don't know how to build these paths: /nix/store/3xv87yzfs7vn04rxj8kdcqhi07jj9ign-container-test-run-certificates.drv warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/l3gy5rpzmph06j70wx9zrf4pqxq0215x-unit-acme-order-renew-ca.foo.service.drv' on nix-store.geninf.io:50051 unit-acme-order-renew-ca.foo.service> gi-build-x86-02: building l3gy5rpzmph06j70wx9zrf4pqxq0215x-unit-acme-order-renew-ca.foo.service.drv unit-acme-order-renew-ca.foo.service> structuredAttrs is enabled building '/nix/store/g402kadfs514p5y0vmfd2dng1wg2g38v-unit-acme-order-renew-test.foo.service.drv' on nix-store.geninf.io:50051 unit-acme-order-renew-test.foo.service> gi-build-x86-02: building g402kadfs514p5y0vmfd2dng1wg2g38v-unit-acme-order-renew-test.foo.service.drv unit-acme-order-renew-test.foo.service> structuredAttrs is enabled building '/nix/store/i74aflxqn97zywn6ch2z0ilmy1ld1l7h-system-units.drv' on nix-store.geninf.io:50051 system-units> gi-build-x86-02: building i74aflxqn97zywn6ch2z0ilmy1ld1l7h-system-units.drv building '/nix/store/ahfp4nxs5ls2jyw7asn536a1886ikyz4-system-units.drv' on nix-store.geninf.io:50051 system-units> gi-build-x86-02: building ahfp4nxs5ls2jyw7asn536a1886ikyz4-system-units.drv building '/nix/store/584xl8zmsb7v4ddy5lv06ccji2pwblhy-etc.drv' on nix-store.geninf.io:50051 etc> gi-build-x86-02: building 584xl8zmsb7v4ddy5lv06ccji2pwblhy-etc.drv building '/nix/store/67cpmjgy0jrwprv8m46r3vhld55qz389-activate.drv' on nix-store.geninf.io:50051 activate> gi-build-x86-02: building 67cpmjgy0jrwprv8m46r3vhld55qz389-activate.drv activate> structuredAttrs is enabled 7k62g4i17kq6phylihp97znlhs04i1hl-nixos-system-server-test.drv: build-x86-01: not scheduled here: 7k62g4i17kq6phylihp97znlhs04i1hl-nixos-system-server-test.drv, asking the scheduler again building '/nix/store/7k62g4i17kq6phylihp97znlhs04i1hl-nixos-system-server-test.drv' on nix-store.geninf.io:50051 nixos-system-server-test> build-x86-01: building 7k62g4i17kq6phylihp97znlhs04i1hl-nixos-system-server-test.drv nixos-system-server-test> structuredAttrs is enabled gljci1s79qnb5l6v7ilp2z47wxlf8wfq-run-server-nspawn.drv: error: gRPC QueryValidPaths on 'nix-store.geninf.io:50051' failed: error: substituter 'https://cache.clan.lol' is disabled building '/nix/store/pq5ps2k9vxplsc2icdajc3p2knvf6kyq-etc.drv' on nix-store.geninf.io:50051 etc> gi-build-x86-01: building pq5ps2k9vxplsc2icdajc3p2knvf6kyq-etc.drv building '/nix/store/sybaqbvdwsfghf0a2lm72gvd387zy7zm-activate.drv' on nix-store.geninf.io:50051 activate> gi-build-x86-02: building sybaqbvdwsfghf0a2lm72gvd387zy7zm-activate.drv activate> structuredAttrs is enabled building '/nix/store/vdli1d05jwhj39fj82xrh97043sddfvs-nixos-system-ca-test.drv' on nix-store.geninf.io:50051 nixos-system-ca-test> gi-build-x86-02: building vdli1d05jwhj39fj82xrh97043sddfvs-nixos-system-ca-test.drv nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/lbl03mh9rdvx7piqgzzcxg32vrs2pmcq-run-ca-nspawn.drv' on nix-store.geninf.io:50051 run-ca-nspawn> gi-build-x86-02: building lbl03mh9rdvx7piqgzzcxg32vrs2pmcq-run-ca-nspawn.drv error: dependency 'wkxa62rpkrcaq9p80bjrp19nmrwj5jz0-nixos-test-driver-certificates.drv' failed nixbot: transient error detected, retrying once don't know how to build these paths: /nix/store/3xv87yzfs7vn04rxj8kdcqhi07jj9ign-container-test-run-certificates.drv warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/gljci1s79qnb5l6v7ilp2z47wxlf8wfq-run-server-nspawn.drv' on nix-store.geninf.io:50051 run-server-nspawn> build-x86-01: building gljci1s79qnb5l6v7ilp2z47wxlf8wfq-run-server-nspawn.drv building '/nix/store/b9dl8falafsppsvwxqw88an91ik4y7cx-driverConfiguration.json.drv' on nix-store.geninf.io:50051 driverConfiguration.json> build-x86-01: building b9dl8falafsppsvwxqw88an91ik4y7cx-driverConfiguration.json.drv driverConfiguration.json> structuredAttrs is enabled building '/nix/store/wkxa62rpkrcaq9p80bjrp19nmrwj5jz0-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051 nixos-test-driver-certificates> build-x86-01: building wkxa62rpkrcaq9p80bjrp19nmrwj5jz0-nixos-test-driver-certificates.drv nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/3xv87yzfs7vn04rxj8kdcqhi07jj9ign-container-test-run-certificates.drv' on nix-store.geninf.io:50051 container-test-run-certificates> build-x86-01: building 3xv87yzfs7vn04rxj8kdcqhi07jj9ign-container-test-run-certificates.drv container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # [1671253.756493] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [1671253.756519] ca systemd-journald[81]: Runtime Journal (/run/log/journal/5452b1cb89b440349a132174fd9039ac) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> ca # [1671253.761393] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [1671253.767939] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [1671253.775466] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [1671253.775803] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [1671253.776090] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [1671253.807578] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/5452b1cb89b440349a132174fd9039ac is 1.174ms for 7 entries. container-test-run-certificates> ca # [1671253.807578] ca systemd-journald[81]: System Journal (/var/log/journal/5452b1cb89b440349a132174fd9039ac) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [1671253.815707] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [1671253.815875] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [1671253.816525] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [1671253.816595] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [1671253.816986] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [1671253.817015] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1671253.817415] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [1671253.817719] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [1671253.817732] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [1671253.826755] ca systemd-tmpfiles[166]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [1671253.826897] ca systemd-tmpfiles[166]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1671253.826996] ca systemd-tmpfiles[166]: fchmod() of /var/log/journal/5452b1cb89b440349a132174fd9039ac failed: Operation not permitted container-test-run-certificates> ca # [1671253.827146] ca systemd-tmpfiles[166]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [1671253.827844] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [1671253.828264] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [1671253.828568] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [1671253.834449] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [1671253.841046] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [1671253.841188] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [1671253.841664] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [1671253.841799] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [1671253.842220] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [1671253.842557] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [1671253.848609] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [1671253.853919] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [1671254.310412] ca systemd-networkd[196]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1671254.310500] ca systemd-networkd[196]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [1671254.318371] ca systemd-networkd[196]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1671254.318537] ca systemd-networkd[196]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [1671254.318622] ca systemd-networkd[196]: lo: Link UP container-test-run-certificates> ca # [1671254.318627] ca systemd-networkd[196]: lo: Gained carrier