drv
  /nix/store/yn1vaxwjpa33hp88bjqfibnssbg12ah4-activate.drv
  /nix/store/wfncvh1gpqg0raadmpdi62a44ni7j0gz-nixos-system-machine-test.drv
  /nix/store/s4bj1k0r13vv0k55jjvf7q409vnx1gjw-run-machine-nspawn.drv
  /nix/store/d8b1zizawcra9wpg1yj6g7c15d2fgxx3-driverConfiguration.json.drv
  /nix/store/5d9718ss4zx815kfk56yvy84czw8l7nj-nixos-test-driver-user-firewall-nftables.drv
  /nix/store/3brkhcwkhz9mb84fv25rn1ly0068z3f7-container-test-run-user-firewall-nftables.drv
these 4 paths will be fetched (18.7 MiB download, 53.5 MiB unpacked):
  /nix/store/w7g6j8g4z3jii569vg5mw7v5vhvd5hi3-jansson-2.15.0
  /nix/store/3ra266xfvnj0dkpak4c0cgzpyibf5g9v-libredirect-0
  /nix/store/dciy7h7hlyq06n2f9brylsi1z945w1r2-lkl-2025-11-13-lib
  /nix/store/6nf45s5zbvz14sjifq5jvfnmw747qzsy-nftables-1.1.6
building '/nix/store/11nrzy8dc6pvpjjr01ax74arfdjrpmsw-test-script.drv'
building '/nix/store/0hh0q2la2ilrj3icbfbmwv72c4ackzvf-nftables-cleanup-deletions.drv'
building '/nix/store/4vwl196am36nz1r0j6bqm1hw6zpgq3dw-nftables-ensure-deletions.drv'
building '/nix/store/znr2fib5pv7vrxhfy9c55r02qdfmln12-nftables-deletions.drv'
building '/nix/store/xnyk69sxyly2qbm9xd2r2m8wl6qjbsqv-passwd.drv'
building '/nix/store/25n2wf8ydkvyy43phj1p6s3isizwvy11-nftables-save-deletions.drv'
building '/nix/store/rplvwdq22pcvxadhv4cblinkb1ds094j-system-path.drv'
system-path> structuredAttrs is enabled
building '/nix/store/icy8zcf2xvivwiq3d576vl29rm0377sc-nftables-rules.drv'
system-path> created 1579 symlinks in user environment
building '/nix/store/wgsg7niizhvs50kngpql5q9yw0lv5av9-unit-nftables.service.drv'
unit-nftables.service> structuredAttrs is enabled
building '/nix/store/rn3g99z18cqwpq3b6mfk0g7m9s28nrjd-dbus-1.drv'
building '/nix/store/qhn4kz9jjk1l759zala5p9wihdk5rp5f-X-Restart-Triggers-dbus-broker.drv'
building '/nix/store/a7987km271ns7v53niicbka4mldcb5bb-unit-dbus-broker.service.drv'
building '/nix/store/rx1zw9v25ylpj4isbg0qmbc869f1zzbh-unit-dbus-broker.service.drv'
unit-dbus-broker.service> structuredAttrs is enabled
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/namskzgni4b86488hrnzji31lpb5mlxm-system-units.drv'
building '/nix/store/gkipw060l5xdy3b4z6867g7gm4k12728-user-units.drv'
building '/nix/store/z4d5fmipqqma7kr7i45v17ndnwy99q3a-etc.drv'
building '/nix/store/yn1vaxwjpa33hp88bjqfibnssbg12ah4-activate.drv'
building '/nix/store/wfncvh1gpqg0raadmpdi62a44ni7j0gz-nixos-system-machine-test.drv'
nixos-system-machine-test> structuredAttrs is enabled
building '/nix/store/s4bj1k0r13vv0k55jjvf7q409vnx1gjw-run-machine-nspawn.drv'
building '/nix/store/d8b1zizawcra9wpg1yj6g7c15d2fgxx3-driverConfiguration.json.drv'
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/5d9718ss4zx815kfk56yvy84czw8l7nj-nixos-test-driver-user-firewall-nftables.drv'
nixos-test-driver-user-firewall-nftables> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-user-firewall-nftables> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-user-firewall-nftables> All checks passed!
