these 19 derivations will be built: /nix/store/fgi39jzjwlqahrfxfqvhkv3i7wxy18pm-nginx.conf.drv /nix/store/vw6adpmc0p8v7hzi9kzighljcnm2m8c6-unit-script-nginx-pre-start.drv /nix/store/vzzg7m0bylkc1d3gagj3r39l74wwfga3-unit-nginx.service.drv /nix/store/2wh91b0vaq23z97v3n2qmnbf472n6mj0-system-units.drv /nix/store/4g3ml1l6srf8szlfv5mcwwkpagzv7pp5-etc.drv /nix/store/h5m8s0mdar8mzpa9wgyj1vrgjx9qi1zr-nginx.conf.drv /nix/store/w3j8paj8cd3rdxd7jrx9pdn654s9qgky-unit-script-nginx-pre-start.drv /nix/store/9xhyg24aszmg0xlqvvkhn5h9fmr8g6nh-unit-nginx.service.drv /nix/store/iq7jm183iz5z3mh2bhylljsc855cpjai-system-units.drv /nix/store/am4q1rbkc0gafi19qrhvb6wwvhqhlxhr-etc.drv /nix/store/8nfxl91fz876cl1150kn4znp4zbzyqbp-activate.drv /nix/store/8f3p5smn4cwrlrwikngspcbygqwndbqa-nixos-system-ca-test.drv /nix/store/xhmrn0vd3x7x36mqb3p7x24513fvc6v8-run-ca-nspawn.drv /nix/store/hidzbbn4np1vvq8jr17a6l2b8msx2gx5-activate.drv /nix/store/zswmk0q4s1ac68miskq4cflzlnb4wv43-nixos-system-server-test.drv /nix/store/z7w7qp2h7m52ngfxww25mavsbs2p50bc-run-server-nspawn.drv /nix/store/dx465anc19n9xc1za9ndd87vhk8h02pf-driverConfiguration.json.drv /nix/store/qc5g5biwz4450riiwwrn9aq4frdqj7lf-nixos-test-driver-certificates.drv /nix/store/i761k2pnvbw5mv3dqw59nkg03m94y77d-container-test-run-certificates.drv this path will be fetched (813.0 KiB download, 2.0 MiB unpacked): /nix/store/5dz4bsvp1izk6pzs287kn83di5c2h7hv-nginx-1.30.5 building '/nix/store/fgi39jzjwlqahrfxfqvhkv3i7wxy18pm-nginx.conf.drv' building '/nix/store/h5m8s0mdar8mzpa9wgyj1vrgjx9qi1zr-nginx.conf.drv' nginx.conf> structuredAttrs is enabled nginx.conf> structuredAttrs is enabled nginx.conf> nginx.conf> ==================== Results =================== nginx.conf> No issues found. nginx.conf> nginx.conf> ==================== Summary =================== nginx.conf> Total issues: nginx.conf> Unspecified: 0 nginx.conf> Low: 0 nginx.conf> Medium: 0 nginx.conf> High: 0 nginx.conf> nginx.conf> nginx.conf> ==================== Results =================== nginx.conf> No issues found. nginx.conf> nginx.conf> ==================== Summary =================== nginx.conf> Total issues: nginx.conf> Unspecified: 0 nginx.conf> Low: 0 nginx.conf> Medium: 0 nginx.conf> High: 0 nginx.conf> building '/nix/store/vw6adpmc0p8v7hzi9kzighljcnm2m8c6-unit-script-nginx-pre-start.drv' building '/nix/store/w3j8paj8cd3rdxd7jrx9pdn654s9qgky-unit-script-nginx-pre-start.drv' unit-script-nginx-pre-start> structuredAttrs is enabled building '/nix/store/vzzg7m0bylkc1d3gagj3r39l74wwfga3-unit-nginx.service.drv' unit-script-nginx-pre-start> structuredAttrs is enabled building '/nix/store/9xhyg24aszmg0xlqvvkhn5h9fmr8g6nh-unit-nginx.service.drv' unit-nginx.service> structuredAttrs is enabled building '/nix/store/2wh91b0vaq23z97v3n2qmnbf472n6mj0-system-units.drv' unit-nginx.service> structuredAttrs is enabled building '/nix/store/iq7jm183iz5z3mh2bhylljsc855cpjai-system-units.drv' building '/nix/store/4g3ml1l6srf8szlfv5mcwwkpagzv7pp5-etc.drv' building '/nix/store/am4q1rbkc0gafi19qrhvb6wwvhqhlxhr-etc.drv' building '/nix/store/hidzbbn4np1vvq8jr17a6l2b8msx2gx5-activate.drv' activate> structuredAttrs is enabled building '/nix/store/zswmk0q4s1ac68miskq4cflzlnb4wv43-nixos-system-server-test.drv' building '/nix/store/8nfxl91fz876cl1150kn4znp4zbzyqbp-activate.drv' nixos-system-server-test> structuredAttrs is enabled activate> structuredAttrs is enabled building '/nix/store/8f3p5smn4cwrlrwikngspcbygqwndbqa-nixos-system-ca-test.drv' nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/z7w7qp2h7m52ngfxww25mavsbs2p50bc-run-server-nspawn.drv' building '/nix/store/xhmrn0vd3x7x36mqb3p7x24513fvc6v8-run-ca-nspawn.drv' building '/nix/store/dx465anc19n9xc1za9ndd87vhk8h02pf-driverConfiguration.json.drv' driverConfiguration.json> structuredAttrs is enabled building '/nix/store/qc5g5biwz4450riiwwrn9aq4frdqj7lf-nixos-test-driver-certificates.drv' nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/i761k2pnvbw5mv3dqw59nkg03m94y77d-container-test-run-certificates.drv' on 'ssh-ng://builder@build-x86-01.clan.lol' building '/nix/store/i761k2pnvbw5mv3dqw59nkg03m94y77d-container-test-run-certificates.drv' container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # No journal files were found. container-test-run-certificates> ca # No journal boot entry found for the specified boot (+0). container-test-run-certificates> ca # [1478781.100984] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [1478781.101031] ca systemd-journald[81]: Runtime Journal (/run/log/journal/d6919599a09d4f3c8948992a563b63ae) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> ca # [1478781.107188] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [1478781.116716] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [1478781.117143] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [1478781.117438] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [1478781.147746] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/d6919599a09d4f3c8948992a563b63ae is 1.189ms for 6 entries. container-test-run-certificates> ca # [1478781.147746] ca systemd-journald[81]: System Journal (/var/log/journal/d6919599a09d4f3c8948992a563b63ae) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [1478781.160307] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [1478781.160550] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [1478781.161712] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [1478781.161782] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [1478781.161831] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [1478781.162432] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [1478781.162576] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [1478781.162608] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1478781.163262] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [1478781.163285] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [1478781.163852] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [1478781.449763] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [1478781.451201] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [1478781.481512] ca systemd-tmpfiles[192]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [1478781.481712] ca systemd-tmpfiles[192]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1478781.481851] ca systemd-tmpfiles[192]: fchmod() of /var/log/journal/d6919599a09d4f3c8948992a563b63ae failed: Operation not permitted container-test-run-certificates> ca # [1478781.482059] ca systemd-tmpfiles[192]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1478781.483110] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [1478781.483961] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [1478781.484362] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [1478781.513379] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [1478781.521551] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [1478781.522153] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [1478781.528256] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [1478781.946779] ca systemd-networkd[188]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1478781.946859] ca systemd-networkd[188]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1478781.954878] ca systemd-networkd[188]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1478781.955065] ca systemd-networkd[188]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1478781.955178] ca systemd-networkd[188]: lo: Link UP container-test-run-certificates> ca # [1478781.955182] ca systemd-networkd[188]: lo: Gained carrier container-test-run-certificates> ca # [1478781.955366] ca systemd-networkd[188]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [1478781.955667] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [1478781.955716] ca systemd-networkd[188]: eth1: Link UP container-test-run-certificates> ca # [1478781.955883] ca