container-test-run-certificates> ca # [1671254.318777] ca systemd-networkd[196]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [1671254.319024] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [1671254.319064] ca systemd-networkd[196]: eth1: Link UP container-test-run-certificates> ca # [1671254.319198] ca systemd-networkd[196]: eth1: Gained carrier container-test-run-certificates> ca # [1671254.319684] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [1671254.340845] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [1671254.676492] ca systemd-resolved[117]: Positive Trust Anchors: container-test-run-certificates> ca # [1671254.676500] ca systemd-resolved[117]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [1671254.676503] ca systemd-resolved[117]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [1671254.676526] ca systemd-resolved[117]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [1671254.686960] ca systemd-resolved[117]: Using system hostname 'ca'. container-test-run-certificates> ca # [1671254.687799] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [1671254.687849] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [1671254.687879] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [1671254.687903] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [1671254.688037] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [1671254.688055] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [1671254.688071] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [1671254.688082] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [1671254.688149] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [1671254.688202] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [1671254.688277] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [1671254.688286] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [1671254.688312] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [1671254.688986] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [1671254.689344] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [1671254.689364] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [1671254.689726] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [1671254.690152] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [1671254.690774] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [1671254.715384] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [1671254.754400] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [1671254.802704] ca acme-setup-privileged[204]: + set -euo pipefail container-test-run-certificates> ca # [1671254.802704] ca acme-setup-privileged[204]: + cd /var/lib/acme container-test-run-certificates> ca # [1671254.802704] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [1671254.803689] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [1671254.804596] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1671254.804626] ca acme-setup-privileged[204]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [1671254.804626] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [1671254.804626] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [1671254.827103] ca nsncd[206]: Sep 23 15:31:09.250 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [1671254.827146] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [1671254.827193] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [1671254.827229] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [1671254.827812] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [1671254.828207] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [1671254.833813] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [1671254.834271] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [1671254.834302] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [1671254.834312] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [1671254.936016] ca dbus-broker-launch[208]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [1671254.936380] ca dbus-broker-launch[208]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [1671254.936380] ca dbus-broker-launch[208]: Invalid user-name in /nix/store/92dpvnx2izg74p9fxmdw8i2jxdlk0jh6-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [1671254.936703] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [1671254.941429] ca dbus-broker-launch[208]: Ready container-test-run-certificates> ca # [1671255.398186] ca systemd-logind[235]: New seat seat0. container-test-run-certificates> ca # [1671255.398317] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [1671255.399191] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [1671255.419691] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [1671255.419825] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [1671255.446286] ca acme-setup-start[222]: + set -euo pipefail container-test-run-certificates> ca # [1671255.446286] ca acme-setup-start[222]: + test -e ca/key.pem container-test-run-certificates> ca # [1671255.446482] ca acme-setup-start[222]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [1671255.458198] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [1671255.459021] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [1671255.643365] ca step-ca[207]: badger 2026/09/23 15:31:10 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [1671255.645454] ca step-ca[207]: 2026/09/23 15:31:10 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [1671255.647765] ca step-ca[207]: 2026/09/23 15:31:10 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [1671255.647765] ca step-ca[207]: 2026/09/23 15:31:10 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [1671255.647765] ca step-ca[207]: 2026/09/23 15:31:10 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [1671255.647765] ca step-ca[207]: 2026/09/23 15:31:10 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [1671255.647765] ca step-ca[207]: 2026/09/23 15:31:10 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [1671255.647865] ca step-ca[207]: 2026/09/23 15:31:10 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [1671255.647865] ca step-ca[207]: 2026/09/23 15:31:10 X.509 Root Fingerprint: 93ee5622205c0002ab022d1391223fc0718ec01927269dd8046e0656e33de92d container-test-run-certificates> ca # [1671255.647916] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [1671255.647980] ca step-ca[207]: 2026/09/23 15:31:10 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [1671256.081258] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1671256.083384] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [1671256.083384] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [1671256.087723] ca acme-ca.foo-start[285]: + cd ca.foo container-test-run-certificates> ca # [1671256.087870] ca acme-ca.foo-start[285]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [1671256.088770] ca acme-ca.foo-start[286]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [1671256.088907] ca acme-ca.foo-start[285]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [1671256.089641] ca acme-ca.foo-start[285]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [1671256.089770] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [1671256.090611] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [1671256.091637] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1671256.092489] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [1671256.092503] ca acme-ca.foo-start[259]: + '[' -d out ']' container-test-run-certificates> ca # [1671256.092503] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1671256.093347] ca acme-ca.foo-start[259]: + chown -R acme:nginx out container-test-run-certificates> ca # [1671256.094824] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [1671256.094834] ca acme-ca.foo-start[259]: + '[' -d