nixos-test-driver-user-firewall-nftables> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-user-firewall-nftables> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-user-firewall-nftables> All checks passed!
building '/nix/store/3brkhcwkhz9mb84fv25rn1ly0068z3f7-container-test-run-user-firewall-nftables.drv'
container-test-run-user-firewall-nftables> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-user-firewall-nftables> start all VLans
container-test-run-user-firewall-nftables> (finished: start all VLans, in 0.00 seconds)
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> Test will time out and terminate in 3600.0 seconds
container-test-run-user-firewall-nftables> run the VM test script
container-test-run-user-firewall-nftables> additionally exposed symbols:
container-test-run-user-firewall-nftables>     machine, router,
container-test-run-user-firewall-nftables>     vlan1,
container-test-run-user-firewall-nftables>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-user-firewall-nftables> start all VMs
container-test-run-user-firewall-nftables> machine: systemd-nspawn running (pid 52)
container-test-run-user-firewall-nftables> router: systemd-nspawn running (pid 53)
container-test-run-user-firewall-nftables> machine: Waiting for journal at /build/vm-state-machine/var/log/journal...
container-test-run-user-firewall-nftables> router: Waiting for journal at /build/vm-state-router/var/log/journal...
container-test-run-user-firewall-nftables> (finished: start all VMs, in 0.00 seconds)
container-test-run-user-firewall-nftables> router: waiting for unit multi-user.target
container-test-run-user-firewall-nftables> nixos-nspawn(machine): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-user-firewall-nftables> nixos-nspawn(machine): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-user-firewall-nftables> nixos-nspawn(router): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-user-firewall-nftables> nixos-nspawn(router): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-user-firewall-nftables> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-user-firewall-nftables> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-user-firewall-nftables> ░ Spawning container machine on /build/vm-state-machine.
container-test-run-user-firewall-nftables> ░ Spawning container router on /build/vm-state-router.
container-test-run-user-firewall-nftables> machine # [2023917.013025] machine systemd-journald[54]: Journal started
container-test-run-user-firewall-nftables> machine # [2023917.013060] machine systemd-journald[54]: Runtime Journal (/run/log/journal/28d34260173a48ca8053118986c5e28c) is 8M, max 4G, 3.9G free.
container-test-run-user-firewall-nftables> machine # [2023917.014472] machine systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-user-firewall-nftables> machine # [2023917.020079] machine systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-user-firewall-nftables> machine # [2023917.020500] machine systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-user-firewall-nftables> machine # [2023917.025826] machine systemd-journald[54]: Time spent on flushing to /var/log/journal/28d34260173a48ca8053118986c5e28c is 1.172ms for 5 entries.
container-test-run-user-firewall-nftables> machine # [2023917.025826] machine systemd-journald[54]: System Journal (/var/log/journal/28d34260173a48ca8053118986c5e28c) is 512B, max 4G, 3.9G free.
container-test-run-user-firewall-nftables> machine # [2023917.030464] machine systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-user-firewall-nftables> machine # [2023917.030591] machine systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-user-firewall-nftables> router # [2023917.020444] router systemd-journald[54]: Journal started
container-test-run-user-firewall-nftables> machine # [2023917.030640] machine systemd[1]: Reached target Local File Systems.
container-test-run-user-firewall-nftables> router # [2023917.020480] router systemd-journald[54]: Runtime Journal (/run/log/journal/4fd123e124cc4dc48a041c3671b9e7a2) is 8M, max 4G, 3.9G free.
container-test-run-user-firewall-nftables> machine # [2023917.031148] machine systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-user-firewall-nftables> router # [2023917.020922] router systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-user-firewall-nftables> machine # [2023917.031177] machine systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> router # [2023917.026443] router systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-user-firewall-nftables> machine # [2023917.031605] machine systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-user-firewall-nftables> router # [2023917.026910] router systemd[1]: Starting Network Name Resolution...
container-test-run-user-firewall-nftables> machine # [2023917.031622] machine systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-user-firewall-nftables> router # [2023917.027346] router systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-user-firewall-nftables> machine # [2023917.043806] machine systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-user-firewall-nftables> router # [2023917.032548] router systemd-journald[54]: Time spent on flushing to /var/log/journal/4fd123e124cc4dc48a041c3671b9e7a2 is 1.333ms for 6 entries.
