these 29 derivations will be built: /nix/store/99r2m7lpnf4sqnf0dg1f8d1in55g0k33-nss-cacert-3.126.drv /nix/store/kkz0c8h0l4m7s1sb9x17iylvzxsqd24p-unit-nix-daemon.service.drv /nix/store/1cdk80pj6cg4mw5g81hlm82vrvq3rnih-system-units.drv /nix/store/358raw0d8bacilkak497r2brqjc09adi-decrypt-age-secrets.drv /nix/store/8b7hgqzjvfyan38z2bkdifdavrxbksba-dry-activate.drv /nix/store/n3irlsmyc6086p15jpfgn753vlw5bcs8-ca.json.drv /nix/store/i5jzp27164jg4hk05xbz5qa10bqpifi4-X-Restart-Triggers-step-ca.drv /nix/store/ajf0qhs5h93mrbw4i1dgkdkprhdqvk6k-unit-step-ca.service.drv /nix/store/q5nvwva2flaazksvcn2zarskvsjzasj5-nginx.conf.drv /nix/store/yy6jm0g4rzcb3hrhwma2dh2zvww7bwfa-unit-script-nginx-pre-start.drv /nix/store/kc7b7v5qg62pyrgl4h9572i2kr26fajg-unit-nginx.service.drv /nix/store/3814ab2ls04pi3g6f93rvhgfhvr1f223-system-units.drv /nix/store/zv02cj8za4r7bvjyc4wq85hrkx0ww5im-etc.drv /nix/store/n60g029f88f3b8yf77d6jwwrwcc1ba73-activate.drv /nix/store/212r4f0r7xabr1qvc4qqxmzkrj64hkmx-nixos-system-ca-test.drv /nix/store/b9yiz2k0gkk8kf2yis6cna4f3q0nd8v3-test-script.drv /nix/store/f4p4vm5ybrafsb9ir0vjjfq1k4lws534-system-units.drv /nix/store/hjnjkq6i738xz9aqykm243n1dlan5kjd-etc.drv /nix/store/8mkykh190ha2pn766cd44qkk9a90h12k-activate.drv /nix/store/hmf1f7f8qgikzfp28lvgdycjrvamdxx0-nixos-system-server-test.drv /nix/store/83a33y7rmi2k1hcc5mc03nnwxzcwibxz-run-server-nspawn.drv /nix/store/aac1sbjj805ixq37x3qc2gmfb7a4h3kq-etc.drv /nix/store/niqdpr4b4p7iw3zjvbzbmbravgh2y3nd-activate.drv /nix/store/cndxgnwid8zlk0h0xnc9m4fql4rgiif7-nixos-system-client-test.drv /nix/store/hwzr8i9ahq3vq3jch3c3bxp8f7jvxj6n-run-client-nspawn.drv /nix/store/ksy4v7g2b6lhkyvpizlzar2wrjr2rckv-run-ca-nspawn.drv /nix/store/h4as66ckr4nfj0hi65cm26smzpmscgra-driverConfiguration.json.drv /nix/store/3dgimwnyfifm6y4qg7b39djrdavqh77i-nixos-test-driver-certificates.drv /nix/store/p2j2pllmhin9zzpimiki634mwz8kxf38-container-test-run-certificates.drv this path will be fetched (0.0 KiB download, 2.6 KiB unpacked): /nix/store/rfzh9mm3gm7dgcw1bpig5dpjmd6931jm-dry-activate building '/nix/store/b9yiz2k0gkk8kf2yis6cna4f3q0nd8v3-test-script.drv' building '/nix/store/q5nvwva2flaazksvcn2zarskvsjzasj5-nginx.conf.drv' test-script> structuredAttrs is enabled nginx.conf> structuredAttrs is enabled building '/nix/store/99r2m7lpnf4sqnf0dg1f8d1in55g0k33-nss-cacert-3.126.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' building '/nix/store/n3irlsmyc6086p15jpfgn753vlw5bcs8-ca.json.drv' building '/nix/store/358raw0d8bacilkak497r2brqjc09adi-decrypt-age-secrets.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' ca.json> structuredAttrs is enabled nginx.conf> nginx.conf> ==================== Results =================== nginx.conf> No issues found. nginx.conf> nginx.conf> ==================== Summary =================== nginx.conf> Total issues: nginx.conf> Unspecified: 0 nginx.conf> Low: 0 nginx.conf> Medium: 0 nginx.conf> High: 0 nginx.conf> building '/nix/store/i5jzp27164jg4hk05xbz5qa10bqpifi4-X-Restart-Triggers-step-ca.drv' building '/nix/store/yy6jm0g4rzcb3hrhwma2dh2zvww7bwfa-unit-script-nginx-pre-start.drv' X-Restart-Triggers-step-ca> structuredAttrs is enabled building '/nix/store/ajf0qhs5h93mrbw4i1dgkdkprhdqvk6k-unit-step-ca.service.drv' unit-script-nginx-pre-start> structuredAttrs is enabled building '/nix/store/kc7b7v5qg62pyrgl4h9572i2kr26fajg-unit-nginx.service.drv' unit-step-ca.service> structuredAttrs is enabled unit-nginx.service> structuredAttrs is enabled building '/nix/store/99r2m7lpnf4sqnf0dg1f8d1in55g0k33-nss-cacert-3.126.drv' nss-cacert-3.126> structuredAttrs is enabled nss-cacert-3.126> Running phase: unpackPhase nss-cacert-3.126> Running phase: patchPhase nss-cacert-3.126> Running phase: updateAutotoolsGnuConfigScriptsPhase nss-cacert-3.126> Running phase: configurePhase nss-cacert-3.126> no configure script, doing nothing nss-cacert-3.126> Running phase: buildPhase building '/nix/store/358raw0d8bacilkak497r2brqjc09adi-decrypt-age-secrets.drv' decrypt-age-secrets> structuredAttrs is enabled building '/nix/store/8b7hgqzjvfyan38z2bkdifdavrxbksba-dry-activate.drv' dry-activate> structuredAttrs is enabled nss-cacert-3.126> Running phase: installPhase nss-cacert-3.126> Running phase: fixupPhase nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/nrfh8amm3daxlrgbkpq3hk36l9nr9z1g-nss-cacert-3.126-p11kit nss-cacert-3.126> checking for references to /build/ in /nix/store/nrfh8amm3daxlrgbkpq3hk36l9nr9z1g-nss-cacert-3.126-p11kit... nss-cacert-3.126> patching script interpreter paths in /nix/store/nrfh8amm3daxlrgbkpq3hk36l9nr9z1g-nss-cacert-3.126-p11kit nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/kqrbws09c7v12gn19cq14i7nf1kjj43i-nss-cacert-3.126-hashed nss-cacert-3.126> checking for references to /build/ in /nix/store/kqrbws09c7v12gn19cq14i7nf1kjj43i-nss-cacert-3.126-hashed... nss-cacert-3.126> patching script interpreter paths in /nix/store/kqrbws09c7v12gn19cq14i7nf1kjj43i-nss-cacert-3.126-hashed nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/9claz779jjn2brsmrbdvac0nmw7250ay-nss-cacert-3.126 nss-cacert-3.126> checking for references to /build/ in /nix/store/9claz779jjn2brsmrbdvac0nmw7250ay-nss-cacert-3.126... nss-cacert-3.126> patching script interpreter paths in /nix/store/9claz779jjn2brsmrbdvac0nmw7250ay-nss-cacert-3.126 nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/skv6cy5m99g6jwm1a1gkifhs1nzwyxr6-nss-cacert-3.126-unbundled nss-cacert-3.126> checking for references to /build/ in /nix/store/skv6cy5m99g6jwm1a1gkifhs1nzwyxr6-nss-cacert-3.126-unbundled... nss-cacert-3.126> patching script interpreter paths in /nix/store/skv6cy5m99g6jwm1a1gkifhs1nzwyxr6-nss-cacert-3.126-unbundled building '/nix/store/kkz0c8h0l4m7s1sb9x17iylvzxsqd24p-unit-nix-daemon.service.drv' unit-nix-daemon.service> structuredAttrs is enabled building '/nix/store/1cdk80pj6cg4mw5g81hlm82vrvq3rnih-system-units.drv' building '/nix/store/3814ab2ls04pi3g6f93rvhgfhvr1f223-system-units.drv' building '/nix/store/f4p4vm5ybrafsb9ir0vjjfq1k4lws534-system-units.drv' building '/nix/store/aac1sbjj805ixq37x3qc2gmfb7a4h3kq-etc.drv' building '/nix/store/hjnjkq6i738xz9aqykm243n1dlan5kjd-etc.drv' building '/nix/store/zv02cj8za4r7bvjyc4wq85hrkx0ww5im-etc.drv' building '/nix/store/niqdpr4b4p7iw3zjvbzbmbravgh2y3nd-activate.drv' building '/nix/store/8mkykh190ha2pn766cd44qkk9a90h12k-activate.drv' building '/nix/store/n60g029f88f3b8yf77d6jwwrwcc1ba73-activate.drv' activate> structuredAttrs is enabled activate> structuredAttrs is enabled building '/nix/store/cndxgnwid8zlk0h0xnc9m4fql4rgiif7-nixos-system-client-test.drv' building '/nix/store/hmf1f7f8qgikzfp28lvgdycjrvamdxx0-nixos-system-server-test.drv' activate> structuredAttrs is enabled nixos-system-client-test> structuredAttrs is enabled building '/nix/store/212r4f0r7xabr1qvc4qqxmzkrj64hkmx-nixos-system-ca-test.drv' nixos-system-server-test> structuredAttrs is enabled nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/ksy4v7g2b6lhkyvpizlzar2wrjr2rckv-run-ca-nspawn.drv' building '/nix/store/hwzr8i9ahq3vq3jch3c3bxp8f7jvxj6n-run-client-nspawn.drv' building '/nix/store/83a33y7rmi2k1hcc5mc03nnwxzcwibxz-run-server-nspawn.drv' building '/nix/store/h4as66ckr4nfj0hi65cm26smzpmscgra-driverConfiguration.json.drv' driverConfiguration.json> structuredAttrs is enabled building '/nix/store/3dgimwnyfifm6y4qg7b39djrdavqh77i-nixos-test-driver-certificates.drv' nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/p2j2pllmhin9zzpimiki634mwz8kxf38-container-test-run-certificates.