systemd-networkd[188]: eth1: Gained carrier container-test-run-certificates> ca # [1478781.957079] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [1478781.989466] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [1478782.427711] ca systemd-resolved[152]: Positive Trust Anchors: container-test-run-certificates> ca # [1478782.427719] ca systemd-resolved[152]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [1478782.427722] ca systemd-resolved[152]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [1478782.427737] ca systemd-resolved[152]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [1478782.438827] ca systemd-resolved[152]: Using system hostname 'ca'. container-test-run-certificates> ca # [1478782.439781] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [1478782.439846] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [1478782.439888] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [1478782.439920] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [1478782.440101] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [1478782.440129] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1478782.440148] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [1478782.440163] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [1478782.440255] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [1478782.440331] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [1478782.440425] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [1478782.440439] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [1478782.440468] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [1478782.446173] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [1478782.446609] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [1478782.446629] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [1478782.447146] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [1478782.447688] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [1478782.448543] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [1478782.488893] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [1478782.596556] ca acme-setup-privileged[203]: + set -euo pipefail container-test-run-certificates> ca # [1478782.596556] ca acme-setup-privileged[203]: + cd /var/lib/acme container-test-run-certificates> ca # [1478782.596556] ca acme-setup-privileged[203]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [1478782.597775] ca acme-setup-privileged[203]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [1478782.599063] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1478782.599063] ca acme-setup-privileged[203]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [1478782.599063] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1478782.599063] ca acme-setup-privileged[203]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [1478782.631462] ca nsncd[205]: Sep 21 10:03:17.054 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [1478782.631512] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [1478782.631591] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [1478782.631639] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [1478782.632563] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [1478782.632990] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [1478782.640292] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [1478782.640838] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [1478782.640862] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [1478782.640874] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [1478782.780386] ca dbus-broker-launch[207]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [1478782.995806] ca dbus-broker-launch[207]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [1478782.995806] ca dbus-broker-launch[207]: Invalid user-name in /nix/store/1rsbjj3vkxs9pmkbvvj5g7ldfs54i9d8-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [1478782.781406] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [1478782.784774] ca dbus-broker-launch[207]: Ready container-test-run-certificates> ca # [1478783.392111] ca acme-setup-start[221]: + set -euo pipefail container-test-run-certificates> ca # [1478783.392111] ca acme-setup-start[221]: + test -e ca/key.pem container-test-run-certificates> ca # [1478783.392111] ca acme-setup-start[221]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [1478783.581787] ca systemd-logind[237]: New seat seat0. container-test-run-certificates> ca # [1478783.581940] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [1478783.582860] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [1478783.586696] ca step-ca[206]: badger 2026/09/21 10:03:18 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [1478783.597252] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [1478783.598524] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [1478783.603195] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [1478783.603339] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [1478783.838919] ca step-ca[206]: 2026/09/21 10:03:18 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [1478783.937106] ca systemd-networkd[188]: eth1: Gained IPv6LL container-test-run-certificates> ca # [1478784.355640] ca step-ca[206]: 2026/09/21 10:03:18 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [1478784.355640] ca step-ca[206]: 2026/09/21 10:03:18 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [1478784.355640] ca step-ca[206]: 2026/09/21 10:03:18 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [1478784.355640] ca step-ca[206]: 2026/09/21 10:03:18 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [1478784.355640] ca step-ca[206]: 2026/09/21 10:03:18 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [1478784.355640] ca step-ca[206]: 2026/09/21 10:03:18 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [1478784.355640] ca step-ca[206]: 2026/09/21 10:03:18 X.509 Root Fingerprint: 284ee37e317a8c10e3c8c982e418e2bec3e5fab1c9a496c0f728ac5747abca9a container-test-run-certificates> ca # [1478784.355871] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [1478784.355934] ca step-ca[206]: 2026/09/21 10:03:18 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [1478784.408023] ca acme-ca.foo-start[272]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1478784.409452] ca acme-ca.foo-start[272]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [1478784.409488] ca acme-ca.foo-start[272]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [1478784.413743] ca acme-ca.foo-start[283]: + cd ca.foo container-test-run-certificates> ca # [1478784.413926] ca acme-ca.foo-start[283]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [1478784.414493] ca acme-ca.foo-start[284]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [1478784.414630] ca acme-ca.foo-start[283]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [1478784.415205] ca acme-ca.foo-start[283]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [1478784.415327] ca acme-ca.foo-start[272]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [1478784.416157] ca acme-ca.foo-start[272]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [1478784.416921] ca acme-ca.foo-start[272]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1478784.417708] ca acme-ca.foo-start[272]: + for fixpath in out certificates container-test-run-certificates> ca # [1478784.417725] ca acme-ca.foo-start[272]: + '[' -d out ']' container-test-run-certificates> ca # [1478784.417725] ca acme-ca.foo-start[272]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1478784.418488] ca acme-ca.foo-start[272]: + chown -R acme:nginx out container-test-run-certificates> ca # [1478784.419947] ca acme-ca.foo-start[272]: + for fixpath in out certificates container-test-run-certificates> ca # [1478784.419964] ca acme-ca.foo-start[272]: + '[' -d certificates ']' container-test-run-certificates> ca # [1478784.422983] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [1478784.424092] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [1478785.214638] ca nginx-pre-start[295]: nginx: the configuration file /nix/store/jnnqbkqmraf67srm0srv8bjy9f5kiwq4-nginx.conf syntax is ok container-test-run-certificates> ca # [1478785.214994] ca nginx-pre-start[295]: nginx: configuration file /nix/store/jnnqbkqmraf67srm0srv8bjy9f5kiwq4-nginx.conf test is successful container-test-run-certificates> ca # [1478785.218825] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [1478785.219165] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [1478785.220086] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [1478785.991049] ca acme-order-renew-ca.foo-start[298]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1478785.992730] ca acme-order-renew-ca.foo-start[298]: + set -euo pipefail container-test-run-certificates> ca # [1478785.992791] ca acme-order-renew-ca.foo-start[298]: + exec container-test-run-certificates> ca # [1478785.992791] ca acme-order-renew-ca.foo-start[298]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [1478785.993371] ca acme-order-renew-ca.foo-start[309]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [1478785.994678] ca acme-order-renew-ca.foo-start[298]: + '[' -n '' ']' container-test-run-certificates> ca # [1478785.994693] ca acme-order-renew-ca.foo-start[298]: + exec container-test-run-certificates> ca # [1478785.994731] ca acme-order-renew-ca.foo-start[298]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [1478785.994752] ca acme-order-renew-ca.foo-start[298]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [1478786.003718] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.427031983Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [1478786.016278] ca step-ca[206]: time="2026-09-21T10:03:20Z" level=info duration="90.952µs" duration-ns=90952 fields.time="2026-09-21T10:03:20Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=ce738627-191f-44c0-bd56-ea2ee3d36fa2 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478786.016569] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.439744186Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [1478786.134304] ca step-ca[206]: time="2026-09-21T10:03:20Z" level=info duration=117.794041ms duration-ns=117794041 fields.time="2026-09-21T10:03:20Z" method=HEAD name=ca nonce=M3ZYb3pBWkcxSm5pSFdqUmxOUXhJT3RDeUQ3OG1DSWs path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=4db0d0b9-8cfc-460c-ade9-e73716b76a44 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478786.192341] ca step-ca[206]: time="2026-09-21T10:03:20Z" level=info duration=57.639562ms duration-ns=57639562 fields.time="2026-09-21T10:03:20Z" method=POST name=ca nonce=UVJrQmh6VUxxSlJtY0xsWFJITHRJdmFDN3dOZW8zTWI path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b56ce6cf-03c4-4b9b-8070-ea79d32872d9 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/sABNKeOjoJeZZ9FxUAG5siqoFU2mQebT/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478786.192528] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.615858041Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [1478786.192528] ca acme-order-renew-ca.foo-start[310]: Your account credentials have been saved in your container-test-run-certificates> ca # [1478786.192528] ca acme-order-renew-ca.foo-start[310]: configuration directory at "accounts". container-test-run-certificates> ca # [1478786.192528] ca acme-order-renew-ca.foo-start[310]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [1478786.192528] ca acme-order-renew-ca.foo-start[310]: configuration directory will also contain private keys container-test-run-certificates> ca # [1478786.192528] ca acme-order-renew-ca.foo-start[310]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [1478786.192528] ca acme-order-renew-ca.foo-start[310]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [1478786.192686] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.615932451Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [1478786.234205] ca step-ca[206]: time="2026-09-21T10:03:20Z" level=info duration=41.387862ms duration-ns=41387862 fields.time="2026-09-21T10:03:20Z" method=POST name=ca nonce=NkcyeW1CN1pXVzB0Q1B2RUR6S0N0OUpjZDVvd01PMU0 path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=252c9989-1b5d-4958-a98e-5e4e3f68e14e response="{\"id\":\"ZuEaYai1Ngm44qKzh8AcTMzBbYIAPaJZ\",\"status\":\"pending\",\"expires\":\"2026-09-22T10:03:20Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-21T10:02:20Z\",\"notAfter\":\"2026-12-20T10:03:20Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/YYMJibGalYoM07AmXfbd8vwJXHplK8fi\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/ZuEaYai1Ngm44qKzh8AcTMzBbYIAPaJZ/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478786.370514] ca step-ca[206]: time="2026-09-21T10:03:20Z" level=info duration=79.635371ms duration-ns=79635371 fields.time="2026-09-21T10:03:20Z" method=POST name=ca nonce=eVZkd1pDdmVkUVZEWjVkUktSUGQxTEN5Q0JOOEZ2ajU path=/acme/acme/authz/YYMJibGalYoM07AmXfbd8vwJXHplK8fi protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=0d7ea5dd-7f56-42a3-a877-eb35e25e7a73 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"tMlfEwcdIItRzjp4NiY7t2LAb0sk4S0i\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/YYMJibGalYoM07AmXfbd8vwJXHplK8fi/ZEnokkJPr3MNPNghU9FaQ8PEP9z5HLv7\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"tMlfEwcdIItRzjp4NiY7t2LAb0sk4S0i\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/YYMJibGalYoM07AmXfbd8vwJXHplK8fi/nP218cKtqo5S0eeXHo0fJkdytkTe4Jhz\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"tMlfEwcdIItRzjp4NiY7t2LAb0sk4S0i\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/YYMJibGalYoM07AmXfbd8vwJXHplK8fi/rnrRrQjEPLiRKqHR5sN6o0i8I34DWKmj\"}],\"wildcard\":false,\"expires\":\"2026-09-22T10:03:20Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478786.370756] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.794075117Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [1478786.370756] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.794096758Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [1478786.423292] ca step-ca[206]: time="2026-09-21T10:03:20Z" level=info duration=52.093847ms duration-ns=52093847 fields.time="2026-09-21T10:03:20Z" method=POST name=ca nonce=QVBMUzFLUjFYMmNSN2tncHJJUHZWMGNoNUxjMjhjZTE path=/acme/acme/challenge/YYMJibGalYoM07AmXfbd8vwJXHplK8fi/nP218cKtqo5S0eeXHo0fJkdytkTe4Jhz protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f98bd758-f617-4fb6-bab9-a14a172ff1eb response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"tMlfEwcdIItRzjp4NiY7t2LAb0sk4S0i\",\"validated\":\"2026-09-21T10:03:20Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/YYMJibGalYoM07AmXfbd8vwJXHplK8fi/nP218cKtqo5S0eeXHo0fJkdytkTe4Jhz\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478786.423479] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.846804512Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [1478786.423521] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.846854586Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [1478786.520603] ca step-ca[206]: time="2026-09-21T10:03:20Z" level=info duration=96.658924ms duration-ns=96658924 fields.time="2026-09-21T10:03:20Z" method=POST name=ca nonce=VzdTY0o5RVF6N2NodzFnN05BUUx3cW9JTFJsZUl2S1o path=/acme/acme/order/ZuEaYai1Ngm44qKzh8AcTMzBbYIAPaJZ/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=3e62474c-8f85-4590-a5fe-bb856cef6eca response="{\"id\":\"ZuEaYai1Ngm44qKzh8AcTMzBbYIAPaJZ\",\"status\":\"valid\",\"expires\":\"2026-09-22T10:03:20Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-21T10:02:20Z\",\"notAfter\":\"2026-12-20T10:03:20Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/YYMJibGalYoM07AmXfbd8vwJXHplK8fi\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/ZuEaYai1Ngm44qKzh8AcTMzBbYIAPaJZ/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/Hsd0uljZaGvdCQNje4yo50aMliVbr40W\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478786.531425] ca