container-test-run-user-firewall-nftables> machine # [2023917.044898] machine systemd[1]: Starting Create System Files and Directories...
container-test-run-user-firewall-nftables> router # [2023917.032548] router systemd-journald[54]: System Journal (/var/log/journal/4fd123e124cc4dc48a041c3671b9e7a2) is 512B, max 4G, 3.9G free.
container-test-run-user-firewall-nftables> machine # [2023917.057514] machine systemd-tmpfiles[66]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> router # [2023917.039561] router systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-user-firewall-nftables> machine # [2023917.057719] machine systemd-tmpfiles[66]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> router # [2023917.040098] router systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-user-firewall-nftables> machine # [2023917.057854] machine systemd-tmpfiles[66]: fchmod() of /var/log/journal/28d34260173a48ca8053118986c5e28c failed: Operation not permitted
container-test-run-user-firewall-nftables> router # [2023917.040164] router systemd[1]: Reached target Local File Systems.
container-test-run-user-firewall-nftables> machine # [2023917.058053] machine systemd-tmpfiles[66]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> router # [2023917.040724] router systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-user-firewall-nftables> machine # [2023917.059643] machine systemd[1]: Finished Create System Files and Directories.
container-test-run-user-firewall-nftables> router # [2023917.040756] router systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> machine # [2023917.060392] machine systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-user-firewall-nftables> router # [2023917.041275] router systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-user-firewall-nftables> machine # [2023917.061288] machine systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-user-firewall-nftables> router # [2023917.041296] router systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-user-firewall-nftables> machine # [2023917.070413] machine systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-user-firewall-nftables> router # [2023917.041972] router systemd[1]: Starting Network Management...
container-test-run-user-firewall-nftables> machine # [2023917.079420] machine systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-user-firewall-nftables> router # [2023917.051114] router systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-user-firewall-nftables> machine # [2023917.080129] machine systemd[1]: Starting Update is Completed...
container-test-run-user-firewall-nftables> router # [2023917.052206] router systemd[1]: Starting Create System Files and Directories...
container-test-run-user-firewall-nftables> machine # [2023917.087271] machine systemd[1]: Finished Update is Completed.
container-test-run-user-firewall-nftables> router # [2023917.072291] router systemd-tmpfiles[70]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> machine # [2023917.087390] machine systemd[1]: Reached target System Initialization.
container-test-run-user-firewall-nftables> router # [2023917.072522] router systemd-tmpfiles[70]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> machine # [2023917.087442] machine systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> router # [2023917.072684] router systemd-tmpfiles[70]: fchmod() of /var/log/journal/4fd123e124cc4dc48a041c3671b9e7a2 failed: Operation not permitted
container-test-run-user-firewall-nftables> machine # [2023917.087467] machine systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-user-firewall-nftables> router # [2023917.072937] router systemd-tmpfiles[70]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> machine # [2023917.087482] machine systemd[1]: Reached target Timer Units.
container-test-run-user-firewall-nftables> router # [2023917.074177] router systemd[1]: Finished Create System Files and Directories.
container-test-run-user-firewall-nftables> machine # [2023917.087561] machine systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-user-firewall-nftables> router # [2023917.075093] router systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-user-firewall-nftables> machine # [2023917.087673] machine systemd[1]: Listening on Nix Daemon Socket.
container-test-run-user-firewall-nftables> router # [2023917.075537] router systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-user-firewall-nftables> machine # [2023917.087751] machine systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-user-firewall-nftables> router # [2023917.087415] router systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-user-firewall-nftables> machine # [2023917.087763] machine systemd[1]: Reached target Socket Units.
container-test-run-user-firewall-nftables> router # [2023917.093770] router systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-user-firewall-nftables> machine # [2023917.087787] machine systemd[1]: Reached target Basic System.
container-test-run-user-firewall-nftables> router # [2023917.094488] router systemd[1]: Starting Update is Completed...
container-test-run-user-firewall-nftables> machine # [2023917.088575] machine systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-user-firewall-nftables> router # [2023917.103271] router systemd[1]: Finished Update is Completed.