certificates ']' container-test-run-certificates> ca # [1671256.096618] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [1671256.097408] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [1671256.320076] ca systemd-networkd[196]: eth1: Gained IPv6LL container-test-run-certificates> ca # [1671256.726532] ca nginx-pre-start[297]: nginx: the configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf syntax is ok container-test-run-certificates> ca # [1671256.726743] ca nginx-pre-start[297]: nginx: configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf test is successful container-test-run-certificates> ca # [1671256.730041] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [1671256.730330] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [1671256.730987] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [1671257.352629] ca acme-order-renew-ca.foo-start[300]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [1671257.354392] ca acme-order-renew-ca.foo-start[300]: + set -euo pipefail container-test-run-certificates> ca # [1671257.354428] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [1671257.354457] ca acme-order-renew-ca.foo-start[300]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [1671257.355208] ca acme-order-renew-ca.foo-start[311]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [1671257.356617] ca acme-order-renew-ca.foo-start[300]: + '[' -n '' ']' container-test-run-certificates> ca # [1671257.356617] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [1671257.356692] ca acme-order-renew-ca.foo-start[300]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [1671257.356692] ca acme-order-renew-ca.foo-start[300]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [1671257.404369] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.827663247Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [1671257.417847] ca step-ca[207]: time="2026-09-23T15:31:11Z" level=info duration="68.289µs" duration-ns=68289 fields.time="2026-09-23T15:31:11Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=35f49abf-c7b2-415c-ad16-639faad1542f response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671257.418118] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.841321552Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [1671257.419530] ca step-ca[207]: time="2026-09-23T15:31:11Z" level=info duration=1.416258ms duration-ns=1416258 fields.time="2026-09-23T15:31:11Z" method=HEAD name=ca nonce=QXV2OFBKdkV4em50TFNoeUVBbDVjTVgzSDBjUWdsQU0 path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=8ae5ba9c-df3b-481c-9919-4eebee87eeea size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671257.420564] ca step-ca[207]: time="2026-09-23T15:31:11Z" level=info duration="783.576µs" duration-ns=783576 fields.time="2026-09-23T15:31:11Z" method=POST name=ca nonce=MHJUeDFnODFOSWhqVXF0ZzE2M3JjNjdOQ2tBOGhoM3A path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=e9f3e574-e537-4d04-9465-ea874ee3d71a response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/Wply4SpF3tyu9gIa97sZsaoZm0QcmKOo/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671257.420709] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.844041836Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [1671257.420709] ca acme-order-renew-ca.foo-start[312]: Your account credentials have been saved in your container-test-run-certificates> ca # [1671257.420709] ca acme-order-renew-ca.foo-start[312]: configuration directory at "accounts". container-test-run-certificates> ca # [1671257.420709] ca acme-order-renew-ca.foo-start[312]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [1671257.420709] ca acme-order-renew-ca.foo-start[312]: configuration directory will also contain private keys container-test-run-certificates> ca # [1671257.420709] ca acme-order-renew-ca.foo-start[312]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [1671257.420709] ca acme-order-renew-ca.foo-start[312]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [1671257.420852] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.844185827Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [1671257.422369] ca step-ca[207]: time="2026-09-23T15:31:11Z" level=info duration=1.327471ms duration-ns=1327471 fields.time="2026-09-23T15:31:11Z" method=POST name=ca nonce=NnNDODF5MUhDc1NNUFR4d3dyU2cyR1B4OHJ0SURiTWU path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=a7678f28-1419-4c53-b4c7-0cb9747d6bf7 response="{\"id\":\"F5TiNGfB5l465tWUvpLw3aYNmcftR97F\",\"status\":\"pending\",\"expires\":\"2026-09-24T15:31:11Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-23T15:30:11Z\",\"notAfter\":\"2026-12-22T15:31:11Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/f2KY5HbiIckse4jzjz8iVMhWsGWuFSct\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/F5TiNGfB5l465tWUvpLw3aYNmcftR97F/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671257.479196] ca step-ca[207]: time="2026-09-23T15:31:11Z" level=info duration="715.187µs" duration-ns=715187 fields.time="2026-09-23T15:31:11Z" method=POST name=ca nonce=WVNiSFBtODZ2ZlRmdUZPbnh1RFV4UWxXYU1HQlp2OEE path=/acme/acme/authz/f2KY5HbiIckse4jzjz8iVMhWsGWuFSct protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b46a482b-d2da-4dc8-ae00-1550af3f312e response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"gUw97hRrYAH2HQXS5fThqA92fhl6JdiS\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/f2KY5HbiIckse4jzjz8iVMhWsGWuFSct/ljyUGbExH6p9kdQUVUlbcTltkl1sBkDj\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"gUw97hRrYAH2HQXS5fThqA92fhl6JdiS\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/f2KY5HbiIckse4jzjz8iVMhWsGWuFSct/ChbzaqRDdiKySEH9K7RESjicH6QxTPih\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"gUw97hRrYAH2HQXS5fThqA92fhl6JdiS\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/f2KY5HbiIckse4jzjz8iVMhWsGWuFSct/XCxcXO3QHVOwT4HesiKzNSVfIYw98Uxu\"}],\"wildcard\":false,\"expires\":\"2026-09-24T15:31:11Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671257.479389] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.902710740Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [1671257.479418] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.902729475Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [1671257.481247] ca step-ca[207]: time="2026-09-23T15:31:11Z" level=info duration=1.63004ms duration-ns=1630040 fields.time="2026-09-23T15:31:11Z" method=POST name=ca nonce=YWdyQzd6MUhrRUhkblU0Rlc5WTNjNXJtdGtFa3FXdFQ path=/acme/acme/challenge/f2KY5HbiIckse4jzjz8iVMhWsGWuFSct/ChbzaqRDdiKySEH9K7RESjicH6QxTPih protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=3f385ce0-80c5-47f6-b37f-bdfefefe3b4f response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"gUw97hRrYAH2HQXS5fThqA92fhl6JdiS\",\"validated\":\"2026-09-23T15:31:11Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/f2KY5HbiIckse4jzjz8iVMhWsGWuFSct/ChbzaqRDdiKySEH9K7RESjicH6QxTPih\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671257.481355] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.904686711Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [1671257.481391] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.904725485Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [1671257.483565] ca step-ca[207]: time="2026-09-23T15:31:11Z" level=info duration=1.907242ms duration-ns=1907242 fields.time="2026-09-23T15:31:11Z" method=POST name=ca nonce=SzJocElEeGMwRGcxNG85ZHIzTktUWTZ1RHhDZlg0YTU path=/acme/acme/order/F5TiNGfB5l465tWUvpLw3aYNmcftR97F/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=1553b5d6-11dc-4fcc-a960-a41a28842da3 