don't know how to build these paths:
  /nix/store/rpqlwmzq8bqid07rb255vmlz8dji0ys5-container-test-run-certificates.drv
warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user
building '/nix/store/7x9q65vahpcbw3zhy21j2n59bqbydca8-dry-activate.drv' on nix-store.geninf.io:50051
dry-activate> attached to the build already running on this worker
dry-activate> build01: building 7x9q65vahpcbw3zhy21j2n59bqbydca8-dry-activate.drv
dry-activate> structuredAttrs is enabled
building '/nix/store/vbxwbrcmavgih0vwgjgznavm14922kdp-decrypt-age-secrets.drv' on nix-store.geninf.io:50051
decrypt-age-secrets> build01: building vbxwbrcmavgih0vwgjgznavm14922kdp-decrypt-age-secrets.drv
decrypt-age-secrets> structuredAttrs is enabled
building '/nix/store/2aijkhab4ylp71zwwl04c4zvi69ndf36-activate.drv' on nix-store.geninf.io:50051
activate> build01: building 2aijkhab4ylp71zwwl04c4zvi69ndf36-activate.drv
activate> structuredAttrs is enabled
building '/nix/store/l8c5nrg33054dnw7zkxfpzyyr279mlmj-dry-activate.drv' on nix-store.geninf.io:50051
dry-activate> build01: building l8c5nrg33054dnw7zkxfpzyyr279mlmj-dry-activate.drv
dry-activate> structuredAttrs is enabled
building '/nix/store/3irix8q8xfiisf72dn1wi24wlp05b7i3-activate.drv' on nix-store.geninf.io:50051
activate> build01: building 3irix8q8xfiisf72dn1wi24wlp05b7i3-activate.drv
activate> structuredAttrs is enabled
building '/nix/store/6c35a8b7l6qsdiaasb5dqfczhki463zv-dry-activate.drv' on nix-store.geninf.io:50051
dry-activate> build01: building 6c35a8b7l6qsdiaasb5dqfczhki463zv-dry-activate.drv
dry-activate> structuredAttrs is enabled
building '/nix/store/ifra6c54nliakhi528c3lz0axw09chc9-activate.drv' on nix-store.geninf.io:50051
activate> build01: building ifra6c54nliakhi528c3lz0axw09chc9-activate.drv
activate> structuredAttrs is enabled
building '/nix/store/y5rk7pkgfjpc6if8mhd75abki24jayi4-nixos-system-server-test.drv' on nix-store.geninf.io:50051
nixos-system-server-test> build01: building y5rk7pkgfjpc6if8mhd75abki24jayi4-nixos-system-server-test.drv
nixos-system-server-test> structuredAttrs is enabled
building '/nix/store/m8lcijw02ackn0gw41yxzd3q628q20l8-nixos-system-client-test.drv' on nix-store.geninf.io:50051
nixos-system-client-test> build01: building m8lcijw02ackn0gw41yxzd3q628q20l8-nixos-system-client-test.drv
nixos-system-client-test> structuredAttrs is enabled
building '/nix/store/7kbfblg6gdj7kw98kcyryxr9g5qyvmcs-nixos-system-ca-test.drv' on nix-store.geninf.io:50051
nixos-system-ca-test> build01: building 7kbfblg6gdj7kw98kcyryxr9g5qyvmcs-nixos-system-ca-test.drv
nixos-system-ca-test> structuredAttrs is enabled
building '/nix/store/5008ajnb5ya6gd4p04ddg01iz9bxgyrq-run-server-nspawn.drv' on nix-store.geninf.io:50051
run-server-nspawn> build01: building 5008ajnb5ya6gd4p04ddg01iz9bxgyrq-run-server-nspawn.drv
building '/nix/store/zpc3p01si6zn1g3fdmz6v8qb3zz78qs0-run-client-nspawn.drv' on nix-store.geninf.io:50051
run-client-nspawn> build01: building zpc3p01si6zn1g3fdmz6v8qb3zz78qs0-run-client-nspawn.drv
building '/nix/store/2gax9jhjdnr802vicm6vvbgjahqf1r2m-run-ca-nspawn.drv' on nix-store.geninf.io:50051
run-ca-nspawn> build01: building 2gax9jhjdnr802vicm6vvbgjahqf1r2m-run-ca-nspawn.drv
building '/nix/store/1g02nhk11g96pv10288fpldsaic93svm-driverConfiguration.json.drv' on nix-store.geninf.io:50051
driverConfiguration.json> build01: building 1g02nhk11g96pv10288fpldsaic93svm-driverConfiguration.json.drv
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/pzlxhk0dglv4cjmlkik1bdk5pi73cilh-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051
nixos-test-driver-certificates> build01: building pzlxhk0dglv4cjmlkik1bdk5pi73cilh-nixos-test-driver-certificates.drv
nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-certificates> All checks passed!
nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-certificates> All checks passed!
building '/nix/store/rpqlwmzq8bqid07rb255vmlz8dji0ys5-container-test-run-certificates.drv' on nix-store.geninf.io:50051
container-test-run-certificates> build01: building rpqlwmzq8bqid07rb255vmlz8dji0ys5-container-test-run-certificates.drv
container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-certificates> start all VLans
container-test-run-certificates> (finished: start all VLans, in 0.00 seconds)
container-test-run-certificates> 
container-test-run-certificates> Test will time out and terminate in 3600.0 seconds
container-test-run-certificates> run the VM test script
container-test-run-certificates> additionally exposed symbols:
container-test-run-certificates>     ca, client, server,
container-test-run-certificates>     vlan1,
container-test-run-certificates>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-certificates> ca: systemd-nspawn running (pid 50)
container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal...
container-test-run-certificates> ca: waiting for unit step-ca.service
container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca.
container-test-run-certificates> ca # No journal files were found.
container-test-run-certificates> ca # No journal boot entry found for the specified boot (+0).
container-test-run-certificates> ca # [2023243.273208] ca systemd-journald[80]: Journal started
container-test-run-certificates> ca # [2023243.273268] ca systemd-journald[80]: Runtime Journal (/run/log/journal/600c883eeeba4938aba9e0f69eb51d1b) is 8M, max 2.5G, 2.4G free.
container-test-run-certificates> ca # [2023243.287086] ca systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> ca # [2023243.302600] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> ca # [2023243.318881] ca systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> ca # [2023243.319978] ca systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> ca # [2023243.320647] ca systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> ca # [2023243.370615] ca systemd-journald[80]: Time spent on flushing to /var/log/journal/600c883eeeba4938aba9e0f69eb51d1b is 1.990ms for 7 entries.
container-test-run-certificates> ca # [2023243.370615] ca systemd-journald[80]: System Journal (/var/log/journal/600c883eeeba4938aba9e0f69eb51d1b) is 8M, max 4G, 3.9G free.
container-test-run-certificates> ca # [2023243.384591] ca systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> ca # [2023243.384936] ca systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> ca # [2023243.385846] ca systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> ca # [2023243.385975] ca systemd[1]: Reached target Local File Systems.
container-test-run-certificates> ca # [2023243.386784] ca systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> ca # [2023243.386833] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [2023243.387773] ca systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> ca # [2023243.388499] ca systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> ca # [2023243.388528] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> ca # [2023243.406838] ca systemd-tmpfiles[159]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> ca # [2023243.407052] ca systemd-tmpfiles[159]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [2023243.407195] ca systemd-tmpfiles[159]: fchmod() of /var/log/journal/600c883eeeba4938aba9e0f69eb51d1b failed: Operation not permitted
container-test-run-certificates> ca # [2023243.407405] ca systemd-tmpfiles[159]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [2023243.408981] ca systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> ca # [2023243.410208] ca systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> ca # [2023243.411155] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> ca # [2023243.428882] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> ca # [2023243.434340] ca systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> ca # [2023243.434639] ca systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> ca # [2023243.436428] ca systemd[1]: Starting Update is Completed...
container-test-run-certificates> ca # [2023243.448995] ca systemd[1]: Finished Firewall.
container-test-run-certificates> ca # [2023243.449269] ca systemd[1]: Finished Update is Completed.
container-test-run-certificates> ca # [2023243.449898] ca systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> ca # [2023243.450199] ca systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> ca # [2023243.451332] ca systemd[1]: Starting Network Management...