container-test-run-user-firewall-nftables> machine # [2023917.089113] machine systemd[1]: Starting nftables firewall...
container-test-run-user-firewall-nftables> router # [2023917.247206] router systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-user-firewall-nftables> machine # [2023917.089688] machine systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> machine # [2023917.103455] machine systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-user-firewall-nftables> machine # [2023917.165617] machine nsncd[76]: Aug 27 20:07:07.388 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-user-firewall-nftables> machine # [2023917.166129] machine systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> machine # [2023917.166393] machine systemd[1]: Finished nftables firewall.
container-test-run-user-firewall-nftables> machine # [2023917.166495] machine systemd[1]: Reached target Preparation for Network.
container-test-run-user-firewall-nftables> machine # [2023917.166531] machine systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-user-firewall-nftables> machine # [2023917.166558] machine systemd[1]: Reached target User and Group Name Lookups.
container-test-run-user-firewall-nftables> machine # [2023917.167474] machine systemd[1]: Starting Address configuration of eth1...
container-test-run-user-firewall-nftables> machine # [2023917.167984] machine systemd[1]: Starting Extra networking commands....
container-test-run-user-firewall-nftables> machine # [2023917.168676] machine systemd[1]: Starting Setup wg0 dummy interface...
container-test-run-user-firewall-nftables> machine # [2023917.169271] machine systemd[1]: Starting User Login Management...
container-test-run-user-firewall-nftables> machine # [2023917.180623] machine network-addresses-eth1-start[101]: adding address 192.168.1.1/24... done
container-test-run-user-firewall-nftables> machine # [2023917.181709] machine systemd[1]: Finished Setup wg0 dummy interface.
container-test-run-user-firewall-nftables> machine # [2023917.182475] machine network-addresses-eth1-start[101]: adding address 2001:db8:1::1/64... done
container-test-run-user-firewall-nftables> machine # [2023917.185268] machine systemd[1]: Finished Address configuration of eth1.
container-test-run-user-firewall-nftables> machine # [2023917.222854] machine systemd[1]: Stopped target Host and Network Name Lookups.
container-test-run-user-firewall-nftables> machine # [2023917.222892] machine systemd[1]: Stopping Host and Network Name Lookups...
container-test-run-user-firewall-nftables> machine # [2023917.222921] machine systemd[1]: Stopped target User and Group Name Lookups.
container-test-run-user-firewall-nftables> machine # [2023917.222944] machine systemd[1]: Stopping User and Group Name Lookups...
container-test-run-user-firewall-nftables> machine # [2023917.223077] machine systemd[1]: Stopping Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> machine # [2023917.224902] machine systemd[1]: nscd.service: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [2023917.225056] machine systemd[1]: Stopped Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> machine # [2023917.227181] machine systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> machine # [2023917.247199] machine systemd[1]: Finished Extra networking commands..
container-test-run-user-firewall-nftables> machine # [2023917.247398] machine systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-user-firewall-nftables> machine # [2023917.247883] machine systemd[1]: Reached target Network.
container-test-run-user-firewall-nftables> machine # [2023917.248681] machine systemd[1]: Starting Nginx Web Server...
container-test-run-user-firewall-nftables> machine # [2023917.320099] machine systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> machine # [2023917.320265] machine nsncd[172]: Aug 27 20:07:07.542 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-user-firewall-nftables> machine # [2023917.320166] machine systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-user-firewall-nftables> machine # [2023917.320220] machine systemd[1]: Reached target User and Group Name Lookups.
container-test-run-user-firewall-nftables> machine # [2023917.320910] machine systemd[1]: Starting Permit User Sessions...
container-test-run-user-firewall-nftables> machine # [2023917.352531] machine systemd[1]: Finished Permit User Sessions.
container-test-run-user-firewall-nftables> machine # [2023917.353232] machine systemd[1]: Started Console Getty.
container-test-run-user-firewall-nftables> machine # [2023917.353255] machine systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-user-firewall-nftables> machine # [2023917.353266] machine systemd[1]: Reached target Login Prompts.