response="{\"id\":\"F5TiNGfB5l465tWUvpLw3aYNmcftR97F\",\"status\":\"valid\",\"expires\":\"2026-09-24T15:31:11Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-23T15:30:11Z\",\"notAfter\":\"2026-12-22T15:31:11Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/f2KY5HbiIckse4jzjz8iVMhWsGWuFSct\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/F5TiNGfB5l465tWUvpLw3aYNmcftR97F/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/etWfpxZpbll1Azt1a5F7PIFNqxTr1nJU\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671257.484272] ca step-ca[207]: time="2026-09-23T15:31:11Z" level=info certificate=MIIB0zCCAXmgAwIBAgIQCvK3Vcf+Y5JTio9sbXgxYjAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MjMxNTMwMTFaFw0yNjEyMjIxNTMxMTFaMBExDzANBgNVBAMTBmNhLmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABI6ZDVGHaA2IfdmmDjuylL7JXEKG8yyNz67hMja4pX0CLxkZqwP7NdjHuXWFxnwJmWRw2+5RCw1D7aCvC0frmxGjgaQwgaEwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU+ds8z+YNPNLA8vOackF76SEtdMYwHwYDVR0jBBgwFoAU6BitA/qdTXEEEVJl6oijifgeApgwEQYDVR0RBAowCIIGY2EuZm9vMB0GDCsGAQQBgqRkxihAAQQNMAsCAQYEBGFjbWUEADAKBggqhkjOPQQDAgNIADBFAiEApXVuFzquL2suD9PuLix56oMzPSkk7Y6xosi2qSvn28ICID20icO0eQIsYtrV3dGcOkzey0aWESuM6BpGAyYIfqdI duration="507.957µs" duration-ns=507957 fields.time="2026-09-23T15:31:11Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=WDNaZGczSDlFbUY0MllyTVRTaURHcDVqZTBnRDRCT2Y path=/acme/acme/certificate/etWfpxZpbll1Azt1a5F7PIFNqxTr1nJU protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=a08290dc-ca4a-4f60-8d92-a0c1df981e0b sans="map[dns:[ca.foo]]" serial=14552534274860923309454733403563241826 size=1340 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-09-23T15:30:11Z" valid-to="2026-12-22T15:31:11Z" container-test-run-certificates> ca # [1671257.484352] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.907683035Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [1671257.484382] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.907717781Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [1671257.484417] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.907753638Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [1671257.484437] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.907773526Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [1671257.484477] ca acme-order-renew-ca.foo-start[312]: 2026-09-23T15:31:11.907814052Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [1671257.487334] ca acme-order-renew-ca.foo-start[300]: + touch out/acme-success container-test-run-certificates> ca # [1671257.488202] ca acme-order-renew-ca.foo-start[300]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1671257.488773] ca acme-order-renew-ca.foo-start[300]: + touch out/renewed container-test-run-certificates> ca # [1671257.489497] ca acme-order-renew-ca.foo-start[300]: + echo Installing new certificate container-test-run-certificates> ca # [1671257.489497] ca acme-order-renew-ca.foo-start[300]: Installing new certificate container-test-run-certificates> ca # [1671257.489528] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [1671257.490419] ca acme-order-renew-ca.foo-start[332]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [1671257.490537] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [1671257.491229] ca acme-order-renew-ca.foo-start[333]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [1671257.491343] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [1671257.491964] ca acme-order-renew-ca.foo-start[334]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [1671257.492080] ca acme-order-renew-ca.foo-start[300]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [1671257.492859] ca acme-order-renew-ca.foo-start[300]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [1671257.493672] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [1671257.493684] ca acme-order-renew-ca.foo-start[300]: + '[' -d out ']' container-test-run-certificates> ca # [1671257.493684] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [1671257.494426] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx out container-test-run-certificates> ca # [1671257.495640] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [1671257.495651] ca acme-order-renew-ca.foo-start[300]: + '[' -d certificates ']' container-test-run-certificates> ca # [1671257.495651] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [1671257.496380] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [1671257.497764] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [1671257.611063] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [1671257.613798] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [1671257.613905] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [1671258.234263] ca nginx[350]: nginx: the configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf syntax is ok container-test-run-certificates> ca # [1671258.234489] ca nginx[350]: nginx: configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 5.64 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [1671258.849144] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [1671258.849290] ca systemd[1]: Startup finished in 5.340s. container-test-run-certificates> ca # [1671258.893676] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [1671258.957632] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [1671258.957730] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [1671258.957741] ca systemd[1]: nginx.service: Consumed 2.407s CPU time over 2.860s wall clock time. container-test-run-certificates> ca # [1671258.959029] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.71 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 443) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 446) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> ca # [1671259.593546] ca nginx-pre-start[374]: nginx: the configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf syntax is ok container-test-run-certificates> ca # [1671259.593806] ca nginx-pre-start[374]: nginx: configuration file /nix/store/3iy4xl0isrms5m23qmg2l908r2rw373r-nginx.conf test is successful container-test-run-certificates> ca # [1671259.596398] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [1671260.092557] server systemd-journald[72]: Journal started container-test-run-certificates> server # [1671260.092582] server systemd-journald[72]: Runtime Journal (/run/log/journal/799383b2882a4123b8544027cb95a6ee) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [1671260.097822] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [1671260.104428] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [1671260.112123] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [1671260.112446] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [1671260.112706] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [1671260.117054] server systemd-journald[72]: Time spent on flushing to /var/log/journal/799383b2882a4123b8544027cb95a6ee is 1.041ms for 7 entries. container-test-run-certificates> server # [1671260.117054] server systemd-journald[72]: System Journal (/var/log/journal/799383b2882a4123b8544027cb95a6ee) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [1671260.126315] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [1671260.126499] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [1671260.127178] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [1671260.127237] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [1671260.127661] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [1671260.127693] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1671260.128047] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [1671260.128338] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [1671260.128356] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [1671260.142245] server systemd-tmpfiles[132]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [1671260.142391] server