step-ca[206]: time="2026-09-21T10:03:20Z" level=info certificate="MIIB1DCCAXmgAwIBAgIQO7Tr3a/xphpx7AyiHhtEDDAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MjExMDAyMjBaFw0yNjEyMjAxMDAzMjBaMBExDzANBgNVBAMTBmNhLmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMO8Ry1ktNlMfkaZPn5RJCT9IxtN1uykYDSL/+lkdkyvgnXFu99ydzHaeFFntFO286C85FSIOLoW7aAMUYgRS82jgaQwgaEwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUoS1QuDPRKODNEcJ5hgSbkPd1spcwHwYDVR0jBBgwFoAU5IkE8/qu18/Sn1cJ07n++zikcxAwEQYDVR0RBAowCIIGY2EuZm9vMB0GDCsGAQQBgqRkxihAAQQNMAsCAQYEBGFjbWUEADAKBggqhkjOPQQDAgNJADBGAiEAkGuyRRJLNpFCgG7pCxFXs9tDqePmi4Qb2ffqarXBC+MCIQDQDpzCvdiDyWrvDICACbe0JogJauSp+GEYDmXPxk3x9A==" duration=10.496329ms duration-ns=10496329 fields.time="2026-09-21T10:03:20Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=aTZRd2NidWZSWWw0SUNwM3BUNmZFR2R6c1VaUkVuZW0 path=/acme/acme/certificate/Hsd0uljZaGvdCQNje4yo50aMliVbr40W protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=fbcc7933-434c-4dd1-bcec-210b87d9bb6d sans="map[dns:[ca.foo]]" serial=79363849115979091511351306719778784268 size=1348 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= valid-from="2026-09-21T10:02:20Z" valid-to="2026-12-20T10:03:20Z" container-test-run-certificates> ca # [1478786.531565] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.954887743Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [1478786.531601] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.954934832Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [1478786.531667] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.955000566Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [1478786.531697] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.955031233Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [1478786.531759] ca acme-order-renew-ca.foo-start[310]: 2026-09-21T10:03:20.955094062Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [1478786.534292] ca acme-order-renew-ca.foo-start[298]: + touch out/acme-success container-test-run-certificates> ca # [1478786.535371] ca acme-order-renew-ca.foo-start[298]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1478786.535923] ca acme-order-renew-ca.foo-start[298]: + touch out/renewed container-test-run-certificates> ca # [1478786.536618] ca acme-order-renew-ca.foo-start[298]: + echo Installing new certificate container-test-run-certificates> ca # [1478786.536618] ca acme-order-renew-ca.foo-start[298]: Installing new certificate container-test-run-certificates> ca # [1478786.536648] ca acme-order-renew-ca.foo-start[298]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1478786.537309] ca acme-order-renew-ca.foo-start[330]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [1478786.537490] ca acme-order-renew-ca.foo-start[298]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [1478786.538207] ca acme-order-renew-ca.foo-start[331]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [1478786.538347] ca acme-order-renew-ca.foo-start[298]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [1478786.538995] ca acme-order-renew-ca.foo-start[332]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [1478786.539116] ca acme-order-renew-ca.foo-start[298]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [1478786.539861] ca acme-order-renew-ca.foo-start[298]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1478786.540642] ca acme-order-renew-ca.foo-start[298]: + for fixpath in out certificates container-test-run-certificates> ca # [1478786.540658] ca acme-order-renew-ca.foo-start[298]: + '[' -d out ']' container-test-run-certificates> ca # [1478786.540658] ca acme-order-renew-ca.foo-start[298]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1478786.541382] ca acme-order-renew-ca.foo-start[298]: + chown -R acme:nginx out container-test-run-certificates> ca # [1478786.543054] ca acme-order-renew-ca.foo-start[298]: + for fixpath in out certificates container-test-run-certificates> ca # [1478786.543054] ca acme-order-renew-ca.foo-start[298]: + '[' -d certificates ']' container-test-run-certificates> ca # [1478786.543089] ca acme-order-renew-ca.foo-start[298]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [1478786.543852] ca acme-order-renew-ca.foo-start[298]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [1478786.545236] ca acme-order-renew-ca.foo-start[298]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [1478786.669253] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [1478786.671937] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [1478786.672046] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [1478787.383073] ca nginx[348]: nginx: the configuration file /nix/store/jnnqbkqmraf67srm0srv8bjy9f5kiwq4-nginx.conf syntax is ok container-test-run-certificates> ca # [1478787.383357] ca nginx[348]: nginx: configuration file /nix/store/jnnqbkqmraf67srm0srv8bjy9f5kiwq4-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 8.64 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [1478788.105946] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [1478788.160324] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [1478788.161166] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [1478788.161344] ca systemd[1]: Startup finished in 7.736s. container-test-run-certificates> ca # [1478788.430908] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [1478788.482200] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [1478788.482338] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [1478788.482356] ca systemd[1]: nginx.service: Consumed 2.876s CPU time over 4.058s wall clock time. container-test-run-certificates> ca # [1478788.484250] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.75 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 443) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 446) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ca # [1478789.170247] ca nginx-pre-start[373]: nginx: the configuration file /nix/store/jnnqbkqmraf67srm0srv8bjy9f5kiwq4-nginx.conf syntax is ok container-test-run-certificates> ca # [1478789.170513] ca nginx-pre-start[373]: nginx: configuration file /nix/store/jnnqbkqmraf67srm0srv8bjy9f5kiwq4-nginx.conf test is successful container-test-run-certificates> ca # [1478789.173356] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [1478789.985491] server systemd-journald[72]: Journal started container-test-run-certificates> server # [1478789.985516] server systemd-journald[72]: Runtime Journal (/run/log/journal/145a31353d7948019368c29f05fa701f) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [1478789.992944] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [1478790.000925] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [1478790.011295] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [1478790.011735] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [1478790.012054] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [1478790.016135] server systemd-journald[72]: Time spent on flushing to /var/log/journal/145a31353d7948019368c29f05fa701f is 1.063ms for 7 entries. container-test-run-certificates> server # [1478790.016135] server systemd-journald[72]: System Journal (/var/log/journal/145a31353d7948019368c29f05fa701f) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [1478790.026808] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [1478790.027266] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [1478790.027324] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [1478790.027803] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [1478790.027833] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1478790.028284] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [1478790.028302] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [1478790.098187] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [1478790.098846] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [1478790.104784] server