these 8 derivations will be built:
  /nix/store/aknimddwnfa9ypw74ajj4g38969i8mpl-system-units.drv
  /nix/store/104x9si8lmnm5s3bbddglc8b8vlpmsa8-etc.drv
  /nix/store/fis5qwbx06r95421ncys32ny48fvzj35-activate.drv
  /nix/store/s39ibkh7s0cqmczlw4f05nxbprdi20f3-nixos-system-machine-test.drv
  /nix/store/89z2v8zc4dclcbqqy8ia8jfb516wa1ff-run-machine-nspawn.drv
  /nix/store/ndnip7h6p890y2phj9k5lcrym6qaxh57-driverConfiguration.json.drv
  /nix/store/yr6v7r58d3ch1p4fg2855ivckrq8zyw9-nixos-test-driver-user-firewall-nftables.drv
  /nix/store/d3rklbls77szpbwqlw793c4hbziggckm-container-test-run-user-firewall-nftables.drv
building '/nix/store/aknimddwnfa9ypw74ajj4g38969i8mpl-system-units.drv'
building '/nix/store/104x9si8lmnm5s3bbddglc8b8vlpmsa8-etc.drv'
building '/nix/store/fis5qwbx06r95421ncys32ny48fvzj35-activate.drv'
activate> structuredAttrs is enabled
building '/nix/store/s39ibkh7s0cqmczlw4f05nxbprdi20f3-nixos-system-machine-test.drv'
nixos-system-machine-test> structuredAttrs is enabled
building '/nix/store/89z2v8zc4dclcbqqy8ia8jfb516wa1ff-run-machine-nspawn.drv'
building '/nix/store/ndnip7h6p890y2phj9k5lcrym6qaxh57-driverConfiguration.json.drv'
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/yr6v7r58d3ch1p4fg2855ivckrq8zyw9-nixos-test-driver-user-firewall-nftables.drv'
nixos-test-driver-user-firewall-nftables> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-user-firewall-nftables> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-user-firewall-nftables> All checks passed!
nixos-test-driver-user-firewall-nftables> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-user-firewall-nftables> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-user-firewall-nftables> All checks passed!
building '/nix/store/d3rklbls77szpbwqlw793c4hbziggckm-container-test-run-user-firewall-nftables.drv' on 'ssh-ng://builder@build-x86-01.clan.lol'
building '/nix/store/d3rklbls77szpbwqlw793c4hbziggckm-container-test-run-user-firewall-nftables.drv'
container-test-run-user-firewall-nftables> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-user-firewall-nftables> start all VLans
container-test-run-user-firewall-nftables> (finished: start all VLans, in 0.00 seconds)
container-test-run-user-firewall-nftables> 
container-test-run-user-firewall-nftables> Test will time out and terminate in 3600.0 seconds
container-test-run-user-firewall-nftables> run the VM test script
container-test-run-user-firewall-nftables> additionally exposed symbols:
container-test-run-user-firewall-nftables>     machine, router,
container-test-run-user-firewall-nftables>     vlan1,
container-test-run-user-firewall-nftables>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-user-firewall-nftables> start all VMs
container-test-run-user-firewall-nftables> machine: systemd-nspawn running (pid 52)
container-test-run-user-firewall-nftables> router: systemd-nspawn running (pid 53)
container-test-run-user-firewall-nftables> router: Waiting for journal at /build/vm-state-router/var/log/journal...
container-test-run-user-firewall-nftables> machine: Waiting for journal at /build/vm-state-machine/var/log/journal...
container-test-run-user-firewall-nftables> (finished: start all VMs, in 0.00 seconds)
container-test-run-user-firewall-nftables> router: waiting for unit multi-user.target
container-test-run-user-firewall-nftables> nixos-nspawn(machine): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-user-firewall-nftables> nixos-nspawn(machine): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-user-firewall-nftables> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-user-firewall-nftables> nixos-nspawn(router): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-user-firewall-nftables> nixos-nspawn(router): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-user-firewall-nftables> ░ Spawning container machine on /build/vm-state-machine.