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' building '/nix/store/p2j2pllmhin9zzpimiki634mwz8kxf38-container-test-run-certificates.drv' container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # [1426161.350474] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [1426161.350505] ca systemd-journald[81]: Runtime Journal (/run/log/journal/f8a00b227b71410c84f1daa32cee492a) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> ca # [1426161.369923] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [1426161.384184] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [1426161.397612] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [1426161.397990] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [1426161.398382] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [1426161.420178] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/f8a00b227b71410c84f1daa32cee492a is 1.203ms for 7 entries. container-test-run-certificates> ca # [1426161.420178] ca systemd-journald[81]: System Journal (/var/log/journal/f8a00b227b71410c84f1daa32cee492a) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [1426161.450854] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [1426161.453578] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [1426161.454985] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [1426161.455067] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [1426161.455116] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [1426161.455762] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [1426161.455914] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [1426161.455946] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1426161.456651] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [1426161.456679] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [1426161.474215] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [1426161.474716] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [1426161.475693] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [1426161.535905] ca systemd-tmpfiles[191]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [1426161.536112] ca systemd-tmpfiles[191]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1426161.536241] ca systemd-tmpfiles[191]: fchmod() of /var/log/journal/f8a00b227b71410c84f1daa32cee492a failed: Operation not permitted container-test-run-certificates> ca # [1426161.536442] ca systemd-tmpfiles[191]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1426161.541361] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [1426161.542540] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [1426161.543019] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [1426161.552206] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [1426161.561681] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [1426161.562441] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [1426161.568865] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [1426163.255965] ca systemd-networkd[189]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1426163.256093] ca systemd-networkd[189]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1426163.266774] ca systemd-networkd[189]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1426163.266977] ca systemd-networkd[189]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1426163.267098] ca systemd-networkd[189]: lo: Link UP container-test-run-certificates> ca # [1426163.267102] ca systemd-networkd[189]: lo: Gained carrier container-test-run-certificates> ca # [1426163.267266] ca systemd-networkd[189]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [1426163.267565] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [1426163.267605] ca systemd-networkd[189]: eth1: Link UP container-test-run-certificates> ca # [1426163.267760] ca systemd-networkd[189]: eth1: Gained carrier container-test-run-certificates> ca # [1426163.269148] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [1426163.302852] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [1426164.313923] ca systemd-resolved[142]: Positive Trust Anchors: container-test-run-certificates> ca # [1426164.313933] ca systemd-resolved[142]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [1426164.313937] ca systemd-resolved[142]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [1426164.313954] ca systemd-resolved[142]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [1426164.326367] ca systemd-resolved[142]: Using system hostname 'ca'. container-test-run-certificates> ca # [1426164.327394] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [1426164.327453] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [1426164.327486] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [1426164.327515] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [1426164.377726] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [1426164.377758] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1426164.377775] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [1426164.377789] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [1426164.377876] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [1426164.377940] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [1426164.378020] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [1426164.378030] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [1426164.378051] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [1426164.378780] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [1426164.379127] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [1426164.379145] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [1426164.379512] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [1426164.380062] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [1426164.380716] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [1426164.427196] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [1426164.948406] ca acme-setup-privileged[203]: + set -euo pipefail container-test-run-certificates> ca # [1426164.948406] ca acme-setup-privileged[203]: + cd /var/lib/acme container-test-run-certificates> ca # [1426164.948406] ca acme-setup-privileged[203]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [1426164.949285] ca acme-setup-privileged[203]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [1426164.950150] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1426164.950182] ca acme-setup-privileged[203]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [1426164.950182] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1426164.950182] ca acme-setup-privileged[203]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [1426165.040077] ca nsncd[205]: Sep 20 19:26:19.463 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [1426165.040197] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [1426165.040268] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [1426165.040313] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [1426165.041278] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [1426165.041706] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [1426165.060472] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [1426165.061163] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [1426165.061195] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [1426165.061207] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [1426165.185110] ca systemd-networkd[189]: eth1: Gained IPv6LL container-test-run-certificates> ca # [1426165.325539] ca dbus-broker-launch[207]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [1426165.326574] ca dbus-broker-launch[207]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [1426165.326574] ca dbus-broker-launch[207]: Invalid user-name in /nix/store/1rsbjj3vkxs9pmkbvvj5g7ldfs54i9d8-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [1426165.326877] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [1426165.330586] ca dbus-broker-launch[207]: Ready container-test-run-certificates> ca # [1426166.903884] ca systemd-logind[237]: New seat seat0. container-test-run-certificates> ca # [1426166.904101] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [1426166.905324] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [1426166.941805] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [1426166.941996] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [1426166.992578] ca acme-setup-start[221]: + set -euo pipefail container-test-run-certificates> ca # [1426166.992578] ca acme-setup-start[221]: + test -e ca/key.pem container-test-run-certificates> ca # [1426166.992578] ca acme-setup-start[221]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [1426167.001425] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [1426167.002696] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [1426167.405542] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [1426167.406846] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [1426170.195038] ca step-ca[206]: badger 2026/09/20 19:26:24 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [1426170.199483] ca step-ca[206]: 2026/09/20 19:26:24 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [1426170.202600] ca