container-test-run-certificates> ca # [2023244.139909] ca systemd-networkd[198]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [2023244.139999] ca systemd-networkd[198]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [2023244.149582] ca systemd-networkd[198]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [2023244.149747] ca systemd-networkd[198]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [2023244.149898] ca systemd-networkd[198]: lo: Link UP
container-test-run-certificates> ca # [2023244.149902] ca systemd-networkd[198]: lo: Gained carrier
container-test-run-certificates> ca # [2023244.150094] ca systemd-networkd[198]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> ca # [2023244.150474] ca systemd[1]: Started Network Management.
container-test-run-certificates> ca # [2023244.180291] ca systemd-networkd[198]: eth1: Link UP
container-test-run-certificates> ca # [2023244.180634] ca systemd-networkd[198]: eth1: Gained carrier
container-test-run-certificates> ca # [2023244.181339] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> ca # [2023244.242684] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> ca # [2023244.287001] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> ca # [2023244.569252] ca systemd-resolved[120]: Positive Trust Anchors:
container-test-run-certificates> ca # [2023244.569263] ca systemd-resolved[120]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> ca # [2023244.569266] ca systemd-resolved[120]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> ca # [2023244.569301] ca systemd-resolved[120]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> ca # [2023244.592191] ca systemd-resolved[120]: Using system hostname 'ca'.
container-test-run-certificates> ca # [2023244.593474] ca systemd[1]: Started Network Name Resolution.
container-test-run-certificates> ca # [2023244.593548] ca systemd[1]: Reached target Network.
container-test-run-certificates> ca # [2023244.593599] ca systemd[1]: Reached target Network is Online.
container-test-run-certificates> ca # [2023244.593639] ca systemd[1]: Reached target System Initialization.
container-test-run-certificates> ca # [2023244.593830] ca systemd[1]: Started Renew ACME Certificate for ca.foo.
container-test-run-certificates> ca # [2023244.593858] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [2023244.593880] ca systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> ca # [2023244.593895] ca systemd[1]: Reached target Timer Units.
container-test-run-certificates> ca # [2023244.594007] ca systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> ca # [2023244.594103] ca systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> ca # [2023244.594202] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> ca # [2023244.594222] ca systemd[1]: Reached target Socket Units.
container-test-run-certificates> ca # [2023244.594256] ca systemd[1]: Reached target Basic System.
container-test-run-certificates> ca # [2023244.596036] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> ca # [2023244.596879] ca systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> ca # [2023244.596916] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem
container-test-run-certificates> ca # [2023244.597903] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> ca # [2023244.598874] ca systemd[1]: Starting step-ca service...
container-test-run-certificates> ca # [2023244.600176] ca systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> ca # [2023244.728510] ca systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> ca # [2023244.819509] ca acme-setup-privileged[203]: + set -euo pipefail
container-test-run-certificates> ca # [2023244.819509] ca acme-setup-privileged[203]: + cd /var/lib/acme
container-test-run-certificates> ca # [2023244.819509] ca acme-setup-privileged[203]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> ca # [2023244.821536] ca acme-setup-privileged[203]: + chown -R acme .lego/accounts
container-test-run-certificates> ca # [2023244.823619] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [2023244.823619] ca acme-setup-privileged[203]: + '[' -d ca.foo ']'
container-test-run-certificates> ca # [2023244.823719] ca acme-setup-privileged[203]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [2023244.823719] ca acme-setup-privileged[203]: + '[' -d .lego/ca.foo ']'
container-test-run-certificates> ca # [2023244.871491] ca systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> ca # [2023244.872056] ca nsncd[205]: Sep 27 17:27:44.857 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> ca # [2023244.871631] ca systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> ca # [2023244.871732] ca systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> ca # [2023244.873645] ca systemd[1]: Starting User Login Management...
container-test-run-certificates> ca # [2023244.874882] ca systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> ca # [2023244.886956] ca systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> ca # [2023244.888829] ca systemd[1]: Started Console Getty.
container-test-run-certificates> ca # [2023244.888899] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> ca # [2023244.888948] ca systemd[1]: Reached target Login Prompts.