container-test-run-user-firewall-nftables> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-user-firewall-nftables> ░ Spawning container router on /build/vm-state-router.
container-test-run-user-firewall-nftables> router # [1583242.497013] router systemd-journald[57]: Journal started
container-test-run-user-firewall-nftables> router # [1583242.497057] router systemd-journald[57]: Runtime Journal (/run/log/journal/2b5000b30d574dbcafc58230982c74d4) is 8M, max 3.7G, 3.7G free.
container-test-run-user-firewall-nftables> router # [1583242.513110] router systemd[1]: Finished Apply Kernel Variables.
container-test-run-user-firewall-nftables> router # [1583242.528105] router systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-user-firewall-nftables> router # [1583242.540451] router systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-user-firewall-nftables> router # [1583242.543074] router systemd[1]: Starting Network Name Resolution...
container-test-run-user-firewall-nftables> router # [1583242.560028] router systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-user-firewall-nftables> router # [1583242.565683] router systemd-journald[57]: Time spent on flushing to /var/log/journal/2b5000b30d574dbcafc58230982c74d4 is 1.261ms for 7 entries.
container-test-run-user-firewall-nftables> router # [1583242.565683] router systemd-journald[57]: System Journal (/var/log/journal/2b5000b30d574dbcafc58230982c74d4) is 8M, max 4G, 3.9G free.
container-test-run-user-firewall-nftables> router # [1583242.600569] router systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-user-firewall-nftables> router # [1583242.601085] router systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-user-firewall-nftables> router # [1583242.602552] router systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-user-firewall-nftables> router # [1583242.602636] router systemd[1]: Reached target Local File Systems.
container-test-run-user-firewall-nftables> router # [1583242.603238] router systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-user-firewall-nftables> router # [1583242.603273] router systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> router # [1583242.604084] router systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-user-firewall-nftables> router # [1583242.604567] router systemd[1]: Starting Create System Files and Directories...
container-test-run-user-firewall-nftables> router # [1583242.604588] router systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-user-firewall-nftables> router # [1583242.605292] router systemd[1]: Starting Network Management...
container-test-run-user-firewall-nftables> router # [1583242.640937] router systemd-tmpfiles[71]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> router # [1583242.641142] router systemd-tmpfiles[71]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> router # [1583242.641270] router systemd-tmpfiles[71]: fchmod() of /var/log/journal/2b5000b30d574dbcafc58230982c74d4 failed: Operation not permitted
container-test-run-user-firewall-nftables> router # [1583242.641459] router systemd-tmpfiles[71]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> router # [1583242.642844] router systemd[1]: Finished Create System Files and Directories.
container-test-run-user-firewall-nftables> router # [1583242.643810] router systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-user-firewall-nftables> router # [1583242.644487] router systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-user-firewall-nftables> router # [1583242.653232] router systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-user-firewall-nftables> router # [1583242.660776] router systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-user-firewall-nftables> router # [1583242.661400] router systemd[1]: Starting Update is Completed...
container-test-run-user-firewall-nftables> router # [1583242.671078] router systemd[1]: Finished Update is Completed.
container-test-run-user-firewall-nftables> router # [1583242.736590] router systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-user-firewall-nftables> machine # [1583242.509339] machine systemd-journald[57]: Journal started
container-test-run-user-firewall-nftables> machine # [1583242.509378] machine systemd-journald[57]: Runtime Journal (/run/log/journal/ce79aaa84df447b79438d6c85e109306) is 8M, max 3.7G, 3.7G free.
container-test-run-user-firewall-nftables> machine # [1583242.516827] machine systemd[1]: Finished Apply Kernel Variables.
container-test-run-user-firewall-nftables> machine # [1583242.528946] machine systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-user-firewall-nftables> machine # [1583242.539240] machine systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-user-firewall-nftables> machine # [1583242.539585] machine systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-user-firewall-nftables> machine # [1583242.566220] machine systemd-journald[57]: Time spent on flushing to /var/log/journal/ce79aaa84df447b79438d6c85e109306 is 1.298ms for 6 entries.