systemd[1]: Finished Firewall. container-test-run-certificates> server # [1478790.104849] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [1478790.104995] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [1478790.105566] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [1478790.109695] server systemd-tmpfiles[174]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [1478790.109847] server systemd-tmpfiles[174]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [1478790.109951] server systemd-tmpfiles[174]: fchmod() of /var/log/journal/145a31353d7948019368c29f05fa701f failed: Operation not permitted container-test-run-certificates> server # [1478790.110111] server systemd-tmpfiles[174]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [1478790.112616] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [1478790.113159] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [1478790.113508] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [1478790.120766] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [1478790.125097] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [1478790.125674] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [1478790.131532] server systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [1478789.980179] client systemd-journald[72]: Journal started container-test-run-certificates> client # [1478789.980208] client systemd-journald[72]: Runtime Journal (/run/log/journal/6d5ef8a497454657a730ae6c40318899) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [1478789.988457] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [1478789.996515] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [1478790.005533] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [1478790.005869] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [1478790.006165] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [1478790.009927] client systemd-journald[72]: Time spent on flushing to /var/log/journal/6d5ef8a497454657a730ae6c40318899 is 1.059ms for 7 entries. container-test-run-certificates> client # [1478790.009927] client systemd-journald[72]: System Journal (/var/log/journal/6d5ef8a497454657a730ae6c40318899) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [1478790.020465] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [1478790.020798] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [1478790.020851] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [1478790.021306] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [1478790.021332] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1478790.021738] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [1478790.021753] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [1478790.071473] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [1478790.071903] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [1478790.100563] client systemd[1]: Finished Firewall. container-test-run-certificates> client # [1478790.100651] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [1478790.100780] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [1478790.101202] client systemd[1]: Starting Network Management... container-test-run-certificates> client # [1478790.105691] client systemd-tmpfiles[144]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [1478790.105837] client systemd-tmpfiles[144]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [1478790.105943] client systemd-tmpfiles[144]: fchmod() of /var/log/journal/6d5ef8a497454657a730ae6c40318899 failed: Operation not permitted container-test-run-certificates> client # [1478790.106100] client systemd-tmpfiles[144]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [1478790.107368] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [1478790.107834] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [1478790.108171] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [1478790.114111] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [1478790.121770] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [1478790.122211] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [1478790.127075] client systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [1478790.632648] server systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1478790.632722] server systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1478790.640481] server systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1478790.640712] server systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1478790.640832] server systemd-networkd[182]: lo: Link UP container-test-run-certificates> server # [1478790.640835] server systemd-networkd[182]: lo: Gained carrier container-test-run-certificates> server # [1478790.641031] server systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [1478790.641354] server systemd[1]: Started Network Management. container-test-run-certificates> server # [1478790.641423] server systemd-networkd[182]: eth1: Link UP container-test-run-certificates> server # [1478790.641595] server systemd-networkd[182]: eth1: Gained carrier container-test-run-certificates> server # [1478790.642124] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [1478790.668356] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> client # [1478790.648421] client systemd-networkd[178]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1478790.648486] client systemd-networkd[178]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1478790.656374] client systemd-networkd[178]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1478790.656529] client systemd-networkd[178]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1478790.656601] client systemd-networkd[178]: lo: Link UP container-test-run-certificates> client # [1478790.656604] client systemd-networkd[178]: lo: Gained carrier container-test-run-certificates> client # [1478790.656728] client systemd-networkd[178]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [1478790.656973] client systemd[1]: Started Network Management. container-test-run-certificates> client # [1478790.663106] client systemd-networkd[178]: eth1: Link UP container-test-run-certificates> client # [1478790.663159] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [1478790.663247] client systemd-networkd[178]: eth1: Gained carrier container-test-run-certificates> client # [1478790.677184] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [1478790.912592] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> server # [1478790.987582] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [1478791.047088] server systemd-resolved[115]: Positive Trust Anchors: container-test-run-certificates> server # [1478791.047093] server systemd-resolved[115]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [1478791.047096] server systemd-resolved[115]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [1478791.047113] server systemd-resolved[115]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [1478791.057448] server systemd-resolved[115]: Using system hostname 'server'. container-test-run-certificates> server # [1478791.058259] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [1478791.058300] server systemd[1]: Reached target Network. container-test-run-certificates> server # [1478791.058328] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [1478791.058353] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [1478791.058473] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [1478791.058486] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1478791.058498] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [1478791.058509] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [1478791.058576] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [1478791.058638] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [1478791.058709] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [1478791.058721] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [1478791.058742] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [1478791.059782] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [1478791.060171] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [1478791.060191] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [1478791.060584] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [1478791.061322] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [1478791.070924] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [1478791.185090] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [1478791.185090] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [1478791.185090] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> client # [1478790.910948] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [1478790.978291] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [1478791.009222] client systemd-resolved[115]: Positive Trust Anchors: container-test-run-certificates> client # [1478791.009230] client systemd-resolved[115]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [1478791.009233] client systemd-resolved[115]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [1478791.009249] client systemd-resolved[115]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [1478791.019421] client systemd-resolved[115]: Using system hostname 'client'. container-test-run-certificates> client # [1478791.020258] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [1478791.020300] client systemd[1]: Reached target Network. container-test-run-certificates> client # [1478791.020333] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [1478791.020360] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1478791.020375] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [1478791.020385] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [1478791.020462] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [1478791.020537] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [1478791.020618] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [1478791.020627] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [1478791.020649] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [1478791.021644] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [1478791.021988] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [1478791.022518] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [1478791.056471] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [1478791.205824] client nsncd[192]: Sep 21 10:03:25.629 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [1478791.205828] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [1478791.205867] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [1478791.205899] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [1478791.206574] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [1478791.207051] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [1478791.213406] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [1478791.214332] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [1478791.214353] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [1478791.214365] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [1478791.347455] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [1478791.348026] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [1478791.348026] client dbus-broker-launch[193]: Invalid user-name in /nix/store/4h111szpdzzhwmlwzqmzchaihv9sdkmc-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [1478791.348328] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [1478791.351864] client dbus-broker-launch[193]: Ready container-test-run-certificates> server # [1478791.186138] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [1478791.187188] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1478791.187221] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [1478791.187221] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1478791.187221] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [1478791.218009] server nsncd[197]: Sep 21 10:03:25.641 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [1478791.218027] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [1478791.218082] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [1478791.218122] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [1478791.218918] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [1478791.219413] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [1478791.226911] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [1478791.227465] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [1478791.227485] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [1478791.227496] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [1478791.356921] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [1478791.357340] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [1478791.357340] server dbus-broker-launch[198]: Invalid user-name in /nix/store/8w07vg50wwd1nd826jppv2vnif6nysyz-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [1478791.357707] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [1478791.361323] server dbus-broker-launch[198]: Ready container-test-run-certificates> server # [1478791.871024] server systemd-logind[227]: New seat seat0. container-test-run-certificates> server # [1478791.871123] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [1478791.871847] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [1478791.895618] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [1478791.895683] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [1478791.901085] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [1478791.901300] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [1478791.901300] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [1478791.908463] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [1478791.909157] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> server # [1478792.000086] server systemd-networkd[182]: eth1: Gained IPv6LL container-test-run-certificates> client # [1478791.876513] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [1478791.876606] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [1478791.891191] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [1478791.898564] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [1478791.898633] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [1478791.898911] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [1478791.899026] client systemd[1]: Startup finished in 2.472s. container-test-run-certificates> client # [1478792.448186] client systemd-networkd[178]: eth1: Gained IPv6LL container-test-run-certificates> server # [1478792.593739] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1478792.595027] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [1478792.595066] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [1478792.599296] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [1478792.599451] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [1478792.600250] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [1478792.600358] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [1478792.600982] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [1478792.601098] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [1478792.601858] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [1478792.602612] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1478792.603349] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1478792.603349] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [1478792.603394] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1478792.604083] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [1478792.605335] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1478792.605335] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [1478792.607255] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [1478792.607990] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [1478793.295542] server