container-test-run-certificates> ca # [2023245.029584] ca dbus-broker-launch[207]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> ca # [2023245.031030] ca dbus-broker-launch[207]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> ca # [2023245.031030] ca dbus-broker-launch[207]: Invalid user-name in /nix/store/v6jly29gdhx37hki3h1m0qb297q1vkvf-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> ca # [2023245.031575] ca systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> ca # [2023245.040944] ca dbus-broker-launch[207]: Ready
container-test-run-certificates> ca # [2023245.280152] ca systemd-networkd[198]: eth1: Gained IPv6LL
container-test-run-certificates> ca # [2023245.682580] ca systemd-logind[237]: New seat seat0.
container-test-run-certificates> ca # [2023245.682767] ca systemd[1]: Started User Login Management.
container-test-run-certificates> ca # [2023245.685221] ca systemd[1]: Starting linger-users.service...
container-test-run-certificates> ca # [2023245.730264] ca systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> ca # [2023245.730599] ca systemd[1]: Finished linger-users.service.
container-test-run-certificates> ca # [2023245.779974] ca acme-setup-start[221]: + set -euo pipefail
container-test-run-certificates> ca # [2023245.779974] ca acme-setup-start[221]: + test -e ca/key.pem
container-test-run-certificates> ca # [2023245.780604] ca acme-setup-start[221]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> ca # [2023245.803649] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> ca # [2023245.806329] ca systemd[1]: Starting Ensure certificate for ca.foo...
container-test-run-certificates> ca # [2023246.003693] ca step-ca[206]: badger 2026/09/27 17:27:45 INFO: All 0 tables opened in 0s
container-test-run-certificates> ca # [2023246.009464] ca step-ca[206]: 2026/09/27 17:27:45 Building new tls configuration using step-ca x509 Signer Interface
container-test-run-certificates> ca # [2023246.015728] ca step-ca[206]: 2026/09/27 17:27:46 Starting Smallstep CA/0.30.2 (linux/arm64)
container-test-run-certificates> ca # [2023246.015728] ca step-ca[206]: 2026/09/27 17:27:46 Documentation: https://u.step.sm/docs/ca
container-test-run-certificates> ca # [2023246.015728] ca step-ca[206]: 2026/09/27 17:27:46 Community Discord: https://u.step.sm/discord
container-test-run-certificates> ca # [2023246.015728] ca step-ca[206]: 2026/09/27 17:27:46 Config file: /etc/smallstep/ca.json
container-test-run-certificates> ca # [2023246.015728] ca step-ca[206]: 2026/09/27 17:27:46 The primary server URL is https://ca.foo:1443
container-test-run-certificates> ca # [2023246.015728] ca step-ca[206]: 2026/09/27 17:27:46 Root certificates are available at https://ca.foo:1443/roots.pem
container-test-run-certificates> ca # [2023246.015728] ca step-ca[206]: 2026/09/27 17:27:46 X.509 Root Fingerprint: 032ac5711a8b49b75484c637605f549317566256b727c99e426ef5e031da76e0
container-test-run-certificates> ca # [2023246.016657] ca systemd[1]: Started step-ca service.
container-test-run-certificates> ca # [2023246.016987] ca step-ca[206]: 2026/09/27 17:27:46 Serving HTTPS on 0.0.0.0:1443 ...