container-test-run-user-firewall-nftables> machine # [1583242.566220] machine systemd-journald[57]: System Journal (/var/log/journal/ce79aaa84df447b79438d6c85e109306) is 8M, max 4G, 3.9G free.
container-test-run-user-firewall-nftables> machine # [1583242.600873] machine systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-user-firewall-nftables> machine # [1583242.601174] machine systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-user-firewall-nftables> machine # [1583242.602396] machine systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-user-firewall-nftables> machine # [1583242.602478] machine systemd[1]: Reached target Local File Systems.
container-test-run-user-firewall-nftables> machine # [1583242.603142] machine systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-user-firewall-nftables> machine # [1583242.603179] machine systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> machine # [1583242.603904] machine systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-user-firewall-nftables> machine # [1583242.604441] machine systemd[1]: Starting Create System Files and Directories...
container-test-run-user-firewall-nftables> machine # [1583242.604462] machine systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-user-firewall-nftables> machine # [1583242.638470] machine systemd-tmpfiles[69]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> machine # [1583242.638626] machine systemd-tmpfiles[69]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> machine # [1583242.638730] machine systemd-tmpfiles[69]: fchmod() of /var/log/journal/ce79aaa84df447b79438d6c85e109306 failed: Operation not permitted
container-test-run-user-firewall-nftables> machine # [1583242.638910] machine systemd-tmpfiles[69]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-user-firewall-nftables> machine # [1583242.640176] machine systemd[1]: Finished Create System Files and Directories.
container-test-run-user-firewall-nftables> machine # [1583242.640938] machine systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-user-firewall-nftables> machine # [1583242.641337] machine systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-user-firewall-nftables> machine # [1583242.648578] machine systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-user-firewall-nftables> machine # [1583242.658196] machine systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-user-firewall-nftables> machine # [1583242.658843] machine systemd[1]: Starting Update is Completed...
container-test-run-user-firewall-nftables> machine # [1583242.666930] machine systemd[1]: Finished Update is Completed.
container-test-run-user-firewall-nftables> machine # [1583242.667031] machine systemd[1]: Reached target System Initialization.
container-test-run-user-firewall-nftables> machine # [1583242.667097] machine systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> machine # [1583242.667126] machine systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-user-firewall-nftables> machine # [1583242.667140] machine systemd[1]: Reached target Timer Units.
container-test-run-user-firewall-nftables> machine # [1583242.667241] machine systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-user-firewall-nftables> machine # [1583242.667336] machine systemd[1]: Listening on Nix Daemon Socket.
container-test-run-user-firewall-nftables> machine # [1583242.667425] machine systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-user-firewall-nftables> machine # [1583242.667441] machine systemd[1]: Reached target Socket Units.
container-test-run-user-firewall-nftables> machine # [1583242.667470] machine systemd[1]: Reached target Basic System.
container-test-run-user-firewall-nftables> machine # [1583242.670071] machine systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-user-firewall-nftables> machine # [1583242.671925] machine systemd[1]: Starting nftables firewall...
container-test-run-user-firewall-nftables> machine # [1583242.674063] machine systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> machine # [1583242.684157] machine systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-user-firewall-nftables> machine # [1583242.736569] machine systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-user-firewall-nftables> machine # [1583242.743721] machine systemd[1]: Finished nftables firewall.
container-test-run-user-firewall-nftables> machine # [1583242.743875] machine systemd[1]: Reached target Preparation for Network.
container-test-run-user-firewall-nftables> machine # [1583242.744701] machine systemd[1]: Starting Address configuration of eth1...
container-test-run-user-firewall-nftables> machine # [1583242.745425] machine systemd[1]: Starting Extra networking commands....
container-test-run-user-firewall-nftables> machine # [1583242.746033] machine systemd[1]: Starting Setup wg0 dummy interface...