container-test-run-user-firewall-nftables> router # [2023917.430278] router systemd-networkd[67]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> router # [2023917.430441] router systemd-networkd[67]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> router # [2023917.439788] router systemd-networkd[67]: lo: Link UP
container-test-run-user-firewall-nftables> router # [2023917.439792] router systemd-networkd[67]: lo: Gained carrier
container-test-run-user-firewall-nftables> router # [2023917.440168] router systemd-networkd[67]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-user-firewall-nftables> router # [2023917.440748] router systemd[1]: Started Network Management.
container-test-run-user-firewall-nftables> router # [2023917.440853] router systemd-networkd[67]: eth1: Link UP
container-test-run-user-firewall-nftables> router # [2023917.441111] router systemd-networkd[67]: eth1: Gained carrier
container-test-run-user-firewall-nftables> router # [2023917.441531] router systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-user-firewall-nftables> router # [2023917.469653] router systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-user-firewall-nftables> router # [2023917.701926] router systemd-resolved[61]: Positive Trust Anchors:
container-test-run-user-firewall-nftables> router # [2023917.701955] router systemd-resolved[61]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-user-firewall-nftables> router # [2023917.701959] router systemd-resolved[61]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-user-firewall-nftables> router # [2023917.701979] router systemd-resolved[61]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-user-firewall-nftables> router # [2023917.717152] router systemd-resolved[61]: Using system hostname 'router'.
container-test-run-user-firewall-nftables> router # [2023917.718504] router systemd[1]: Started Network Name Resolution.
container-test-run-user-firewall-nftables> router # [2023917.718562] router systemd[1]: Reached target Network.
container-test-run-user-firewall-nftables> router # [2023917.718605] router systemd[1]: Reached target System Initialization.
container-test-run-user-firewall-nftables> router # [2023917.718641] router systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> router # [2023917.718662] router systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-user-firewall-nftables> router # [2023917.718675] router systemd[1]: Reached target Timer Units.
container-test-run-user-firewall-nftables> router # [2023917.718770] router systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-user-firewall-nftables> router # [2023917.718896] router systemd[1]: Listening on Nix Daemon Socket.
container-test-run-user-firewall-nftables> router # [2023917.718985] router systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-user-firewall-nftables> router # [2023917.718998] router systemd[1]: Reached target Socket Units.
container-test-run-user-firewall-nftables> router # [2023917.719048] router systemd[1]: Reached target Basic System.
container-test-run-user-firewall-nftables> router # [2023917.719829] router systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-user-firewall-nftables> router # [2023917.720419] router systemd[1]: Starting Nginx Web Server...
container-test-run-user-firewall-nftables> router # [2023917.720973] router systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> router # [2023917.721998] router systemd[1]: Starting D-Bus System Message Bus...
container-test-run-user-firewall-nftables> router # [2023917.751131] router systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-user-firewall-nftables> router # [2023917.839528] router nsncd[84]: Aug 27 20:07:08.062 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-user-firewall-nftables> router # [2023917.839599] router systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> router # [2023917.839666] router systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-user-firewall-nftables> router # [2023917.839715] router systemd[1]: Reached target User and Group Name Lookups.
container-test-run-user-firewall-nftables> router # [2023917.840644] router systemd[1]: Starting User Login Management...
container-test-run-user-firewall-nftables> router # [2023917.841062] router systemd[1]: Starting Permit User Sessions...
container-test-run-user-firewall-nftables> router # [2023917.865726] router systemd[1]: Finished Permit User Sessions.
container-test-run-user-firewall-nftables> router # [2023917.866270] router systemd[1]: Started Console Getty.
container-test-run-user-firewall-nftables> router # [2023917.866295] router systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-user-firewall-nftables> router # [2023917.866310] router systemd[1]: Reached target Login Prompts.
container-test-run-user-firewall-nftables> router # [2023917.914541] router dbus-broker-launch[85]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-user-firewall-nftables> router # [2023917.915169] router dbus-broker-launch[85]: NSS returned no entry for 'systemd-timesync'
container-test-run-user-firewall-nftables> router # [2023917.915169] router dbus-broker-launch[85]: Invalid user-name in /nix/store/xjqr1rr6dvby76rk5bqpdpxpi2kcc01c-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-user-firewall-nftables> router # [2023917.915683] router systemd[1]: Started D-Bus System Message Bus.