container-test-run-certificates> ca # [2023246.727306] ca acme-ca.foo-start[257]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [2023246.731076] ca acme-ca.foo-start[257]: + '[' -e out/acme-success ']'
container-test-run-certificates> ca # [2023246.731076] ca acme-ca.foo-start[257]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=
container-test-run-certificates> ca # [2023246.746192] ca acme-ca.foo-start[294]: + cd ca.foo
container-test-run-certificates> ca # [2023246.746799] ca acme-ca.foo-start[294]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> ca # [2023246.748019] ca acme-ca.foo-start[295]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> ca # [2023246.748459] ca acme-ca.foo-start[294]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> ca # [2023246.749655] ca acme-ca.foo-start[294]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> ca # [2023246.749908] ca acme-ca.foo-start[257]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> ca # [2023246.751556] ca acme-ca.foo-start[257]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> ca # [2023246.753367] ca acme-ca.foo-start[257]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [2023246.754951] ca acme-ca.foo-start[257]: + for fixpath in out certificates
container-test-run-certificates> ca # [2023246.754951] ca acme-ca.foo-start[257]: + '[' -d out ']'
container-test-run-certificates> ca # [2023246.755059] ca acme-ca.foo-start[257]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [2023246.756932] ca acme-ca.foo-start[257]: + chown -R acme:nginx out
container-test-run-certificates> ca # [2023246.760949] ca acme-ca.foo-start[257]: + for fixpath in out certificates
container-test-run-certificates> ca # [2023246.760949] ca acme-ca.foo-start[257]: + '[' -d certificates ']'
container-test-run-certificates> ca # [2023246.765468] ca systemd[1]: Finished Ensure certificate for ca.foo.
container-test-run-certificates> ca # [2023246.767208] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca # [2023247.703594] ca nginx-pre-start[306]: nginx: the configuration file /nix/store/gh4jnj8l81p1sq7mc0i468485s77940l-nginx.conf syntax is ok
container-test-run-certificates> ca # [2023247.704215] ca nginx-pre-start[306]: nginx: configuration file /nix/store/gh4jnj8l81p1sq7mc0i468485s77940l-nginx.conf test is successful
container-test-run-certificates> ca # [2023247.709994] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> ca # [2023247.710897] ca systemd[1]: Reached target Multi-User System.
container-test-run-certificates> ca # [2023247.713232] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> ca # [2023248.670174] ca acme-order-renew-ca.foo-start[309]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [2023248.673549] ca acme-order-renew-ca.foo-start[309]: + set -euo pipefail
container-test-run-certificates> ca # [2023248.673627] ca acme-order-renew-ca.foo-start[309]: + exec
container-test-run-certificates> ca # [2023248.673703] ca acme-order-renew-ca.foo-start[309]: + /nix/store/fxkh6pl0y4nfbhdqdnhfkvsq7pbxq655-flock-0.4.0/bin/flock 11
container-test-run-certificates> ca # [2023248.675102] ca acme-order-renew-ca.foo-start[321]: ++ find accounts -path '*/keys/*.key' -print -quit
container-test-run-certificates> ca # [2023248.678195] ca acme-order-renew-ca.foo-start[309]: + '[' -n '' ']'
container-test-run-certificates> ca # [2023248.678280] ca acme-order-renew-ca.foo-start[309]: + exec
container-test-run-certificates> ca # [2023248.678333] ca acme-order-renew-ca.foo-start[309]: + '[' -e certificates/ca.foo.key ']'
container-test-run-certificates> ca # [2023248.678333] ca acme-order-renew-ca.foo-start[309]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains
container-test-run-certificates> ca # [2023248.711874] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.697655818Z INFO  Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key
container-test-run-certificates> ca # [2023248.745998] ca step-ca[206]: time="2026-09-27T17:27:48Z" level=info duration="298.445µs" duration-ns=298445 fields.time="2026-09-27T17:27:48Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=a9f0d9f5-5c12-4aef-bbd3-a1d71e0ba641 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023248.746658] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.732293294Z INFO  Registering the account. email=none@none.tld
container-test-run-certificates> ca # [2023248.754431] ca step-ca[206]: time="2026-09-27T17:27:48Z" level=info duration=7.633625ms duration-ns=7633625 fields.time="2026-09-27T17:27:48Z" method=HEAD name=ca nonce=REZOcUw4Mnd4Y0xwUkpRWFZIRHRvS2NFU0Z2bnd5czU path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=c2dd0283-ceb3-4b57-8087-f3e99f12fa81 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023248.758202] ca step-ca[206]: time="2026-09-27T17:27:48Z" level=info duration=2.813599ms duration-ns=2813599 fields.time="2026-09-27T17:27:48Z" method=POST name=ca nonce=aVAzYllweW9BeUR5TXRFanZzZTByZkZIMnJIRUpnY2Q path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f986de89-b9b6-4ba1-bb7d-4065f6500e6c response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/h0CFY2LRnvb2yAhE4SPdOUJ0YoQ60bSy/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023248.758801] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.744598623Z WARN  !!!! HEADS UP !!!!