step-ca[206]: 2026/09/20 19:26:24 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [1426170.202600] ca step-ca[206]: 2026/09/20 19:26:24 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [1426170.202600] ca step-ca[206]: 2026/09/20 19:26:24 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [1426170.202600] ca step-ca[206]: 2026/09/20 19:26:24 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [1426170.202600] ca step-ca[206]: 2026/09/20 19:26:24 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [1426170.202600] ca step-ca[206]: 2026/09/20 19:26:24 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [1426170.202774] ca step-ca[206]: 2026/09/20 19:26:24 X.509 Root Fingerprint: 5dc23c6b276e245eee744bc1d0ea4ff380a715296096efc77d4615e642575ee6 container-test-run-certificates> ca # [1426170.202852] ca step-ca[206]: 2026/09/20 19:26:24 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [1426170.287561] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca: still waiting for container 'ca' to reach ready state... container-test-run-certificates> ca # [1426174.358489] ca acme-ca.foo-start[258]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1426174.360390] ca acme-ca.foo-start[258]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [1426174.360390] ca acme-ca.foo-start[258]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [1426174.372029] ca acme-ca.foo-start[285]: + cd ca.foo container-test-run-certificates> ca # [1426174.372029] ca acme-ca.foo-start[285]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [1426174.373216] ca acme-ca.foo-start[286]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [1426174.373440] ca acme-ca.foo-start[285]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [1426174.374598] ca acme-ca.foo-start[285]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [1426174.374853] ca acme-ca.foo-start[258]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [1426174.375983] ca acme-ca.foo-start[258]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [1426174.376909] ca acme-ca.foo-start[258]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1426174.377808] ca acme-ca.foo-start[258]: + for fixpath in out certificates container-test-run-certificates> ca # [1426174.377863] ca acme-ca.foo-start[258]: + '[' -d out ']' container-test-run-certificates> ca # [1426174.377863] ca acme-ca.foo-start[258]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1426174.378789] ca acme-ca.foo-start[258]: + chown -R acme:nginx out container-test-run-certificates> ca # [1426174.380624] ca acme-ca.foo-start[258]: + for fixpath in out certificates container-test-run-certificates> ca # [1426174.380624] ca acme-ca.foo-start[258]: + '[' -d certificates ']' container-test-run-certificates> ca # [1426174.388750] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [1426174.390085] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [1426176.012355] ca nginx-pre-start[297]: nginx: the configuration file /nix/store/spbgk0wfc0j1pxz00y5s4gkbz78w4xxd-nginx.conf syntax is ok container-test-run-certificates> ca # [1426176.012697] ca nginx-pre-start[297]: nginx: configuration file /nix/store/spbgk0wfc0j1pxz00y5s4gkbz78w4xxd-nginx.conf test is successful container-test-run-certificates> ca # [1426176.017866] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [1426176.018271] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [1426176.019177] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [1426178.198321] ca acme-order-renew-ca.foo-start[300]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1426178.199774] ca acme-order-renew-ca.foo-start[300]: + set -euo pipefail container-test-run-certificates> ca # [1426178.199815] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [1426178.199850] ca acme-order-renew-ca.foo-start[300]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [1426178.200423] ca acme-order-renew-ca.foo-start[311]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [1426178.201827] ca acme-order-renew-ca.foo-start[300]: + '[' -n '' ']' container-test-run-certificates> ca # [1426178.201864] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [1426178.201880] ca acme-order-renew-ca.foo-start[300]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [1426178.201904] ca acme-order-renew-ca.foo-start[300]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [1426178.214243] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.637555686Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [1426178.228622] ca step-ca[206]: time="2026-09-20T19:26:32Z" level=info duration="133.101µs" duration-ns=133101 fields.time="2026-09-20T19:26:32Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=0ca6c2e9-caac-4d88-8482-2c03f0d989dc response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426178.228912] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.652173179Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [1426178.232982] ca step-ca[206]: time="2026-09-20T19:26:32Z" level=info duration=3.972443ms duration-ns=3972443 fields.time="2026-09-20T19:26:32Z" method=HEAD name=ca nonce=VGlqbHlRYlJnRlJLUXJxclVGMUJtMGdaTHFKS1cxbGo path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=8e15bded-77de-431a-b6da-8f8bc2e5ba19 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426178.234937] ca step-ca[206]: time="2026-09-20T19:26:32Z" level=info duration=1.482973ms duration-ns=1482973 fields.time="2026-09-20T19:26:32Z" method=POST name=ca nonce=QzNSMkliYjAwT1M3Z0RINWRhYm45ektqeE1zc01KM1Y path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=ceac6375-72f7-41bf-a06f-ac3c18d4c52e response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/DCePLxvuY7mjwxSLmT0EVS0SduBtC24k/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426178.235140] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.658464760Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [1426178.235140] ca acme-order-renew-ca.foo-start[312]: Your account credentials have been saved in your container-test-run-certificates> ca # [1426178.235140] ca acme-order-renew-ca.foo-start[312]: configuration directory at "accounts". container-test-run-certificates> ca # [1426178.235140] ca acme-order-renew-ca.foo-start[312]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [1426178.235140] ca acme-order-renew-ca.foo-start[312]: configuration directory will also contain private keys container-test-run-certificates> ca # [1426178.235140] ca acme-order-renew-ca.foo-start[312]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [1426178.235140] ca acme-order-renew-ca.foo-start[312]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [1426178.235312] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.658541945Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [1426178.237832] ca step-ca[206]: time="2026-09-20T19:26:32Z" level=info duration=2.371156ms duration-ns=2371156 fields.time="2026-09-20T19:26:32Z" method=POST name=ca nonce=MTZnRVdOalVodXZ4TzNHajkzTnBmMTl5RFpzejBKaWQ path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1041045b-c757-42a2-bc64-5327fac359c3 response="{\"id\":\"hWF5N29FEHmpze6l1lid4tfXDrnXOpq3\",\"status\":\"pending\",\"expires\":\"2026-09-21T19:26:32Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-20T19:25:32Z\",\"notAfter\":\"2026-12-19T19:26:32Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/Tc4C4sZyT02Om9CPscl7EXfHwb7yZK91\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/hWF5N29FEHmpze6l1lid4tfXDrnXOpq3/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426178.296385] ca step-ca[206]: time="2026-09-20T19:26:32Z" level=info duration=1.670407ms duration-ns=1670407 fields.time="2026-09-20T19:26:32Z" method=POST name=ca nonce=Q1pIb0FyYUYwUHNtbE1TV1JoRGZQYU9zeWFPTTRXY2w path=/acme/acme/authz/Tc4C4sZyT02Om9CPscl7EXfHwb7yZK91 protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=546c6910-fba3-4451-bd3f-da57f6af2ad7 