container-test-run-user-firewall-nftables> machine # [1583242.775465] machine network-addresses-eth1-start[95]: adding address 192.168.1.1/24... done
container-test-run-user-firewall-nftables> machine # [1583242.775460] machine systemd[1]: Finished Setup wg0 dummy interface.
container-test-run-user-firewall-nftables> machine # [1583242.776919] machine network-addresses-eth1-start[95]: adding address 2001:db8:1::1/64... done
container-test-run-user-firewall-nftables> machine # [1583242.779639] machine systemd[1]: Finished Address configuration of eth1.
container-test-run-user-firewall-nftables> machine # [1583242.805740] machine systemd[1]: nscd.service: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [1583242.805888] machine systemd[1]: Stopped Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> machine # [1583242.810076] machine systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> machine # [1583242.826708] machine systemd[1]: Finished Extra networking commands..
container-test-run-user-firewall-nftables> machine # [1583242.826918] machine systemd[1]: Reached target Network.
container-test-run-user-firewall-nftables> machine # [1583242.831069] machine systemd[1]: Starting Nginx Web Server...
container-test-run-user-firewall-nftables> machine # [1583243.187336] machine nsncd[157]: Sep 22 15:04:17.610 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-user-firewall-nftables> machine # [1583243.187450] machine systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> machine # [1583243.187513] machine systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-user-firewall-nftables> machine # [1583243.187556] machine systemd[1]: Reached target User and Group Name Lookups.
container-test-run-user-firewall-nftables> machine # [1583243.188475] machine systemd[1]: Starting User Login Management...
container-test-run-user-firewall-nftables> machine # [1583243.188903] machine systemd[1]: Starting Permit User Sessions...
container-test-run-user-firewall-nftables> machine # [1583243.216379] machine systemd[1]: Finished Permit User Sessions.
container-test-run-user-firewall-nftables> machine # [1583243.216968] machine systemd[1]: Started Console Getty.
container-test-run-user-firewall-nftables> machine # [1583243.216989] machine systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-user-firewall-nftables> machine # [1583243.217001] machine systemd[1]: Reached target Login Prompts.
container-test-run-user-firewall-nftables> machine # [1583243.497996] machine systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-user-firewall-nftables> router # [1583243.487237] router systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-user-firewall-nftables> router # [1583243.634914] router systemd-networkd[72]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> router # [1583243.634992] router systemd-networkd[72]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-user-firewall-nftables> router # [1583243.642689] router systemd-networkd[72]: lo: Link UP
container-test-run-user-firewall-nftables> router # [1583243.642694] router systemd-networkd[72]: lo: Gained carrier
container-test-run-user-firewall-nftables> router # [1583243.642856] router systemd-networkd[72]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-user-firewall-nftables> router # [1583243.643135] router systemd[1]: Started Network Management.
container-test-run-user-firewall-nftables> router # [1583243.643192] router systemd-networkd[72]: eth1: Link UP
container-test-run-user-firewall-nftables> router # [1583243.643361] router systemd-networkd[72]: eth1: Gained carrier
container-test-run-user-firewall-nftables> router # [1583243.644262] router systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-user-firewall-nftables> router # [1583243.670272] router systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-user-firewall-nftables> machine # [1583243.830657] machine nginx-pre-start[192]: nginx: the configuration file /nix/store/mp3wzdfijj3d4khzfr47qwcrcsnjn8r9-nginx.conf syntax is ok
container-test-run-user-firewall-nftables> machine # [1583243.831016] machine nginx-pre-start[192]: nginx: configuration file /nix/store/mp3wzdfijj3d4khzfr47qwcrcsnjn8r9-nginx.conf test is successful
container-test-run-user-firewall-nftables> machine # [1583243.842683] machine systemd[1]: Started Nginx Web Server.
container-test-run-user-firewall-nftables> machine # [1583243.921009] machine systemd-logind[182]: New seat seat0.
container-test-run-user-firewall-nftables> machine # [1583243.922097] machine systemd[1]: Starting D-Bus System Message Bus...