container-test-run-user-firewall-nftables> router # [2023917.920134] router dbus-broker-launch[85]: Ready
container-test-run-user-firewall-nftables> machine # [2023917.584549] machine systemd-logind[104]: New seat seat0.
container-test-run-user-firewall-nftables> machine # [2023917.585613] machine systemd[1]: Starting D-Bus System Message Bus...
container-test-run-user-firewall-nftables> machine # [2023917.585712] machine systemd[1]: Started User Login Management.
container-test-run-user-firewall-nftables> machine # [2023917.586359] machine systemd[1]: Starting linger-users.service...
container-test-run-user-firewall-nftables> machine # [2023917.620735] machine systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [2023917.620914] machine systemd[1]: Finished linger-users.service.
container-test-run-user-firewall-nftables> machine # [2023917.723221] machine nginx-pre-start[203]: nginx: the configuration file /nix/store/pn78ibz0jl5fciqc1jh9cq8k3m729427-nginx.conf syntax is ok
container-test-run-user-firewall-nftables> machine # [2023917.723573] machine nginx-pre-start[203]: nginx: configuration file /nix/store/pn78ibz0jl5fciqc1jh9cq8k3m729427-nginx.conf test is successful
container-test-run-user-firewall-nftables> machine # [2023917.740284] machine systemd[1]: Started Nginx Web Server.
container-test-run-user-firewall-nftables> machine # [2023917.740418] machine systemd[1]: Reached target Multi-User System.
container-test-run-user-firewall-nftables> machine # [2023917.766906] machine dbus-broker-launch[199]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-user-firewall-nftables> machine # [2023917.767306] machine dbus-broker-launch[199]: NSS returned no entry for 'systemd-timesync'
container-test-run-user-firewall-nftables> machine # [2023917.767306] machine dbus-broker-launch[199]: Invalid user-name in /nix/store/kl71d502bzsaq92wh7d3dfq1fxkrw64p-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-user-firewall-nftables> machine # [2023917.767692] machine systemd[1]: Started D-Bus System Message Bus.
container-test-run-user-firewall-nftables> machine # [2023917.767860] machine systemd[1]: Startup finished in 1.049s.
container-test-run-user-firewall-nftables> machine # [2023917.772282] machine dbus-broker-launch[199]: Ready
container-test-run-user-firewall-nftables> machine # [2023918.005240] machine systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-user-firewall-nftables> router # [2023918.011947] router systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-user-firewall-nftables> router # [2023918.219947] router nginx-pre-start[114]: nginx: the configuration file /nix/store/0v75lyzd1xza7xgrwxmaakdh2509cqgb-nginx.conf syntax is ok
container-test-run-user-firewall-nftables> router # [2023918.220513] router nginx-pre-start[114]: nginx: configuration file /nix/store/0v75lyzd1xza7xgrwxmaakdh2509cqgb-nginx.conf test is successful
container-test-run-user-firewall-nftables> router # [2023918.224022] router systemd[1]: Started Nginx Web Server.
container-test-run-user-firewall-nftables> router: (finished: waiting for unit multi-user.target, in 2.15 seconds)
container-test-run-user-firewall-nftables> router: waiting for TCP port 80 on localhost
container-test-run-user-firewall-nftables> router # [2023918.275215] router systemd-logind[103]: New seat seat0.
container-test-run-user-firewall-nftables> router # [2023918.275357] router systemd[1]: Started User Login Management.
container-test-run-user-firewall-nftables> router # [2023918.276307] router systemd[1]: Starting linger-users.service...
container-test-run-user-firewall-nftables> router # [2023918.307256] router systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-user-firewall-nftables> router # [2023918.307500] router systemd[1]: Finished linger-users.service.
container-test-run-user-firewall-nftables> router # [2023918.307747] router systemd[1]: Reached target Multi-User System.
container-test-run-user-firewall-nftables> router # [2023918.307853] router systemd[1]: Startup finished in 1.594s.
container-test-run-user-firewall-nftables> router # [2023918.517121] router systemd-networkd[67]: eth1: Gained IPv6LL
container-test-run-user-firewall-nftables> Connection to localhost (::1) 80 port [tcp/http] succeeded!