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"D3iZO2MeIrm7AzyxlLHswskvTm2nTkZa\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Tc4C4sZyT02Om9CPscl7EXfHwb7yZK91/p5E50l3LFakmI4dFtupOJ5O7Y6Ahh1ns\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"D3iZO2MeIrm7AzyxlLHswskvTm2nTkZa\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Tc4C4sZyT02Om9CPscl7EXfHwb7yZK91/iUpuXGxzWRAchIxBzAi3nxNwKcivWvDl\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"D3iZO2MeIrm7AzyxlLHswskvTm2nTkZa\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Tc4C4sZyT02Om9CPscl7EXfHwb7yZK91/X4qFsZTu6uc3SaMywtrnlC9nD9hgjaqj\"}],\"wildcard\":false,\"expires\":\"2026-09-21T19:26:32Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426178.296632] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.719952065Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [1426178.296678] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.719973445Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [1426178.299392] ca step-ca[206]: time="2026-09-20T19:26:32Z" level=info duration=2.40499ms duration-ns=2404990 fields.time="2026-09-20T19:26:32Z" method=POST name=ca nonce=cmd0Q0t1N2k3T3lmWUdLak9Eekg3TDdTOVROZTA0VDU path=/acme/acme/challenge/Tc4C4sZyT02Om9CPscl7EXfHwb7yZK91/iUpuXGxzWRAchIxBzAi3nxNwKcivWvDl protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=be34fcef-c3a2-4a55-9b68-d3d21a186a19 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"D3iZO2MeIrm7AzyxlLHswskvTm2nTkZa\",\"validated\":\"2026-09-20T19:26:32Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Tc4C4sZyT02Om9CPscl7EXfHwb7yZK91/iUpuXGxzWRAchIxBzAi3nxNwKcivWvDl\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426178.299603] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.722925976Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [1426178.299657] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.722991239Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [1426178.302649] ca step-ca[206]: time="2026-09-20T19:26:32Z" level=info duration=2.53746ms duration-ns=2537460 fields.time="2026-09-20T19:26:32Z" method=POST name=ca nonce=ajF2MndBNXNxdm9VcUFiWUUycjlMWEpsNjEzS0NRQTk path=/acme/acme/order/hWF5N29FEHmpze6l1lid4tfXDrnXOpq3/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=42356ace-3f95-4bc1-918c-2fb7017150b2 response="{\"id\":\"hWF5N29FEHmpze6l1lid4tfXDrnXOpq3\",\"status\":\"valid\",\"expires\":\"2026-09-21T19:26:32Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-20T19:25:32Z\",\"notAfter\":\"2026-12-19T19:26:32Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/Tc4C4sZyT02Om9CPscl7EXfHwb7yZK91\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/hWF5N29FEHmpze6l1lid4tfXDrnXOpq3/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/mXNx5qp3VvlQbjQLeL1TAMTG3jHeclCh\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426178.303589] ca step-ca[206]: time="2026-09-20T19:26:32Z" level=info certificate="MIIB1TCCAXqgAwIBAgIRALb38QmRqsxAPT3OD4ED+ikwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTIwMTkyNTMyWhcNMjYxMjE5MTkyNjMyWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT0hwOcwXE3BX7t1J1iXL1iTYP0QawfjioMIxW248hwG9LZmXSmUBM8W0IA1V40SO90Wu/0yCCBUMT1Ny/Mb97lo4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFK7yPGy+VnJ9zi+2EKWHhfUP1jzPMB8GA1UdIwQYMBaAFN0447gEBVVXnGq7a1nW/QKR0+e3MBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSQAwRgIhAJc5jJD9EJV5rbS+yqYY1dBCuLoOVO8MzKIJaFNK6GqiAiEAnbMj1QbthRonm9nyF5aE5bJbkjmmDVsxSORT0GBQ0t4=" duration="589.771µs" duration-ns=589771 fields.time="2026-09-20T19:26:32Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=WHlNSU1ROVFlU1lLampRbGdaSVFHOEJ3dWJpVHh2THQ path=/acme/acme/certificate/mXNx5qp3VvlQbjQLeL1TAMTG3jHeclCh protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=e4afb56a-2fd8-4272-a46b-95f8b0765be5 sans="map[dns:[ca.foo]]" serial=243206881375762542334887685019501066793 size=1344 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= valid-from="2026-09-20T19:25:32Z" valid-to="2026-12-19T19:26:32Z" container-test-run-certificates> ca # [1426178.303728] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.727053861Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [1426178.303767] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.727100990Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [1426178.303848] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.727181592Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [1426178.303876] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.727211829Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [1426178.303942] ca acme-order-renew-ca.foo-start[312]: 2026-09-20T19:26:32.727277082Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [1426178.307725] ca acme-order-renew-ca.foo-start[300]: + touch out/acme-success container-test-run-certificates> ca # [1426178.308825] ca acme-order-renew-ca.foo-start[300]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1426178.309493] ca acme-order-renew-ca.foo-start[300]: + touch out/renewed container-test-run-certificates> ca # [1426178.310741] ca acme-order-renew-ca.foo-start[300]: + echo Installing new certificate container-test-run-certificates> ca # [1426178.310776] ca acme-order-renew-ca.foo-start[300]: Installing new certificate container-test-run-certificates> ca # [1426178.310776] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1426178.311910] ca acme-order-renew-ca.foo-start[332]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [1426178.312196] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [1426178.313146] ca acme-order-renew-ca.foo-start[333]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [1426178.313341] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [1426178.314325] ca acme-order-renew-ca.foo-start[334]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [1426178.314524] ca acme-order-renew-ca.foo-start[300]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [1426178.315829] ca acme-order-renew-ca.foo-start[300]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1426178.316841] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [1426178.316841] ca acme-order-renew-ca.foo-start[300]: + '[' -d out ']' container-test-run-certificates> ca # [1426178.316878] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1426178.317757] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx out container-test-run-certificates> ca # [1426178.319454] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [1426178.319454] ca acme-order-renew-ca.foo-start[300]: + '[' -d certificates ']' container-test-run-certificates> ca # [1426178.319503] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [1426178.320458] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [1426178.322689] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [1426178.758521] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [1426178.764940] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [1426178.779185] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [1426178.779441] ca systemd[1]: acme-order-renew-ca.foo.service: Consumed 1.386s CPU time over 2.745s wall clock time. container-test-run-certificates> ca: still waiting for container 'ca' to reach ready state... container-test-run-certificates> ca # [1426181.983955] ca nginx[350]: nginx: the configuration file /nix/store/spbgk0wfc0j1pxz00y5s4gkbz78w4xxd-nginx.conf syntax is ok container-test-run-certificates> ca # [1426181.984346] ca nginx[350]: nginx: configuration file /nix/store/spbgk0wfc0j1pxz00y5s4gkbz78w4xxd-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 22.65 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [1426183.238133] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [1426183.238895] ca systemd[1]: Startup finished in 22.283s. container-test-run-certificates> ca # [1426183.277496] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [1426183.349367] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [1426183.349543] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [1426183.349565] ca systemd[1]: nginx.service: Consumed 4.472s CPU time over 8.959s wall clock time. container-test-run-certificates> ca # [1426183.352053] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.90 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 443) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 446) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ca # [1426184.166436] ca nginx-pre-start[374]: nginx: the configuration file /nix/store/spbgk0wfc0j1pxz00y5s4gkbz78w4xxd-nginx.conf syntax is ok container-test-run-certificates> ca # [1426184.166790] ca nginx-pre-start[374]: nginx: configuration file /nix/store/spbgk0wfc0j1pxz00y5s4gkbz78w4xxd-nginx.conf