container-test-run-user-firewall-nftables> machine # [1583243.922195] machine systemd[1]: Started User Login Management.
container-test-run-user-firewall-nftables> machine # [1583243.922845] machine systemd[1]: Starting linger-users.service...
container-test-run-user-firewall-nftables> machine # [1583243.951342] machine systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [1583243.951578] machine systemd[1]: Finished linger-users.service.
container-test-run-user-firewall-nftables> machine # [1583243.951779] machine systemd[1]: Reached target Multi-User System.
container-test-run-user-firewall-nftables> machine # [1583244.713465] machine dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-user-firewall-nftables> machine # [1583244.717031] machine dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync'
container-test-run-user-firewall-nftables> machine # [1583244.717031] machine dbus-broker-launch[198]: Invalid user-name in /nix/store/3h0vxspwk6i2zrimwnqzdl6i7wy4s4dg-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-user-firewall-nftables> machine # [1583244.719147] machine systemd[1]: Started D-Bus System Message Bus.
container-test-run-user-firewall-nftables> machine # [1583244.719558] machine systemd[1]: Startup finished in 2.579s.
container-test-run-user-firewall-nftables> machine # [1583244.731883] machine dbus-broker-launch[198]: Ready
container-test-run-user-firewall-nftables> router # [1583244.945600] router systemd-resolved[64]: Positive Trust Anchors:
container-test-run-user-firewall-nftables> router # [1583244.945610] router systemd-resolved[64]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-user-firewall-nftables> router # [1583244.945615] router systemd-resolved[64]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-user-firewall-nftables> router # [1583244.945641] router systemd-resolved[64]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-user-firewall-nftables> router # [1583244.962686] router systemd-resolved[64]: Using system hostname 'router'.
container-test-run-user-firewall-nftables> router # [1583244.964055] router systemd[1]: Started Network Name Resolution.
container-test-run-user-firewall-nftables> router # [1583244.964149] router systemd[1]: Reached target Network.
container-test-run-user-firewall-nftables> router # [1583244.964200] router systemd[1]: Reached target System Initialization.
container-test-run-user-firewall-nftables> router # [1583244.964236] router systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-user-firewall-nftables> router # [1583244.964258] router systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-user-firewall-nftables> router # [1583244.964269] router systemd[1]: Reached target Timer Units.
container-test-run-user-firewall-nftables> router # [1583244.964379] router systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-user-firewall-nftables> router # [1583244.967417] router systemd[1]: Listening on Nix Daemon Socket.
container-test-run-user-firewall-nftables> router # [1583244.967537] router systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-user-firewall-nftables> router # [1583244.967553] router systemd[1]: Reached target Socket Units.
container-test-run-user-firewall-nftables> router # [1583244.967584] router systemd[1]: Reached target Basic System.
container-test-run-user-firewall-nftables> router # [1583244.970074] router systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-user-firewall-nftables> router # [1583244.970947] router systemd[1]: Starting Nginx Web Server...
container-test-run-user-firewall-nftables> router # [1583244.973082] router systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-user-firewall-nftables> router # [1583244.987329] router systemd[1]: Starting D-Bus System Message Bus...
container-test-run-user-firewall-nftables> router # [1583245.003030] router systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-user-firewall-nftables> router # [1583245.226387] router nsncd[87]: Sep 22 15:04:19.649 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-user-firewall-nftables> router # [1583245.226531] router systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-user-firewall-nftables> router # [1583245.226625] router systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-user-firewall-nftables> router # [1583245.226679] router systemd[1]: Reached target User and Group Name Lookups.
container-test-run-user-firewall-nftables> router # [1583245.227784] router systemd[1]: Starting User Login Management...
container-test-run-user-firewall-nftables> router # [1583245.228494] router systemd[1]: Starting Permit User Sessions...
container-test-run-user-firewall-nftables> router # [1583245.248753] router systemd[1]: Finished Permit User Sessions.