container-test-run-certificates> ca # [2023248.758801] ca acme-order-renew-ca.foo-start[322]: Your account credentials have been saved in your
container-test-run-certificates> ca # [2023248.758801] ca acme-order-renew-ca.foo-start[322]: configuration directory at "accounts".
container-test-run-certificates> ca # [2023248.758801] ca acme-order-renew-ca.foo-start[322]: You should make a secure backup of this folder now. This
container-test-run-certificates> ca # [2023248.758801] ca acme-order-renew-ca.foo-start[322]: configuration directory will also contain private keys
container-test-run-certificates> ca # [2023248.758801] ca acme-order-renew-ca.foo-start[322]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> ca # [2023248.758801] ca acme-order-renew-ca.foo-start[322]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> ca # [2023248.759149] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.744838106Z INFO  Obtaining bundled SAN certificate. domains=ca.foo
container-test-run-certificates> ca # [2023248.764204] ca step-ca[206]: time="2026-09-27T17:27:48Z" level=info duration=4.38778ms duration-ns=4387780 fields.time="2026-09-27T17:27:48Z" method=POST name=ca nonce=WWwwZVVpZW5pa1ZId0RUTzNpZjlWNEl0WmJsYWNzeHE path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=0c3449b1-3d1a-494d-9172-77a9b958fe16 response="{\"id\":\"hDYyVoXl7kAYmHXcxBwRGSQx4MPVyVdw\",\"status\":\"pending\",\"expires\":\"2026-09-28T17:27:48Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-27T17:26:48Z\",\"notAfter\":\"2026-12-26T17:27:48Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/Hn0orq5MyrMQKZCg93gyPbPnmnXk6JgA\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/hDYyVoXl7kAYmHXcxBwRGSQx4MPVyVdw/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023248.823881] ca step-ca[206]: time="2026-09-27T17:27:48Z" level=info duration=2.042388ms duration-ns=2042388 fields.time="2026-09-27T17:27:48Z" method=POST name=ca nonce=M2lQODNxYm1VU0pQRktvVkpnd0ZkRFVsS0dTYVR1Zm0 path=/acme/acme/authz/Hn0orq5MyrMQKZCg93gyPbPnmnXk6JgA protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=4d0fed81-47a3-4d44-95d8-f67f37b8046e response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"ntfDnHfgLUKULsqx8GCBwOrLNSNIrly6\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Hn0orq5MyrMQKZCg93gyPbPnmnXk6JgA/bou2nOK64LuS66MOey8pgxxu5PPGYkFe\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"ntfDnHfgLUKULsqx8GCBwOrLNSNIrly6\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Hn0orq5MyrMQKZCg93gyPbPnmnXk6JgA/vr8BaeCjvROJRsIDchOMbkqKgbmTx6uF\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"ntfDnHfgLUKULsqx8GCBwOrLNSNIrly6\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Hn0orq5MyrMQKZCg93gyPbPnmnXk6JgA/FunjcXJvsriTLajB5hrjihNOgEwY0VRP\"}],\"wildcard\":false,\"expires\":\"2026-09-28T17:27:48Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023248.824328] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.810120363Z INFO  Use solver. domain=ca.foo type=http-01
container-test-run-certificates> ca # [2023248.824408] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.810169124Z INFO  http01: Trying to solve HTTP-01. domain=ca.foo
container-test-run-certificates> ca # [2023248.830614] ca step-ca[206]: time="2026-09-27T17:27:48Z" level=info duration=5.426155ms duration-ns=5426155 fields.time="2026-09-27T17:27:48Z" method=POST name=ca nonce=b1E0NHBWSHhrcWluY1BiQ3ZIbzFWdFo1aXpCaXFkd2I path=/acme/acme/challenge/Hn0orq5MyrMQKZCg93gyPbPnmnXk6JgA/vr8BaeCjvROJRsIDchOMbkqKgbmTx6uF protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=b6e39926-b4ec-4203-b635-709caaf3279e response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"ntfDnHfgLUKULsqx8GCBwOrLNSNIrly6\",\"validated\":\"2026-09-27T17:27:48Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/Hn0orq5MyrMQKZCg93gyPbPnmnXk6JgA/vr8BaeCjvROJRsIDchOMbkqKgbmTx6uF\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023248.831150] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.816946417Z INFO  The server validated our request. domain=ca.foo