test is successful container-test-run-certificates> ca # [1426184.169586] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [1426184.717607] server systemd-journald[72]: Journal started container-test-run-certificates> server # [1426184.717634] server systemd-journald[72]: Runtime Journal (/run/log/journal/8ddd482d3eae4f8cb03a2fe9b236bf07) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [1426184.728388] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [1426184.736782] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [1426184.710080] client systemd-journald[72]: Journal started container-test-run-certificates> server # [1426184.758580] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [1426184.710114] client systemd-journald[72]: Runtime Journal (/run/log/journal/0ec0aa8fc2af4ff6ac28715ab4b38774) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [1426184.759533] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [1426184.720614] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [1426184.759923] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [1426184.728645] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [1426184.764536] server systemd-journald[72]: Time spent on flushing to /var/log/journal/8ddd482d3eae4f8cb03a2fe9b236bf07 is 1.056ms for 7 entries. container-test-run-certificates> client # [1426184.737515] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [1426184.764536] server systemd-journald[72]: System Journal (/var/log/journal/8ddd482d3eae4f8cb03a2fe9b236bf07) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [1426184.737875] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [1426184.784683] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [1426184.789229] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [1426184.738216] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [1426184.790415] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [1426184.761675] client systemd-journald[72]: Time spent on flushing to /var/log/journal/0ec0aa8fc2af4ff6ac28715ab4b38774 is 1.087ms for 7 entries. container-test-run-certificates> server # [1426184.790504] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [1426184.761675] client systemd-journald[72]: System Journal (/var/log/journal/0ec0aa8fc2af4ff6ac28715ab4b38774) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [1426184.790986] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [1426184.785963] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [1426184.791025] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1426184.791717] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [1426184.791556] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [1426184.791911] client systemd[1]: Finished Firewall. container-test-run-certificates> server # [1426184.791893] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [1426184.793318] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [1426184.791910] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [1426184.793386] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [1426184.818184] server systemd[1]: Finished Firewall. container-test-run-certificates> client # [1426184.793420] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [1426184.818476] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [1426184.793879] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [1426184.818698] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [1426184.794018] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [1426184.819555] server systemd[1]: Starting Network Management... container-test-run-certificates> client # [1426184.794043] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1426184.826433] server systemd-tmpfiles[168]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [1426184.818205] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [1426184.826588] server systemd-tmpfiles[168]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [1426184.818669] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [1426184.826693] server systemd-tmpfiles[168]: fchmod() of /var/log/journal/8ddd482d3eae4f8cb03a2fe9b236bf07 failed: Operation not permitted container-test-run-certificates> server # [1426184.826845] server systemd-tmpfiles[168]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [1426184.818691] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [1426184.832833] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [1426184.819353] client systemd[1]: Starting Network Management... container-test-run-certificates> server # [1426184.833599] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [1426184.829772] client systemd-tmpfiles[177]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [1426184.833900] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [1426184.829917] client systemd-tmpfiles[177]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [1426184.839703] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [1426184.830031] client systemd-tmpfiles[177]: fchmod() of /var/log/journal/0ec0aa8fc2af4ff6ac28715ab4b38774 failed: Operation not permitted container-test-run-certificates> server # [1426184.845390] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [1426184.830184] client systemd-tmpfiles[177]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [1426184.845904] server systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [1426184.831050] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [1426184.850605] server systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [1426184.831520] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [1426184.944950] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [1426184.831858] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [1426184.838021] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [1426184.843408] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [1426184.843852] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [1426184.849191] client systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [1426184.945311] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [1426185.741416] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [1426185.884713] client systemd-networkd[178]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1426185.884783] client systemd-networkd[178]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1426185.895899] client systemd-networkd[178]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1426185.896122] client systemd-networkd[178]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1426185.896187] client systemd-networkd[178]: lo: Link UP container-test-run-certificates> client # [1426185.896189] client systemd-networkd[178]: lo: Gained carrier container-test-run-certificates> client # [1426185.896309] client systemd-networkd[178]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [1426185.896542] client systemd[1]: Started Network Management. container-test-run-certificates> client # [1426185.896581] client systemd-networkd[178]: eth1: Link UP container-test-run-certificates> client # [1426185.896705] client systemd-networkd[178]: eth1: Gained carrier container-test-run-certificates> client # [1426185.897673] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [1426185.916027] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [1426185.745044] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [1426185.867996] server systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1426185.868079] server systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1426185.876038] server systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1426185.876187] server systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1426185.876265] server systemd-networkd[182]: lo: Link UP container-test-run-certificates> server # [1426185.876268] server systemd-networkd[182]: lo: Gained carrier container-test-run-certificates> server # [1426185.876403] server systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [1426185.876651] server systemd[1]: Started Network Management. container-test-run-certificates> server # [1426185.876703] server systemd-networkd[182]: eth1: Link UP container-test-run-certificates> server # [1426185.876868] server systemd-networkd[182]: eth1: Gained carrier