container-test-run-user-firewall-nftables> router # [1583245.250128] router systemd[1]: Started Console Getty.
container-test-run-user-firewall-nftables> router # [1583245.250159] router systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-user-firewall-nftables> router # [1583245.250175] router systemd[1]: Reached target Login Prompts.
container-test-run-user-firewall-nftables> router # [1583245.405572] router dbus-broker-launch[88]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-user-firewall-nftables> router # [1583245.406183] router dbus-broker-launch[88]: NSS returned no entry for 'systemd-timesync'
container-test-run-user-firewall-nftables> router # [1583245.406183] router dbus-broker-launch[88]: Invalid user-name in /nix/store/md88dwyvb0nscqqpcyx7s8mmkkp9fyig-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-user-firewall-nftables> router # [1583245.406644] router systemd[1]: Started D-Bus System Message Bus.
container-test-run-user-firewall-nftables> router # [1583245.412409] router dbus-broker-launch[88]: Ready
container-test-run-user-firewall-nftables> router # [1583245.570086] router systemd-networkd[72]: eth1: Gained IPv6LL
container-test-run-user-firewall-nftables> router: (finished: waiting for unit multi-user.target, in 5.65 seconds)
container-test-run-user-firewall-nftables> router: waiting for TCP port 80 on localhost
container-test-run-user-firewall-nftables> router # [1583247.120041] router nginx-pre-start[117]: nginx: the configuration file /nix/store/8pm198x2afdnw4pfhzda47gzyd82xsw7-nginx.conf syntax is ok
container-test-run-user-firewall-nftables> router # [1583247.120041] router nginx-pre-start[117]: nginx: configuration file /nix/store/8pm198x2afdnw4pfhzda47gzyd82xsw7-nginx.conf test is successful
container-test-run-user-firewall-nftables> router # [1583247.131113] router systemd[1]: Started Nginx Web Server.
container-test-run-user-firewall-nftables> router # [1583247.229173] router systemd-logind[105]: New seat seat0.
container-test-run-user-firewall-nftables> router # [1583247.229362] router systemd[1]: Started User Login Management.
container-test-run-user-firewall-nftables> router # [1583247.230502] router systemd[1]: Starting linger-users.service...
container-test-run-user-firewall-nftables> router # [1583247.260449] router systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-user-firewall-nftables> router # [1583247.260667] router systemd[1]: Finished linger-users.service.
container-test-run-user-firewall-nftables> router # [1583247.261073] router systemd[1]: Reached target Multi-User System.
container-test-run-user-firewall-nftables> router # [1583247.265110] router systemd[1]: Startup finished in 5.119s.
container-test-run-user-firewall-nftables> Connection to localhost (::1) 80 port [tcp/http] succeeded!
container-test-run-user-firewall-nftables> router: (finished: waiting for TCP port 80 on localhost, in 1.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit multi-user.target
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit multi-user.target, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit nginx.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit nginx.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> router: must succeed: ip -4 addr show eth1 | grep -oP '(?<=inet\s)\d+(\.\d+){3}'
container-test-run-user-firewall-nftables> router: (finished: must succeed: ip -4 addr show eth1 | grep -oP '(?<=inet\s)\d+(\.\d+){3}', in 0.01 seconds)
container-test-run-user-firewall-nftables> router: must succeed: ip -6 addr show eth1 | grep -oP '(?<=inet6\s)[0-9a-f:]+' | grep -v '^fe80' | head -1
container-test-run-user-firewall-nftables> router: (finished: must succeed: ip -6 addr show eth1 | grep -oP '(?<=inet6\s)[0-9a-f:]+' | grep -v '^fe80' | head -1, in 0.01 seconds)
container-test-run-user-firewall-nftables> Router IPv4: 192.168.1.2
container-test-run-user-firewall-nftables> Router IPv6: 2001:db8:1::2
container-test-run-user-firewall-nftables> machine: must succeed: systemctl restart nftables