container-test-run-certificates> ca # [2023248.831266] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.817076179Z INFO  Validations succeeded; requesting certificates. domains=ca.foo
container-test-run-certificates> ca # [2023248.841196] ca step-ca[206]: time="2026-09-27T17:27:48Z" level=info duration=8.131592ms duration-ns=8131592 fields.time="2026-09-27T17:27:48Z" method=POST name=ca nonce=VDU3WVJaSjdGcFJvNGpBNktTaml6akpKcmRVUHVOc3M path=/acme/acme/order/hDYyVoXl7kAYmHXcxBwRGSQx4MPVyVdw/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=6c6ea648-8a22-4bc2-a30a-5257acc4a243 response="{\"id\":\"hDYyVoXl7kAYmHXcxBwRGSQx4MPVyVdw\",\"status\":\"valid\",\"expires\":\"2026-09-28T17:27:48Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-27T17:26:48Z\",\"notAfter\":\"2026-12-26T17:27:48Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/Hn0orq5MyrMQKZCg93gyPbPnmnXk6JgA\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/hDYyVoXl7kAYmHXcxBwRGSQx4MPVyVdw/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/wFWaKUcvOBfbLcVZClpzVxcBH53WsIkN\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023248.843785] ca step-ca[206]: time="2026-09-27T17:27:48Z" level=info certificate=MIIB0zCCAXqgAwIBAgIRAK4Ar2yJX59yrf5MWlNDU8owCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTI3MTcyNjQ4WhcNMjYxMjI2MTcyNzQ4WjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASRGWR/yzhJGeG3OJqcphtEsHiD8/uGty8SpwS8hksCOEGxq0osRorY8uzySUVXccswm4P6gMG1vp3E1PV67T+Ko4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFOrGU1KvswwxhXSKWCOV3+iZa+K/MB8GA1UdIwQYMBaAFFiW5eKOWF8+rnQ+v/K6ZDOYYxK/MBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDRwAwRAIgI0BttCEMPSyMH26byYuA2G4VE4oP2aZw3HzLY1tXeM8CIHegdGuRJpI9nQnO01MDjez86W9dzloI/yIPWssJ9hyh duration=1.668303ms duration-ns=1668303 fields.time="2026-09-27T17:27:48Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=RnM4M2RaN0w0UHhobGYwNWpRN1pLQnVHNlZPY0NSQnc path=/acme/acme/certificate/wFWaKUcvOBfbLcVZClpzVxcBH53WsIkN protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=f80cd5de-8341-4576-b9c9-a5fdbc00326b sans="map[dns:[ca.foo]]" serial=231289229287412599738259886587345327050 size=1340 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= valid-from="2026-09-27T17:26:48Z" valid-to="2026-12-26T17:27:48Z"
container-test-run-certificates> ca # [2023248.844131] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.829930236Z INFO  Server responded with a certificate. domains=ca.foo
container-test-run-certificates> ca # [2023248.844213] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.830034317Z INFO  Writing file. filepath=certificates/ca.foo.crt
container-test-run-certificates> ca # [2023248.844367] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.830177319Z INFO  Writing file. filepath=certificates/ca.foo.issuer.crt
container-test-run-certificates> ca # [2023248.844431] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.830253640Z INFO  Writing file. filepath=certificates/ca.foo.key
container-test-run-certificates> ca # [2023248.844593] ca acme-order-renew-ca.foo-start[322]: 2026-09-27T17:27:48.830403842Z INFO  Writing file. filepath=certificates/ca.foo.json
container-test-run-certificates> ca # [2023248.848898] ca acme-order-renew-ca.foo-start[309]: + touch out/acme-success
container-test-run-certificates> ca # [2023248.851121] ca acme-order-renew-ca.foo-start[309]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [2023248.852565] ca acme-order-renew-ca.foo-start[309]: + touch out/renewed
container-test-run-certificates> ca # [2023248.854379] ca acme-order-renew-ca.foo-start[309]: + echo Installing new certificate
container-test-run-certificates> ca # [2023248.854379] ca acme-order-renew-ca.foo-start[309]: Installing new certificate
container-test-run-certificates> ca # [2023248.854379] ca acme-order-renew-ca.foo-start[309]: + cp -vp certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [2023248.855997] ca acme-order-renew-ca.foo-start[353]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> ca # [2023248.856376] ca acme-order-renew-ca.foo-start[309]: + cp -vp certificates/ca.foo.key out/key.pem
container-test-run-certificates> ca # [2023248.858189] ca acme-order-renew-ca.foo-start[354]: 'certificates/ca.foo.key' -> 'out/key.pem'