systemd-tmpfiles[132]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [1671260.142491] server systemd-tmpfiles[132]: fchmod() of /var/log/journal/799383b2882a4123b8544027cb95a6ee failed: Operation not permitted container-test-run-certificates> server # [1671260.142636] server systemd-tmpfiles[132]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [1671260.143942] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [1671260.144446] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [1671260.144776] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [1671260.149443] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> server # [1671260.151908] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [1671260.156592] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [1671260.157091] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [1671260.162453] server systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [1671260.179173] server systemd[1]: Finished Firewall. container-test-run-certificates> server # [1671260.179234] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [1671260.179361] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [1671260.179860] server systemd[1]: Starting Network Management... container-test-run-certificates> client # [1671260.087415] client systemd-journald[72]: Journal started container-test-run-certificates> client # [1671260.087441] client systemd-journald[72]: Runtime Journal (/run/log/journal/f0153f79afb644eb9cf2061c2883a3da) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [1671260.092368] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [1671260.099093] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [1671260.106777] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [1671260.107108] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [1671260.107374] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [1671260.112003] client systemd-journald[72]: Time spent on flushing to /var/log/journal/f0153f79afb644eb9cf2061c2883a3da is 1.077ms for 7 entries. container-test-run-certificates> client # [1671260.112003] client systemd-journald[72]: System Journal (/var/log/journal/f0153f79afb644eb9cf2061c2883a3da) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [1671260.120762] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [1671260.120964] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [1671260.121659] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [1671260.121711] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [1671260.122141] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [1671260.122164] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1671260.122559] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [1671260.122936] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [1671260.122948] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [1671260.131873] client systemd-tmpfiles[131]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [1671260.132018] client systemd-tmpfiles[131]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [1671260.132116] client systemd-tmpfiles[131]: fchmod() of /var/log/journal/f0153f79afb644eb9cf2061c2883a3da failed: Operation not permitted container-test-run-certificates> client # [1671260.132261] client systemd-tmpfiles[131]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [1671260.133060] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [1671260.133609] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [1671260.133927] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [1671260.140009] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [1671260.145207] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [1671260.145638] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [1671260.150653] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [1671260.150821] client systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [1671260.172828] client systemd[1]: Finished Firewall. container-test-run-certificates> client # [1671260.172903] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [1671260.173098] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [1671260.173652] client systemd[1]: Starting Network Management... container-test-run-certificates> client # [1671260.639225] client systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1671260.639317] client systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [1671260.647248] client systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1671260.647389] client systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [1671260.647468] client systemd-networkd[186]: lo: Link UP container-test-run-certificates> client # [1671260.647471] client systemd-networkd[186]: lo: Gained carrier container-test-run-certificates> client # [1671260.647612] client systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [1671260.647865] client systemd[1]: Started Network Management. container-test-run-certificates> client # [1671260.647954] client systemd-networkd[186]: eth1: Link UP container-test-run-certificates> client # [1671260.647958] client systemd-networkd[186]: eth1: Gained carrier container-test-run-certificates> client # [1671260.648528] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [1671260.667576] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [1671260.647363] server systemd-networkd[190]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1671260.647435] server systemd-networkd[190]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [1671260.654782] server systemd-networkd[190]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1671260.654962] server systemd-networkd[190]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [1671260.655037] server systemd-networkd[190]: lo: Link UP container-test-run-certificates> server # [1671260.655041] server systemd-networkd[190]: lo: Gained carrier container-test-run-certificates> server # [1671260.655177] server systemd-networkd[190]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [1671260.655443] server systemd[1]: Started Network Management. container-test-run-certificates> server # [1671260.664700] server systemd-networkd[190]: eth1: Link UP container-test-run-certificates> server # [1671260.664756] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [1671260.664825] server systemd-networkd[190]: eth1: Gained carrier container-test-run-certificates> server # [1671260.693200] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [1671260.995400] server systemd-resolved[110]: Positive Trust Anchors: container-test-run-certificates> server # [1671260.995407] server systemd-resolved[110]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [1671260.995410] server systemd-resolved[110]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [1671260.995426] server systemd-resolved[110]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [1671261.005674] server systemd-resolved[110]: Using system hostname 'server'. container-test-run-certificates> server # [1671261.006447] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [1671261.006485] server systemd[1]: Reached target Network. container-test-run-certificates> server # [1671261.006512] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [1671261.006535] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [1671261.006672] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [1671261.006694] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [1671261.006709] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [1671261.006721] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [1671261.006790] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [1671261.006842] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [1671261.006905] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [1671261.006915] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [1671261.006934] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [1671261.007540] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [1671261.007858] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [1671261.007876] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [1671261.008346] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [1671261.009067] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [1671261.041237] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [1671261.093195] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [1671261.123999] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [1671261.124172] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [1671261.124172] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [1671261.125139] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [1671261.126300] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1671261.126300] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [1671261.126352] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [1671261.126352] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [1671261.147188] server nsncd[197]: Sep 23 15:31:15.570 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [1671261.147206] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [1671261.147230] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [1671261.147254] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [1671261.149121] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [1671261.149485] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [1671261.155357] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [1671261.156684] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [1671261.156704] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [1671261.156716] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [1671260.995411] client systemd-resolved[109]: Positive Trust Anchors: container-test-run-certificates> client # [1671260.995416] client systemd-resolved[109]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [1671260.995419] client systemd-resolved[109]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [1671260.995434] client systemd-resolved[109]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [1671261.005614] client systemd-resolved[109]: Using system hostname 'client'. container-test-run-certificates> client # [1671261.006463] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [1671261.006505] client systemd[1]: Reached target Network. container-test-run-certificates> client # [1671261.006542] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [1671261.006575] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [1671261.006589] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [1671261.006600] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [1671261.006669] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [1671261.006723] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [1671261.006799] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [1671261.006811] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [1671261.006831] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [1671261.007391] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [1671261.007778] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [1671261.008316] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [1671261.042049] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [1671261.085623] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [1671261.147492] client nsncd[192]: Sep 23 15:31:15.570 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [1671261.147557] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [1671261.147596] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [1671261.147635] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [1671261.149151] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [1671261.149485] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [1671261.154467] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [1671261.154873] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [1671261.154894] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [1671261.154903] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [1671261.260210] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [1671261.260563] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [1671261.260563] client dbus-broker-launch[193]: Invalid user-name in /nix/store/k1wkxjg7rqm8aki2ngjxfj3lf1b0qmmn-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [1671261.260801] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [1671261.264228] client dbus-broker-launch[193]: Ready container-test-run-certificates> server # [1671261.266524] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [1671261.266969] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [1671261.266969] server dbus-broker-launch[198]: Invalid user-name in /nix/store/c02lr3b0bgpmd8c0jfrflwkam4h2k3z7-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [1671261.267173] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [1671261.270354] server dbus-broker-launch[198]: Ready container-test-run-certificates> server # [1671261.706616] server systemd-logind[222]: New seat seat0. container-test-run-certificates> server # [1671261.706697] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [1671261.729203] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [1671261.736493] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [1671261.736542] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [1671261.765628] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [1671261.765628] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [1671261.765791] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [1671261.772982] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [1671261.773780] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> client # [1671261.702517] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [1671261.702655] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [1671261.703488] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [1671261.733209] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [1671261.733287] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [1671261.733487] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [1671261.733564] client systemd[1]: Startup finished in 1.876s. container-test-run-certificates> client # [1671262.144109] client systemd-networkd[186]: eth1: Gained IPv6LL container-test-run-certificates> server # [1671262.390283] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1671262.392117] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [1671262.392117] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [1671262.396666] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [1671262.396829] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [1671262.397569] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [1671262.397725] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [1671262.398480] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [1671262.398606] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [1671262.399475] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [1671262.400327] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1671262.401161] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1671262.401175] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [1671262.401175] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1671262.401969] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [1671262.403596] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [1671262.403596] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [1671262.405479] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [1671262.406189] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [1671262.529076] server