container-test-run-user-firewall-nftables> machine: (finished: must succeed: systemctl restart nftables, in 0.13 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit nftables.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit nftables.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: nft list table inet user-firewall >&2
container-test-run-user-firewall-nftables> table inet user-firewall {
container-test-run-user-firewall-nftables> 	chain output {
container-test-run-user-firewall-nftables> 		type filter hook output priority filter; policy accept;
container-test-run-user-firewall-nftables> 		oifname "lo" counter packets 0 bytes 0 accept comment "allow lo"
container-test-run-user-firewall-nftables> 		oifname "tun*" counter packets 0 bytes 0 accept comment "allow tun*"
container-test-run-user-firewall-nftables> 		oifname "tap*" counter packets 0 bytes 0 accept comment "allow tap*"
container-test-run-user-firewall-nftables> 		oifname "wg*" counter packets 0 bytes 0 accept comment "allow wg*"
container-test-run-user-firewall-nftables> 		oifname "tailscale*" counter packets 0 bytes 0 accept comment "allow tailscale*"
container-test-run-user-firewall-nftables> 		oifname "zt*" counter packets 0 bytes 0 accept comment "allow zt*"
container-test-run-user-firewall-nftables> 		oifname "vpn*" counter packets 0 bytes 0 accept comment "allow vpn*"
container-test-run-user-firewall-nftables> 		oifname "ipsec*" counter packets 0 bytes 0 accept comment "allow ipsec*"
container-test-run-user-firewall-nftables> 		oifname "nebula*" counter packets 0 bytes 0 accept comment "allow nebula*"
container-test-run-user-firewall-nftables> 		oifname "tinc*" counter packets 0 bytes 0 accept comment "allow tinc*"
container-test-run-user-firewall-nftables> 		oifname "edge*" counter packets 0 bytes 0 accept comment "allow edge*"
container-test-run-user-firewall-nftables> 		oifname "hyprspace" counter packets 0 bytes 0 accept comment "allow hyprspace"
container-test-run-user-firewall-nftables> 		oifname "ham0" counter packets 0 bytes 0 accept comment "allow ham0"
container-test-run-user-firewall-nftables> 		oifname "easytier" counter packets 0 bytes 0 accept comment "allow easytier"
container-test-run-user-firewall-nftables> 		oifname "mycelium" counter packets 0 bytes 0 accept comment "allow mycelium"
container-test-run-user-firewall-nftables> 		meta skuid 1002 counter packets 0 bytes 0 reject comment "blocked user bob"
container-test-run-user-firewall-nftables> 	}
container-test-run-user-firewall-nftables> }
container-test-run-user-firewall-nftables> machine: (finished: must succeed: nft list table inet user-firewall >&2, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080
container-test-run-user-firewall-nftables> machine: (finished: waiting for success: runuser -u alice -- curl -s http://127.0.0.1:8080, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s http://192.168.1.2
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s http://192.168.1.2, in 0.03 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s http://[2001:db8:1::2]
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s http://[2001:db8:1::2], in 0.03 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s http://127.0.0.1:8080
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s http://127.0.0.1:8080, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://192.168.1.2 2>&1 || echo 'EXIT_CODE='$?
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://192.168.1.2 2>&1 || echo 'EXIT_CODE='$?, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://[2001:db8:1::2] 2>&1 || echo 'EXIT_CODE='$?
container-test-run-user-firewall-nftables> machine # [1583248.509429] machine systemd[1]: Stopping nftables firewall...
container-test-run-user-firewall-nftables> machine # [1583248.560622] machine systemd[1]: nftables.service: Deactivated successfully.
container-test-run-user-firewall-nftables> machine # [1583248.560825] machine systemd[1]: Stopped nftables firewall.
container-test-run-user-firewall-nftables> machine # [1583248.562648] machine systemd[1]: Starting nftables firewall...
container-test-run-user-firewall-nftables> machine # [1583248.626333] machine systemd[1]: Finished nftables firewall.