nginx-pre-start[270]: nginx: the configuration file /nix/store/7wv2zw3whf4grx9xnxbdb37zv3ignyld-nginx.conf syntax is ok container-test-run-certificates> server # [1478793.295906] server nginx-pre-start[270]: nginx: configuration file /nix/store/7wv2zw3whf4grx9xnxbdb37zv3ignyld-nginx.conf test is successful container-test-run-certificates> server # [1478793.298312] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [1478793.298880] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [1478793.299522] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [1478794.026636] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1478794.028062] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [1478794.028099] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1478794.028121] server acme-order-renew-test.foo-start[273]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [1478794.028694] server acme-order-renew-test.foo-start[285]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [1478794.030016] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [1478794.030050] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1478794.030102] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [1478794.030131] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [1478794.039847] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.463156683Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [1478794.053950] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.477273832Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [1478794.063237] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.486569400Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [1478794.063237] server acme-order-renew-test.foo-start[286]: Your account credentials have been saved in your container-test-run-certificates> server # [1478794.063237] server acme-order-renew-test.foo-start[286]: configuration directory at "accounts". container-test-run-certificates> server # [1478794.063237] server acme-order-renew-test.foo-start[286]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [1478794.063237] server acme-order-renew-test.foo-start[286]: configuration directory will also contain private keys container-test-run-certificates> server # [1478794.063237] server acme-order-renew-test.foo-start[286]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [1478794.063237] server acme-order-renew-test.foo-start[286]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [1478794.063362] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.486630264Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [1478794.130366] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.553695249Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [1478794.130366] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.553707382Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [1478794.133048] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.556379024Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [1478794.133089] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.556416074Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [1478794.139045] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.562373043Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [1478794.139081] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.562402158Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [1478794.139105] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.562441442Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [1478794.139126] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.562462682Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [1478794.139163] server acme-order-renew-test.foo-start[286]: 2026-09-21T10:03:28.562499682Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [1478794.142302] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [1478794.143271] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1478794.143820] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [1478794.144573] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [1478794.144573] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [1478794.144602] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1478794.145280] server acme-order-renew-test.foo-start[305]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [1478794.145402] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [1478794.146085] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [1478794.146196] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [1478794.146893] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [1478794.147006] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [1478794.147754] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1478794.148604] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1478794.148615] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [1478794.148615] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1478794.149373] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [1478794.150597] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1478794.150606] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [1478794.150606] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [1478794.151327] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [1478794.152433] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> server # [1478794.270778] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [1478794.273425] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [1478794.273539] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> ca # [1478794.053725] ca step-ca[206]: time="2026-09-21T10:03:28Z" level=info duration="38.062µs" duration-ns=38062 fields.time="2026-09-21T10:03:28Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=95acec78-9a1e-434c-a172-7e1116681dd4 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478794.060190] ca step-ca[206]: time="2026-09-21T10:03:28Z" level=info duration=5.446328ms duration-ns=5446328 fields.time="2026-09-21T10:03:28Z" method=HEAD name=ca nonce=aVp1MHBoeVdqU0cydEtQVHZ0MXFUdXQ0VXVTUmJNclg path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=608240f0-b43f-473c-b963-ed222b09bdaa size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478794.063040] ca step-ca[206]: time="2026-09-21T10:03:28Z" level=info duration=1.870323ms duration-ns=1870323 fields.time="2026-09-21T10:03:28Z" method=POST name=ca nonce=NzlGUzdDZ2ZrQVBZNWh6cVg1Ylhybm8wb3VXRURjbzY path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=5106be0f-a71d-40b0-99e7-3e30e5adf377 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/AexwASqy4ZHkJk0c43NsjoI32WbKd1KV/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478794.066581] ca step-ca[206]: time="2026-09-21T10:03:28Z" level=info duration=2.56979ms duration-ns=2569790 fields.time="2026-09-21T10:03:28Z" method=POST name=ca nonce=U3Jqblg3amVSTXQzczlrM0hWR1k4R2J2U2hDbWlaTmc path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=39997c15-35b2-4014-9519-24b8e48d3ac1 response="{\"id\":\"2TQ493OMT3nJHXwYICTfCmSkQva0rba3\",\"status\":\"pending\",\"expires\":\"2026-09-22T10:03:28Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-21T10:02:28Z\",\"notAfter\":\"2026-12-20T10:03:28Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/3B07EJDBL6a9EU3qleOw3D8COenfYl2k\"],\"finalize\":\"https://ca.foo/acme/acme/order/2TQ493OMT3nJHXwYICTfCmSkQva0rba3/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478794.130163] ca step-ca[206]: time="2026-09-21T10:03:28Z" level=info duration=6.459186ms duration-ns=6459186 