systemd-networkd[190]: eth1: Gained IPv6LL container-test-run-certificates> server # [1671263.026117] server nginx-pre-start[270]: nginx: the configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf syntax is ok container-test-run-certificates> server # [1671263.026420] server nginx-pre-start[270]: nginx: configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf test is successful container-test-run-certificates> server # [1671263.029197] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [1671263.029398] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [1671263.029995] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [1671263.655587] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [1671263.656987] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [1671263.657046] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1671263.657077] server acme-order-renew-test.foo-start[273]: + /nix/store/m9ik4hd36632x3n2ibrxl2vyi0w4y094-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [1671263.657688] server acme-order-renew-test.foo-start[284]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [1671263.658977] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [1671263.658997] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [1671263.659036] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [1671263.659058] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [1671263.668802] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.092122941Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [1671263.683738] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.107063031Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [1671263.686722] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.110054055Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [1671263.686722] server acme-order-renew-test.foo-start[285]: Your account credentials have been saved in your container-test-run-certificates> server # [1671263.686722] server acme-order-renew-test.foo-start[285]: configuration directory at "accounts". container-test-run-certificates> server # [1671263.686722] server acme-order-renew-test.foo-start[285]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [1671263.686722] server acme-order-renew-test.foo-start[285]: configuration directory will also contain private keys container-test-run-certificates> server # [1671263.686722] server acme-order-renew-test.foo-start[285]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [1671263.686722] server acme-order-renew-test.foo-start[285]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [1671263.686827] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.110101634Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [1671263.746218] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.169548453Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [1671263.746218] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.169557090Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [1671263.748641] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.171973641Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [1671263.748667] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.172002235Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [1671263.752655] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.175987451Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [1671263.752672] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.176009683Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [1671263.752707] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.176042174Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [1671263.752733] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.176069035Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [1671263.752767] server acme-order-renew-test.foo-start[285]: 2026-09-23T15:31:18.176103380Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [1671263.755504] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [1671263.756619] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1671263.757263] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [1671263.758042] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [1671263.758042] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [1671263.758070] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [1671263.758801] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [1671263.758979] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [1671263.759613] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [1671263.759725] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [1671263.760499] server acme-order-renew-test.foo-start[308]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [1671263.760626] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [1671263.761507] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [1671263.762373] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1671263.762387] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [1671263.762387] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [1671263.763197] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [1671263.764695] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [1671263.764712] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [1671263.764712] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [1671263.765614] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [1671263.767015] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> server # [1671263.881677] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [1671263.884237] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [1671263.884389] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> ca # [1671263.683519] ca step-ca[207]: time="2026-09-23T15:31:18Z" level=info duration="31.69µs" duration-ns=31690 fields.time="2026-09-23T15:31:18Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=313227e4-efd4-4708-a35d-78ad97efb791 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671263.685093] ca step-ca[207]: time="2026-09-23T15:31:18Z" level=info duration="586.625µs" duration-ns=586625 fields.time="2026-09-23T15:31:18Z" method=HEAD name=ca nonce=R0V6dmVudkJiOWhXT01kU0VwNGVBbnk1clhDa1JnV2E path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=07ec6545-0b0d-4720-b0f7-a98e4ebd7f52 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671263.686552] ca step-ca[207]: time="2026-09-23T15:31:18Z" level=info duration="643.822µs" duration-ns=643822 fields.time="2026-09-23T15:31:18Z" method=POST name=ca nonce=UVJVVmhjMDR5cVRZNnJvSXNZUFJKQ0tNNWZTUVJCWTk path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=3d01c986-173a-41c0-9c0a-7dbe2b81a84c response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/obOACu3qzrL6irZeIXKAaCaNJPYybPux/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671263.688712] ca step-ca[207]: time="2026-09-23T15:31:18Z" level=info duration=1.331578ms duration-ns=1331578 fields.time="2026-09-23T15:31:18Z" method=POST name=ca nonce=RXVtbjdRcTRFZzhBbG5UbW9MVmtKdG1VRnZyeWhad3A path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=254e9d13-ed5d-46a4-b658-b18d9126d244 response="{\"id\":\"BPSBRGetxkhCa0kM7xWA152N1RkWmgWn\",\"status\":\"pending\",\"expires\":\"2026-09-24T15:31:18Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-23T15:30:18Z\",\"notAfter\":\"2026-12-22T15:31:18Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/PKIiHLuk8aqB0VsbCqPB0D2owM4J4eyC\"],\"finalize\":\"https://ca.foo/acme/acme/order/BPSBRGetxkhCa0kM7xWA152N1RkWmgWn/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671263.746081] ca