container-test-run-certificates> server # [1426185.877768] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [1426185.901381] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> client # [1426186.364324] client systemd-resolved[118]: Positive Trust Anchors: container-test-run-certificates> client # [1426186.364334] client systemd-resolved[118]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [1426186.364337] client systemd-resolved[118]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [1426186.364356] client systemd-resolved[118]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [1426186.377897] client systemd-resolved[118]: Using system hostname 'client'. container-test-run-certificates> client # [1426186.379317] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [1426186.379414] client systemd[1]: Reached target Network. container-test-run-certificates> client # [1426186.379468] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [1426186.379520] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1426186.379549] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [1426186.379565] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [1426186.379685] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [1426186.379783] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [1426186.379898] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [1426186.379918] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [1426186.379946] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [1426186.381268] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [1426186.381780] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [1426186.382670] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [1426186.415755] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [1426186.597380] client nsncd[192]: Sep 20 19:26:41.020 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [1426186.597466] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [1426186.597519] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [1426186.597556] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [1426186.598349] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [1426186.598737] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [1426186.496293] server systemd-resolved[134]: Positive Trust Anchors: container-test-run-certificates> server # [1426186.496303] server systemd-resolved[134]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [1426186.496306] server systemd-resolved[134]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [1426186.496331] server systemd-resolved[134]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [1426186.509220] server systemd-resolved[134]: Using system hostname 'server'. container-test-run-certificates> server # [1426186.513279] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [1426186.513379] server systemd[1]: Reached target Network. container-test-run-certificates> server # [1426186.513425] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [1426186.513467] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [1426186.513666] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [1426186.513697] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1426186.513718] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [1426186.513738] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [1426186.513867] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [1426186.513958] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [1426186.514062] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [1426186.514081] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [1426186.514114] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [1426186.515146] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [1426186.516030] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [1426186.516055] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [1426186.516858] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [1426186.518066] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [1426186.549398] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [1426186.645258] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [1426186.645258] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [1426186.645258] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [1426186.646405] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [1426186.647955] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1426186.648010] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [1426186.648010] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1426186.648010] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [1426186.676135] server nsncd[197]: Sep 20 19:26:41.099 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [1426186.676188] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [1426186.676247] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [1426186.676291] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [1426186.677050] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [1426186.677470] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [1426186.710542] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [1426186.711257] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [1426186.711283] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [1426186.711294] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [1426186.629695] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [1426186.630264] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [1426186.630284] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [1426186.630296] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [1426186.754715] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [1426186.755398] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [1426186.755398] client dbus-broker-launch[193]: Invalid user-name in /nix/store/4h111szpdzzhwmlwzqmzchaihv9sdkmc-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [1426186.755831] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [1426186.760946] client dbus-broker-launch[193]: Ready container-test-run-certificates> server # [1426186.850690] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [1426186.851350] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [1426186.851350] server dbus-broker-launch[198]: Invalid user-name in /nix/store/8w07vg50wwd1nd826jppv2vnif6nysyz-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [1426186.851684] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [1426186.855452] server dbus-broker-launch[198]: Ready container-test-run-certificates> client # [1426187.388155] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [1426187.388304] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [1426187.389154] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [1426187.411583] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [1426187.411748] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [1426187.412078] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [1426187.412200] client systemd[1]: Startup finished in 2.965s. container-test-run-certificates> server # [1426187.562370] server systemd-logind[227]: New seat seat0. container-test-run-certificates> server # [1426187.562569] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [1426187.563715] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [1426187.584126] server systemd-networkd[182]: eth1: Gained IPv6LL container-test-run-certificates> server # [1426187.593193] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [1426187.593331] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [1426187.593784] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [1426187.594003] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [1426187.594003] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [1426187.601756] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [1426187.602660] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> client # [1426187.713139] client systemd-networkd[178]: eth1: Gained IPv6LL container-test-run-certificates> server # [1426188.432370] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1426188.434152] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [1426188.434152] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [1426188.439559] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [1426188.439559] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [1426188.440362] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [1426188.440537] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [1426188.441116] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [1426188.441237] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [1426188.442070] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [1426188.442859] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1426188.443660] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1426188.443660] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [1426188.443705] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1426188.444459] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [1426188.446175] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1426188.446175] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [1426188.449184] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [1426188.450363] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [1426189.257557] server nginx-pre-start[270]: nginx: the configuration file /nix/store/gjfpf92r5ay3yh007dqmwgdjhx6xqkhc-nginx.conf syntax is ok container-test-run-certificates> server # [1426189.267967] server nginx-pre-start[270]: nginx: configuration file /nix/store/gjfpf92r5ay3yh007dqmwgdjhx6xqkhc-nginx.conf test is successful container-test-run-certificates> server # [1426189.260844] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [1426189.261162] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [1426189.270548] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [1426190.068029] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1426190.070537] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [1426190.070577] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1426190.070613] server acme-order-renew-test.foo-start[273]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [1426190.071240] server acme-order-renew-test.foo-start[285]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [1426190.072567] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [1426190.072603] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1426190.072620] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [1426190.072642] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [1426190.082870] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.506163065Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [1426190.097894] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.521213333Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [1426190.294824] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.718129926Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [1426190.294824] server acme-order-renew-test.foo-start[286]: Your account credentials have been saved in your container-test-run-certificates> server # [1426190.294824] server acme-order-renew-test.foo-start[286]: configuration directory at "accounts". container-test-run-certificates> server # [1426190.294824] server acme-order-renew-test.foo-start[286]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [1426190.294824] server acme-order-renew-test.foo-start[286]: configuration directory will also contain private keys container-test-run-certificates> server # [1426190.294824] server acme-order-renew-test.foo-start[286]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [1426190.294824] server acme-order-renew-test.foo-start[286]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [1426190.295109] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.718222000Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> ca # [1426190.097671] ca step-ca[206]: time="2026-09-20T19:26:44Z" level=info duration="51.487µs" duration-ns=51487 fields.time="2026-09-20T19:26:44Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=fb3235cd-1dee-43fc-9e31-aedb575149db response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426190.196910] ca step-ca[206]: time="2026-09-20T19:26:44Z" level=info duration=98.110977ms duration-ns=98110977 fields.time="2026-09-20T19:26:44Z" method=HEAD name=ca nonce=Z0oydkpDdGd3R08wZTF4aXpmdWNDa0xXWTZ1UVE2N3Y path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=28cb7252-2cd9-47fc-b803-4fa27abc60fc size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426190.294080] ca step-ca[206]: time="2026-09-20T19:26:44Z" level=info duration=94.330627ms duration-ns=94330627 fields.time="2026-09-20T19:26:44Z" method=POST name=ca nonce=OXBZMHRzS2ZLTWtKTDI2Nkg5emJTTWtsdXZpT2NwYWY path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=ebbfa251-aaa5-4ee7-aded-feb391fcbd9d response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/ux5I6VAeKGHSyZOLSj5MNzxKVt6xwerg/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> server # [1426190.497709] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.921031062Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [1426190.497709] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.921050358Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [1426190.506263] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.929582559Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [1426190.506326] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.929638474Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [1426190.546363] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.969678742Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [1426190.546453] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.969724699Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [1426190.546453] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.969774482Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [1426190.546506] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.969798999Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [1426190.546527] server acme-order-renew-test.foo-start[286]: 2026-09-20T19:26:44.969861176Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [1426190.549195] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [1426190.550208] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1426190.551441] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [1426190.552355] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [1426190.552355] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [1426190.552417] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1426190.553294] server acme-order-renew-test.foo-start[305]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [1426190.553451] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [1426190.554154] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [1426190.554277] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [1426190.555026] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [1426190.555165] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [1426190.556138] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1426190.557373] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1426190.557395] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [1426190.557395] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1426190.558385] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [1426190.560088] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1426190.560088] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [1426190.560120] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [1426190.561154] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [1426190.562675] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> server # [1426190.703755] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [1426190.707609] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [1426190.707794] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> ca # [1426190.425312] ca step-ca[206]: time="2026-09-20T19:26:44Z" level=info duration=129.13904ms duration-ns=129139040 fields.time="2026-09-20T19:26:44Z" method=POST name=ca nonce=a0Z3UDVRNDY5STVQVml1VzBnSDUwSG8yeG1HVGhERDk path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=e3252347-0aea-4ff4-92aa-997294dea943 