container-test-run-user-firewall-nftables> machine # [1583248.662449] machine runuser[228]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [1583248.672047] machine runuser[228]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [1583248.690658] machine runuser[230]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [1583248.700080] machine runuser[230]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [1583248.714415] machine runuser[232]: pam_unix(runuser:session): session opened for user alice(uid=1001) by (uid=0)
container-test-run-user-firewall-nftables> machine # [1583248.726165] machine runuser[232]: pam_unix(runuser:session): session closed for user alice
container-test-run-user-firewall-nftables> machine # [1583248.737266] machine runuser[234]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine # [1583248.745666] machine runuser[234]: pam_unix(runuser:session): session closed for user bob
container-test-run-user-firewall-nftables> machine # [1583248.751816] machine runuser[237]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine # [1583248.758108] machine runuser[237]: pam_unix(runuser:session): session closed for user bob
container-test-run-user-firewall-nftables> machine # [1583248.764287] machine runuser[240]: pam_unix(runuser:session): session opened for user bob(uid=1002) by (uid=0)
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --connect-timeout 2 http://[2001:db8:1::2] 2>&1 || echo 'EXIT_CODE='$?, in 1.04 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: nft list table inet user-firewall
container-test-run-user-firewall-nftables> machine: (finished: must succeed: nft list table inet user-firewall, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit setup-wg0-interface.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit setup-wg0-interface.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for unit nginx.service
container-test-run-user-firewall-nftables> machine: (finished: waiting for unit nginx.service, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: waiting for TCP port 8081 on 10.100.0.2
container-test-run-user-firewall-nftables> Connection to 10.100.0.2 8081 port [tcp/sunproxyadmin] succeeded!
container-test-run-user-firewall-nftables> machine: (finished: waiting for TCP port 8081 on 10.100.0.2, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: ip link show wg0
container-test-run-user-firewall-nftables> machine: (finished: must succeed: ip link show wg0, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: ip addr show wg0
container-test-run-user-firewall-nftables> machine: (finished: must succeed: ip addr show wg0, in 0.01 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s --interface wg0 http://10.100.0.2:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s --interface wg0 http://10.100.0.2:8081/, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u alice -- curl -s --interface wg0 http://[fd00::2]:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u alice -- curl -s --interface wg0 http://[fd00::2]:8081/, in 0.03 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --interface wg0 http://10.100.0.2:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --interface wg0 http://10.100.0.2:8081/, in 0.03 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: runuser -u bob -- curl -s --interface wg0 http://[fd00::2]:8081/
container-test-run-user-firewall-nftables> machine: (finished: must succeed: runuser -u bob -- curl -s --interface wg0 http://[fd00::2]:8081/, in 0.02 seconds)
container-test-run-user-firewall-nftables> machine: must succeed: nft list table inet user-firewall | grep -E 'oifname.*wg' >&2
container-test-run-user-firewall-nftables> 		oifname "wg*" counter packets 0 bytes 0 accept comment "allow wg*"
container-test-run-user-firewall-nftables> machine: (finished: must succeed: nft list table inet user-firewall | grep -E 'oifname.*wg' >&2, in 0.01 seconds)
container-test-run-user-firewall-nftables> (finished: run the VM test script, in 8.15 seconds)
container-test-run-user-firewall-nftables> test script finished in 8.25s
container-test-run-user-firewall-nftables> cleanup
container-test-run-user-firewall-nftables> kill NspawnMachine (pid 52)
container-test-run-user-firewall-nftables> kill NspawnMachine (pid 53)
container-test-run-user-firewall-nftables> Container machine terminated by signal KILL.
container-test-run-user-firewall-nftables> (finished: cleanup, in 0.18 seconds)
container-test-run-user-firewall-nftables> Container router terminated by signal KILL.

post-build step Upload to niks3: ok
time=2026-09-22T15:04:25.034Z level=INFO msg="Uploading 0 paths to niks3.clan.lol (1 already cached)"
time=2026-09-22T15:04:25.601Z level=INFO msg="Uploading 1 narinfos"
time=2026-09-22T15:04:27.106Z level=INFO msg="Upload complete. (2.171s)"