step-ca[207]: time="2026-09-23T15:31:18Z" level=info duration="472.941µs" duration-ns=472941 fields.time="2026-09-23T15:31:18Z" method=POST name=ca nonce=V0xHOFBuMGNHZjBsdmNPTExoMTZZTkhEMDd1UVJLbFU path=/acme/acme/authz/PKIiHLuk8aqB0VsbCqPB0D2owM4J4eyC protocol=HTTP/1.1 referer= remote-address="::1" request-id=0c12b79a-6c17-46c1-bfe4-4fad678be85e response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"VBvEUvNeUdJRn16tWQ9Ily2TuuQO5oVV\",\"url\":\"https://ca.foo/acme/acme/challenge/PKIiHLuk8aqB0VsbCqPB0D2owM4J4eyC/IhFr9SoG3O9G1wDF4pS3VWw6Tawaasuz\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"VBvEUvNeUdJRn16tWQ9Ily2TuuQO5oVV\",\"url\":\"https://ca.foo/acme/acme/challenge/PKIiHLuk8aqB0VsbCqPB0D2owM4J4eyC/MdDd2p2BONBvm5JfdjQNG9sJJiG2Wuwr\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"VBvEUvNeUdJRn16tWQ9Ily2TuuQO5oVV\",\"url\":\"https://ca.foo/acme/acme/challenge/PKIiHLuk8aqB0VsbCqPB0D2owM4J4eyC/V8fQa3Cs4g91O8zTLB84uhjw3Kf2C9BB\"}],\"wildcard\":false,\"expires\":\"2026-09-24T15:31:18Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671263.748501] ca step-ca[207]: time="2026-09-23T15:31:18Z" level=info duration=1.655217ms duration-ns=1655217 fields.time="2026-09-23T15:31:18Z" method=POST name=ca nonce=UGFlb1E2S1pMR1lOczVHMnE2dDRCcFlibWFydGtpYks path=/acme/acme/challenge/PKIiHLuk8aqB0VsbCqPB0D2owM4J4eyC/MdDd2p2BONBvm5JfdjQNG9sJJiG2Wuwr protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=1641f517-ee7a-4762-8214-ca0d2c6a2070 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"VBvEUvNeUdJRn16tWQ9Ily2TuuQO5oVV\",\"validated\":\"2026-09-23T15:31:18Z\",\"url\":\"https://ca.foo/acme/acme/challenge/PKIiHLuk8aqB0VsbCqPB0D2owM4J4eyC/MdDd2p2BONBvm5JfdjQNG9sJJiG2Wuwr\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671263.751313] ca step-ca[207]: time="2026-09-23T15:31:18Z" level=info duration=1.837441ms duration-ns=1837441 fields.time="2026-09-23T15:31:18Z" method=POST name=ca nonce=bUpYY3JBQWJKemUzQTU1MnQ3S2FqcVVLUHBDeUthZVM path=/acme/acme/order/BPSBRGetxkhCa0kM7xWA152N1RkWmgWn/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=e4200f28-3173-4300-a80f-1c500db38484 response="{\"id\":\"BPSBRGetxkhCa0kM7xWA152N1RkWmgWn\",\"status\":\"valid\",\"expires\":\"2026-09-24T15:31:18Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-23T15:30:18Z\",\"notAfter\":\"2026-12-22T15:31:18Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/PKIiHLuk8aqB0VsbCqPB0D2owM4J4eyC\"],\"finalize\":\"https://ca.foo/acme/acme/order/BPSBRGetxkhCa0kM7xWA152N1RkWmgWn/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/pDRbUKJ67IU9YcrmDqdNqE0ILAjusRJF\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [1671263.752510] ca step-ca[207]: time="2026-09-23T15:31:18Z" level=info certificate=MIIB1jCCAX2gAwIBAgIQY94G2uASSkk7Ol3DLiDyFTAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MjMxNTMwMThaFw0yNjEyMjIxNTMxMThaMBMxETAPBgNVBAMTCHRlc3QuZm9vMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUxky3BsxD1tssX8M3F0VCJS0V2s/ILzjTS0Zq2H5x1IUCeDYFsso97eG0Udda+N9/U0Hwj/yhKxxYTVfCwCgQKOBpjCBozAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBTyhAW7+s5SqZ38WU7LYfJwYzKVMzAfBgNVHSMEGDAWgBToGK0D+p1NcQQRUmXqiKOJ+B4CmDATBgNVHREEDDAKggh0ZXN0LmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDRwAwRAIgbvndJv4BoMnwo6CvR2T2JC3PG1tbbbqlFh+mkEZJ38oCIGmajajzBr1JpFuMQaPLgqrTExZZrUD0oNGSNFl4CW5x duration="490.955µs" duration-ns=490955 fields.time="2026-09-23T15:31:18Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=aGZ3WnNpUFZqWW9VTjc1anU5WFNjODMzdm1OdjVKd1Y path=/acme/acme/certificate/pDRbUKJ67IU9YcrmDqdNqE0ILAjusRJF protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=1c6d5e5d-ddbf-43b6-9485-f800bb4c98ba sans="map[dns:[test.foo]]" serial=132746400520845206841393043372729496085 size=1344 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-09-23T15:30:18Z" valid-to="2026-12-22T15:31:18Z" container-test-run-certificates> server # [1671264.501741] server nginx[324]: nginx: the configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf syntax is ok container-test-run-certificates> server # [1671264.501936] server nginx[324]: nginx: configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf test is successful container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 5.64 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [1671265.124739] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [1671265.124882] server systemd[1]: Startup finished in 5.271s. container-test-run-certificates> server # [1671265.242166] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [1671265.290866] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [1671265.290999] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [1671265.291037] server systemd[1]: nginx.service: Consumed 3.664s CPU time over 2.884s wall clock time. container-test-run-certificates> server # [1671265.292370] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.69 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 34304 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 60332 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> server # [1671265.923812] server nginx-pre-start[347]: nginx: the configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf syntax is ok container-test-run-certificates> server # [1671265.924104] server nginx-pre-start[347]: nginx: configuration file /nix/store/cby9afk5cl067qpc763prp1vzgmy4mxd-nginx.conf test is successful container-test-run-certificates> server # [1671265.926947] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1552 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [929 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [79 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Sep 23 15:30:18 2026 GMT container-test-run-certificates> * expire date: Dec 22 15:31:18 2026 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 34312 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1872 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.03 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> 63:de:06:da:e0:12:4a:49:3b:3a:5d:c3:2e:20:f2:15 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Sep 23 15:30:18 2026 GMT container-test-run-certificates> Not After : Dec 22 15:31:18 2026 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:53:19:32:dc:1b:31:0f:5b:6c:b1:7f:0c:dc:5d: container-test-run-certificates> 15:08:94:b4:57:6b:3f:20:bc:e3:4d:2d:19:ab:61: container-test-run-certificates> f9:c7:52:14:09:e0:d8:16:cb:28:f7:b7:86:d1:47: container-test-run-certificates> 5d:6b:e3:7d:fd:4d:07:c2:3f:f2:84:ac:71:61:35: container-test-run-certificates> 5f:0b:00:a0:40 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> F2:84:05:BB:FA:CE:52:A9:9D:FC:59:4E:CB:61:F2:70:63:32:95:33 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> E8:18:AD:03:FA:9D:4D:71:04:11:52:65:EA:88:A3:89:F8:1E:02:98 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:44:02:20:6e:f9:dd:26:fe:01:a0:c9:f0:a3:a0:af:47:64: container-test-run-certificates> f6:24:2d:cf:1b:5b:5b:6d:ba:a5:16:1f:a6:90:46:49:df:ca: container-test-run-certificates> 02:20:69:9a:8d:a8:f3:06:bd:49:a4:5b:8c:41:a3:cb:82:aa: container-test-run-certificates> d3:13:16:59:ad:40:f4:a0:d1:92:34:59:78:09:6e:71 container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds) container-test-run-certificates> (finished: run the VM test script, in 13.73 seconds) container-test-run-certificates> test script finished in 13.78s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 446) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> kill NspawnMachine (pid 443) container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> Container server terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.29 seconds)