container-test-run-user-firewall-nftables> router: (finished: waiting for TCP port 80 on localhost, in 1.03 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit multi-user.target
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit multi-user.target, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit nginx.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit nginx.service, in 0.02 seconds)
container-test-run-user-firewall-nftables> router: must succeed: ip -4 addr show eth1 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'
container-test-run-user-firewall-nftables> router: (finished: must succeed: ip -4 addr show eth1 | grep -oP '(?<=inet\s)\d+(\.\d+){3}', in 0.01 seconds)
container-test-run-user-firewall-nftables> router: must succeed: ip -6 addr show eth1 | grep -oP '(?<=inet6\s)[0-9a-f:]+' | grep -v '^fe80' | head -1
container-test-run-user-firewall-nftables> router: (finished: must succeed: ip -6 addr show eth1 | grep -oP '(?<=inet6\s)[0-9a-f:]+' | grep -v '^fe80' | head -1, in 0.03 seconds)
container-test-run-user-firewall-nftables> Router IPv4: 192.168.1.2
container-test-run-user-firewall-nftables> Router IPv6: 2001:db8:1::2
container-test-run-user-firewall-nftables> machine: must succeed: systemctl restart nftables
container-test-run-user-firewall-nftables> machine: (finished: must succeed: systemctl restart nftables, in 0.16 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit nftables.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit nftables.service, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: nft list table inet user-firewall >&2
container-test-run-user-firewall-nftables> table inet user-firewall {
container-test-run-user-firewall-nftables> 	chain output {
container-test-run-user-firewall-nftables> 		type filter hook output priority filter; policy accept;
container-test-run-user-firewall-nftables> 		oifname "lo" counter packets 0 bytes 0 accept comment "allow lo"
container-test-run-user-firewall-nftables> 		oifname "tun*" counter packets 0 bytes 0 accept comment "allow tun*"
container-test-run-user-firewall-nftables> 		oifname "tap*" counter packets 0 bytes 0 accept comment "allow tap*"
container-test-run-user-firewall-nftables> 		oifname "wg*" counter packets 0 bytes 0 accept comment "allow wg*"
container-test-run-user-firewall-nftables> 		oifname "tailscale*" counter packets 0 bytes 0 accept comment "allow tailscale*"
container-test-run-user-firewall-nftables> 		oifname "zt*" counter packets 0 bytes 0 accept comment "allow zt*"
container-test-run-user-firewall-nftables> 		oifname "vpn*" counter packets 0 bytes 0 accept comment "allow vpn*"
container-test-run-user-firewall-nftables> 		oifname "ipsec*" counter packets 0 bytes 0 accept comment "allow ipsec*"
container-test-run-user-firewall-nftables> 		oifname "nebula*" counter packets 0 bytes 0 accept comment "allow nebula*"
container-test-run-user-firewall-nftables> 		oifname "tinc*" counter packets 0 bytes 0 accept comment "allow tinc*"
container-test-run-user-firewall-nftables> 		oifname "edge*" counter packets 0 bytes 0 accept comment "allow edge*"
container-test-run-user-firewall-nftables> 		oifname "hyprspace" counter packets 0 bytes 0 accept comment "allow hyprspace"
container-test-run-user-firewall-nftables> 		oifname "ham0" counter packets 0 bytes 0 accept comment "allow ham0"
container-test-run-user-firewall-nftables> 		oifname "easytier" counter packets 0 bytes 0 accept comment "allow easytier"
container-test-run-user-firewall-nftables> 		oifname "mycelium" counter packets 0 bytes 0 accept comment "allow mycelium"
container-test-run-user-firewall-nftables> 		meta skuid 1002 counter packets 0 bytes 0 reject comment "blocked user bob"
container-test-run-user-firewall-nftables> 	}
container-test-run-user-firewall-nftables> }
container-test-run-user-firewall-nftables> machine: (finished: must succeed: nft list table inet user-firewall >&2, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080
container-test-run-user-firewall-nftables> machine: (finished: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080, in 0.03 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s http://192.168.1.2
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s http://192.168.1.2, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s http://[2001:db8:1::2]
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s http://[2001:db8:1::2], in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s http://127.0.0.1:8080
container-test-run-user-firewall-nftables> machine # [2023919.658743] machine systemd[1]: Stopping nftables firewall...