fields.time="2026-09-21T10:03:28Z" method=POST name=ca nonce=NzRwM2RFVjlDc1NJTUdXYmlUazA0ZE1iWkxIaVF2VHk path=/acme/acme/authz/3B07EJDBL6a9EU3qleOw3D8COenfYl2k protocol=HTTP/1.1 referer= remote-address="::1" request-id=967cc32a-294a-4442-8d09-36b14de6b214 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"3pCy8PESpKjP1VImVDqYjhtqD9veD6bJ\",\"url\":\"https://ca.foo/acme/acme/challenge/3B07EJDBL6a9EU3qleOw3D8COenfYl2k/ciHjEW4aHlJp6OKYTGDb80pE0xmDBlpt\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"3pCy8PESpKjP1VImVDqYjhtqD9veD6bJ\",\"url\":\"https://ca.foo/acme/acme/challenge/3B07EJDBL6a9EU3qleOw3D8COenfYl2k/exwkmqpwWoQ4lMEnQO8PxRMorPWn8vJd\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"3pCy8PESpKjP1VImVDqYjhtqD9veD6bJ\",\"url\":\"https://ca.foo/acme/acme/challenge/3B07EJDBL6a9EU3qleOw3D8COenfYl2k/hsBLwtHdnMPGFPYeXvzxLGGCV9R8JZzR\"}],\"wildcard\":false,\"expires\":\"2026-09-22T10:03:28Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478794.132888] ca step-ca[206]: time="2026-09-21T10:03:28Z" level=info duration=1.763902ms duration-ns=1763902 fields.time="2026-09-21T10:03:28Z" method=POST name=ca nonce=YlNOQzBlUHczRG5Bb0JnYXpGME9KbExKTlY2WmhXd3M path=/acme/acme/challenge/3B07EJDBL6a9EU3qleOw3D8COenfYl2k/exwkmqpwWoQ4lMEnQO8PxRMorPWn8vJd protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=823cff64-7930-4cb4-a806-df3e1aff0780 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"3pCy8PESpKjP1VImVDqYjhtqD9veD6bJ\",\"validated\":\"2026-09-21T10:03:28Z\",\"url\":\"https://ca.foo/acme/acme/challenge/3B07EJDBL6a9EU3qleOw3D8COenfYl2k/exwkmqpwWoQ4lMEnQO8PxRMorPWn8vJd\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478794.137528] ca step-ca[206]: time="2026-09-21T10:03:28Z" level=info duration=3.606312ms duration-ns=3606312 fields.time="2026-09-21T10:03:28Z" method=POST name=ca nonce=ZlE3dGZPT2sxV3UyTjk1Z21VZGE4akdkQ2V4bGplYWk path=/acme/acme/order/2TQ493OMT3nJHXwYICTfCmSkQva0rba3/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=8b80c5b2-26f8-48b1-9c25-bde1afbaee8a response="{\"id\":\"2TQ493OMT3nJHXwYICTfCmSkQva0rba3\",\"status\":\"valid\",\"expires\":\"2026-09-22T10:03:28Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-21T10:02:28Z\",\"notAfter\":\"2026-12-20T10:03:28Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/3B07EJDBL6a9EU3qleOw3D8COenfYl2k\"],\"finalize\":\"https://ca.foo/acme/acme/order/2TQ493OMT3nJHXwYICTfCmSkQva0rba3/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/QUBcwsBwXbKQ1Vg9mtAR1HmGyA9756zG\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1478794.138896] ca step-ca[206]: time="2026-09-21T10:03:28Z" level=info certificate="MIIB1zCCAX2gAwIBAgIQbDmRL5m3UxQuiU15v718rzAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MjExMDAyMjhaFw0yNjEyMjAxMDAzMjhaMBMxETAPBgNVBAMTCHRlc3QuZm9vMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5SOg2ghdtpQMQ3I7bSjfa2smGd1m9JGoO+gk1hbv+Ch/ztogQED1pbdI34MBPWKvllw9W0c4AkEELhSw2yzfaqOBpjCBozAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBRrKJ6XORYRCIrcZcN+LYzl0lmjuTAfBgNVHSMEGDAWgBTkiQTz+q7Xz9KfVwnTuf77OKRzEDATBgNVHREEDDAKggh0ZXN0LmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIgb62rlNK0GiF48uFYvmarh/uNI5FyWnEOV+Jijqt7FssCIQC2g6HMeuDf6TeMX2rscPf2BSz41yWzupSymFFKZke30Q==" duration="650.936µs" duration-ns=650936 fields.time="2026-09-21T10:03:28Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=Vm9kb0p5SGZNNTkwTDg5QzRSZXlxNWptZUlSaXhJUzA path=/acme/acme/certificate/QUBcwsBwXbKQ1Vg9mtAR1HmGyA9756zG protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=abb6b5af-70a2-4b78-a37a-4edbb2d11f7b sans="map[dns:[test.foo]]" serial=143855529186396399367434268940508691631 size=1352 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.4.1 (release; linux; amd64)" user-id= valid-from="2026-09-21T10:02:28Z" valid-to="2026-12-20T10:03:28Z" container-test-run-certificates> server # [1478794.949246] server nginx[323]: nginx: the configuration file /nix/store/7wv2zw3whf4grx9xnxbdb37zv3ignyld-nginx.conf syntax is ok container-test-run-certificates> server # [1478794.949519] server nginx[323]: nginx: configuration file /nix/store/7wv2zw3whf4grx9xnxbdb37zv3ignyld-nginx.conf test is successful container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 6.64 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [1478795.674606] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [1478795.674778] server systemd[1]: Startup finished in 6.246s. container-test-run-certificates> server # [1478795.824161] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [1478795.871463] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [1478795.871548] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [1478795.871568] server systemd[1]: nginx.service: Consumed 3.981s CPU time over 3.263s wall clock time. container-test-run-certificates> server # [1478795.872815] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.75 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 53578 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 47470 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> server # [1478796.561754] server nginx-pre-start[346]: nginx: the configuration file /nix/store/7wv2zw3whf4grx9xnxbdb37zv3ignyld-nginx.conf syntax is ok container-test-run-certificates> server # [1478796.562104] server nginx-pre-start[346]: nginx: configuration file /nix/store/7wv2zw3whf4grx9xnxbdb37zv3ignyld-nginx.conf test is successful container-test-run-certificates> server # [1478796.565708] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [932 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [79 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 21 10:02:28 2026 GMT container-test-run-certificates> * expire date: Dec 20 10:03:28 2026 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 53594 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1917 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.03 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> 6c:39:91:2f:99:b7:53:14:2e:89:4d:79:bf:bd:7c:af container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Sep 21 10:02:28 2026 GMT container-test-run-certificates> Not After : Dec 20 10:03:28 2026 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:e5:23:a0:da:08:5d:b6:94:0c:43:72:3b:6d:28: container-test-run-certificates> df:6b:6b:26:19:dd:66:f4:91:a8:3b:e8:24:d6:16: container-test-run-certificates> ef:f8:28:7f:ce:da:20:40:40:f5:a5:b7:48:df:83: container-test-run-certificates> 01:3d:62:af:96:5c:3d:5b:47:38:02:41:04:2e:14: container-test-run-certificates> b0:db:2c:df:6a container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> 6B:28:9E:97:39:16:11:08:8A:DC:65:C3:7E:2D:8C:E5:D2:59:A3:B9 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> E4:89:04:F3:FA:AE:D7:CF:D2:9F:57:09:D3:B9:FE:FB:38:A4:73:10 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:45:02:20:6f:ad:ab:94:d2:b4:1a:21:78:f2:e1:58:be:66: container-test-run-certificates> ab:87:fb:8d:23:91:72:5a:71:0e:57:e2:62:8e:ab:7b:16:cb: container-test-run-certificates> 02:21:00:b6:83:a1:cc:7a:e0:df:e9:37:8c:5f:6a:ec:70:f7: container-test-run-certificates> f6:05:2c:f8:d7:25:b3:ba:94:b2:98:51:4a:66:47:b7:d1 container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds) container-test-run-certificates> (finished: run the VM test script, in 17.83 seconds) container-test-run-certificates> test script finished in 18.10s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 446) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> kill NspawnMachine (pid 443) container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.24 seconds) container-test-run-certificates> Container server terminated by signal KILL. post-build step Upload to niks3: ok time=2026-09-21T10:03:32.912Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)" time=2026-09-21T10:03:33.529Z level=INFO msg="Uploading 1 narinfos" time=2026-09-21T10:03:33.596Z level=INFO msg="Upload complete. (807ms)"