response="{\"id\":\"P9GaW8FWNKcTe22xdOceCu274OSSESWG\",\"status\":\"pending\",\"expires\":\"2026-09-21T19:26:44Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-20T19:25:44Z\",\"notAfter\":\"2026-12-19T19:26:44Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/yeR3WNKWZtIhJnolmz3rGId5EETEfdP0\"],\"finalize\":\"https://ca.foo/acme/acme/order/P9GaW8FWNKcTe22xdOceCu274OSSESWG/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426190.497446] ca step-ca[206]: time="2026-09-20T19:26:44Z" level=info duration=14.544456ms duration-ns=14544456 fields.time="2026-09-20T19:26:44Z" method=POST name=ca nonce=eVFadjFSNzVNSmhmd0U3S01tNDFValRlbGh6MndTbWI path=/acme/acme/authz/yeR3WNKWZtIhJnolmz3rGId5EETEfdP0 protocol=HTTP/1.1 referer= remote-address="::1" request-id=2619b0a3-7272-452d-85c6-79f714c7b66b response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"YqNefFB4ocU0PGGL9vq8mS6R2IsErUT9\",\"url\":\"https://ca.foo/acme/acme/challenge/yeR3WNKWZtIhJnolmz3rGId5EETEfdP0/NTjA94x7bUaZHcZ9ZkqlNrGJXxde3VSk\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"YqNefFB4ocU0PGGL9vq8mS6R2IsErUT9\",\"url\":\"https://ca.foo/acme/acme/challenge/yeR3WNKWZtIhJnolmz3rGId5EETEfdP0/cWLdjrWg41O4Em8s3eDpkw7uQ70iPAY8\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"YqNefFB4ocU0PGGL9vq8mS6R2IsErUT9\",\"url\":\"https://ca.foo/acme/acme/challenge/yeR3WNKWZtIhJnolmz3rGId5EETEfdP0/umEfy8OdY0ygj7c6RbqX0UD7b5yPjkf6\"}],\"wildcard\":false,\"expires\":\"2026-09-21T19:26:44Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426190.505925] ca step-ca[206]: time="2026-09-20T19:26:44Z" level=info duration=7.308727ms duration-ns=7308727 fields.time="2026-09-20T19:26:44Z" method=POST name=ca nonce=N3pyZ1JSOGRlcnVSekw1a01yeWtjMUNFVERJZjdmVlk path=/acme/acme/challenge/yeR3WNKWZtIhJnolmz3rGId5EETEfdP0/cWLdjrWg41O4Em8s3eDpkw7uQ70iPAY8 protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=81238fdc-bb19-4754-a670-6f5a184b684e response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"YqNefFB4ocU0PGGL9vq8mS6R2IsErUT9\",\"validated\":\"2026-09-20T19:26:44Z\",\"url\":\"https://ca.foo/acme/acme/challenge/yeR3WNKWZtIhJnolmz3rGId5EETEfdP0/cWLdjrWg41O4Em8s3eDpkw7uQ70iPAY8\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426190.534144] ca step-ca[206]: time="2026-09-20T19:26:44Z" level=info duration=26.818304ms duration-ns=26818304 fields.time="2026-09-20T19:26:44Z" method=POST name=ca nonce=ZUdvc2JWQjhhWmljTmU4YThXOWp6dGV1NUFPT0JDRDM path=/acme/acme/order/P9GaW8FWNKcTe22xdOceCu274OSSESWG/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=519d406d-4d83-4f19-b05a-715074e012d2 response="{\"id\":\"P9GaW8FWNKcTe22xdOceCu274OSSESWG\",\"status\":\"valid\",\"expires\":\"2026-09-21T19:26:44Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-20T19:25:44Z\",\"notAfter\":\"2026-12-19T19:26:44Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/yeR3WNKWZtIhJnolmz3rGId5EETEfdP0\"],\"finalize\":\"https://ca.foo/acme/acme/order/P9GaW8FWNKcTe22xdOceCu274OSSESWG/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/Sbt4VUNMJSLPRN92CHJX51xFUP7ZyLIJ\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1426190.546160] ca step-ca[206]: time="2026-09-20T19:26:44Z" level=info certificate=MIIB2TCCAX6gAwIBAgIRAPtXtXzXrEhz5iCCrHsNO7wwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTIwMTkyNTQ0WhcNMjYxMjE5MTkyNjQ0WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDx8vdAbXDGZ2XdAs4dxZfgUWFMDCFdsy9qg4WIQZOYD4s1oGDwUPMuQGCLUY/1Zu9wogYFVQrmdtkuRfyh93N2jgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUuYVVnplr3jEYxFDS6C5ZOiElThAwHwYDVR0jBBgwFoAU3TjjuAQFVVecartrWdb9ApHT57cwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0kAMEYCIQDhJZfY9fqphTyy+yFBisLixKBVAAE7ckU9ZtYbYZ71eAIhAJtzhb6YLhScuIRua2OYemxu7CuIMnzgOcIemcoAzZ8c duration=10.789572ms duration-ns=10789572 fields.time="2026-09-20T19:26:44Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=c05rZkFVT0dJcER3SEJZYkF6REVaM1Q4RGNNdUFEclc path=/acme/acme/certificate/Sbt4VUNMJSLPRN92CHJX51xFUP7ZyLIJ protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=cf6085c2-e8b6-47d9-a177-0cdae43fd2a1 sans="map[dns:[test.foo]]" serial=334091637775884381324569959953161075644 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= valid-from="2026-09-20T19:25:44Z" valid-to="2026-12-19T19:26:44Z" container-test-run-certificates> server # [1426191.481039] server nginx[323]: nginx: the configuration file /nix/store/gjfpf92r5ay3yh007dqmwgdjhx6xqkhc-nginx.conf syntax is ok container-test-run-certificates> server # [1426191.481335] server nginx[323]: nginx: configuration file /nix/store/gjfpf92r5ay3yh007dqmwgdjhx6xqkhc-nginx.conf test is successful container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 8.14 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [1426192.289172] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [1426192.289320] server systemd[1]: Startup finished in 7.849s. container-test-run-certificates> server # [1426192.316968] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [1426192.396251] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [1426192.396366] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [1426192.396388] server systemd[1]: nginx.service: Consumed 4.552s CPU time over 3.945s wall clock time. container-test-run-certificates> server # [1426192.397826] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.85 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 43044 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 52214 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 0 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 0 ms: Could not connect to server container-test-run-certificates> server # [1426193.154135] server nginx-pre-start[346]: nginx: the configuration file /nix/store/gjfpf92r5ay3yh007dqmwgdjhx6xqkhc-nginx.conf syntax is ok container-test-run-certificates> server # [1426193.321290] server nginx-pre-start[346]: nginx: configuration file /nix/store/gjfpf92r5ay3yh007dqmwgdjhx6xqkhc-nginx.conf test is successful container-test-run-certificates> server # [1426193.157060] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [931 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [78 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 20 19:25:44 2026 GMT container-test-run-certificates> * expire date: Dec 19 19:26:44 2026 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 43056 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1769 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.19 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> fb:57:b5:7c:d7:ac:48:73:e6:20:82:ac:7b:0d:3b:bc container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Sep 20 19:25:44 2026 GMT container-test-run-certificates> Not After : Dec 19 19:26:44 2026 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:3c:7c:bd:d0:1b:5c:31:99:d9:77:40:b3:87:71: container-test-run-certificates> 65:f8:14:58:53:03:08:57:6c:cb:da:a0:e1:62:10: container-test-run-certificates> 64:e6:03:e2:cd:68:18:3c:14:3c:cb:90:18:22:d4: container-test-run-certificates> 63:fd:59:bb:dc:28:81:81:55:42:b9:9d:b6:4b:91: container-test-run-certificates> 7f:28:7d:dc:dd container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> B9:85:55:9E:99:6B:DE:31:18:C4:50:D2:E8:2E:59:3A:21:25:4E:10 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> DD:38:E3:B8:04:05:55:57:9C:6A:BB:6B:59:D6:FD:02:91:D3:E7:B7 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:46:02:21:00:e1:25:97:d8:f5:fa:a9:85:3c:b2:fb:21:41: container-test-run-certificates> 8a:c2:e2:c4:a0:55:00:01:3b:72:45:3d:66:d6:1b:61:9e:f5: container-test-run-certificates> 78:02:21:00:9b:73:85:be:98:2e:14:9c:b8:84:6e:6b:63:98: container-test-run-certificates> 7a:6c:6e:ec:2b:88:32:7c:e0:39:c2:1e:99:ca:00:cd:9f:1c container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds) container-test-run-certificates> (finished: run the VM test script, in 33.75 seconds) container-test-run-certificates> test script finished in 84.19s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 446) container-test-run-certificates> kill NspawnMachine (pid 443) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> Container server terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.29 seconds) post-build step Upload to niks3: ok time=2026-09-20T19:27:39.866Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)" time=2026-09-20T19:27:40.359Z level=INFO msg="Uploading 1 narinfos" time=2026-09-20T19:27:41.316Z level=INFO msg="Upload complete. (1.506s)"