container-test-run-user-firewall-nftables> machine # [2023919.755087] machine systemd[1]: nftables.service: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [2023919.755290] machine systemd[1]: Stopped nftables firewall.
container-test-run-user-firewall-nftables> machine # [2023919.756221] machine systemd[1]: Starting nftables firewall...
container-test-run-user-firewall-nftables> machine # [2023919.807824] machine systemd[1]: Finished nftables firewall.
container-test-run-user-firewall-nftables> machine # [2023919.850959] machine runuser[235]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [2023919.860203] machine runuser[235]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [2023919.876469] machine runuser[237]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [2023919.884900] machine runuser[237]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [2023919.895956] machine runuser[239]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [2023919.906714] machine runuser[239]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s http://127.0.0.1:8080, in 0.03 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://192.168.1.2 2>&1 || echo 'EXIT_CODE='$?
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://192.168.1.2 2>&1 || echo 'EXIT_CODE='$?, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://[2001:db8:1::2] 2>&1 || echo 'EXIT_CODE='$?
container-test-run-user-firewall-nftables> machine # [2023919.927298] machine runuser[241]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine # [2023919.935608] machine runuser[241]: pam_unix(runuser:session): session closed for user bob
container-test-run-user-firewall-nftables> machine # [2023919.946759] machine runuser[244]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine # [2023919.956264] machine runuser[244]: pam_unix(runuser:session): session closed for user bob
container-test-run-user-firewall-nftables> machine # [2023919.966749] machine runuser[247]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://[2001:db8:1::2] 2>&1 || echo 'EXIT_CODE='$?, in 1.06 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: nft list table inet user-firewall
container-test-run-user-firewall-nftables> machine: (finished: must succeed: nft list table inet user-firewall, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit setup-wg0-interface.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit setup-wg0-interface.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit nginx.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit nginx.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for TCP port 8081 on 10.100.0.2
container-test-run-user-firewall-nftables> Connection to 10.100.0.2 8081 port [tcp/sunproxyadmin] succeeded!
container-test-run-user-firewall-nftables> machine: (finished: waiting for TCP port 8081 on 10.100.0.2, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: ip link show wg0
container-test-run-user-firewall-nftables> machine: (finished: must succeed: ip link show wg0, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: ip addr show wg0
container-test-run-user-firewall-nftables> machine: (finished: must succeed: ip addr show wg0, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s --interface wg0 http://10.100.0.2:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s --interface wg0 http://10.100.0.2:8081/, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s --interface wg0 http://[fd00::2]:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s --interface wg0 http://[fd00::2]:8081/, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --interface wg0 http://10.100.0.2:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --interface wg0 http://10.100.0.2:8081/, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --interface wg0 http://[fd00::2]:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --interface wg0 http://[fd00::2]:8081/, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: nft list table inet user-firewall | grep -E 'oifname.*wg' >&2
container-test-run-user-firewall-nftables> 		oifname "wg*" counter packets 0 bytes 0 accept comment "allow wg*"
container-test-run-user-firewall-nftables> machine: (finished: must succeed: nft list table inet user-firewall | grep -E 'oifname.*wg' >&2, in 0.01 seconds)
container-test-run-user-firewall-nftables> (finished: run the VM test script, in 4.73 seconds)
container-test-run-user-firewall-nftables> test script finished in 4.79s
container-test-run-user-firewall-nftables> cleanup
container-test-run-user-firewall-nftables> kill NspawnMachine (pid 52)
container-test-run-user-firewall-nftables> kill NspawnMachine (pid 53)
container-test-run-user-firewall-nftables> Container machine terminated by signal KILL.
container-test-run-user-firewall-nftables> Container router terminated by signal KILL.
container-test-run-user-firewall-nftables> (finished: cleanup, in 0.18 seconds)

post-build step Upload to niks3: ok
time=2026-08-27T20:07:11.909Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)"
time=2026-08-27T20:07:12.728Z level=INFO msg="Uploading 1 narinfos"
time=2026-08-27T20:07:13.018Z level=INFO msg="Upload complete. (1.172s)"