container-test-run-certificates> ca # [2023248.858492] ca acme-order-renew-ca.foo-start[309]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem
container-test-run-certificates> ca # [2023248.860683] ca acme-order-renew-ca.foo-start[355]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> ca # [2023248.861102] ca acme-order-renew-ca.foo-start[309]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> ca # [2023248.863828] ca acme-order-renew-ca.foo-start[309]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [2023248.865776] ca acme-order-renew-ca.foo-start[309]: + for fixpath in out certificates
container-test-run-certificates> ca # [2023248.865776] ca acme-order-renew-ca.foo-start[309]: + '[' -d out ']'
container-test-run-certificates> ca # [2023248.865893] ca acme-order-renew-ca.foo-start[309]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [2023248.867344] ca acme-order-renew-ca.foo-start[309]: + chown -R acme:nginx out
container-test-run-certificates> ca # [2023248.871346] ca acme-order-renew-ca.foo-start[309]: + for fixpath in out certificates
container-test-run-certificates> ca # [2023248.871346] ca acme-order-renew-ca.foo-start[309]: + '[' -d certificates ']'
container-test-run-certificates> ca # [2023248.871440] ca acme-order-renew-ca.foo-start[309]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [2023248.872988] ca acme-order-renew-ca.foo-start[309]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [2023248.877127] ca acme-order-renew-ca.foo-start[309]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [2023249.077124] ca systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> ca # [2023249.082276] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [2023249.082543] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> ca # [2023249.082748] ca systemd[1]: acme-order-renew-ca.foo.service: Consumed 1.200s CPU time over 1.369s wall clock time.
container-test-run-certificates> ca # [2023249.999765] ca nginx[371]: nginx: the configuration file /nix/store/gh4jnj8l81p1sq7mc0i468485s77940l-nginx.conf syntax is ok
container-test-run-certificates> ca # [2023250.000211] ca nginx[371]: nginx: configuration file /nix/store/gh4jnj8l81p1sq7mc0i468485s77940l-nginx.conf test is successful
container-test-run-certificates> ca # [2023250.951459] ca systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> ca # [2023250.951936] ca systemd[1]: Startup finished in 8.190s.
container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 9.17 seconds)
container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem'
container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.01 seconds)
container-test-run-certificates> ca: must succeed: systemctl restart nginx.service
container-test-run-certificates> ca # [2023251.414011] ca systemd[1]: Stopping Nginx Web Server...
container-test-run-certificates> ca # [2023251.532415] ca systemd[1]: nginx.service: Deactivated successfully.
container-test-run-certificates> ca # [2023251.532787] ca systemd[1]: Stopped Nginx Web Server.
container-test-run-certificates> ca # [2023251.532832] ca systemd[1]: nginx.service: Consumed 3.593s CPU time over 4.765s wall clock time.
container-test-run-certificates> ca # [2023251.537366] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 1.10 seconds)
container-test-run-certificates> server: systemd-nspawn running (pid 465)
container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal...
container-test-run-certificates> client: systemd-nspawn running (pid 468)
container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal...
container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem'
container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container server on /build/vm-state-server.
container-test-run-certificates> ░ Spawning container client on /build/vm-state-client.
container-test-run-certificates> ca # [2023252.493546] ca nginx-pre-start[395]: nginx: the configuration file /nix/store/gh4jnj8l81p1sq7mc0i468485s77940l-nginx.conf syntax is ok
container-test-run-certificates> ca # [2023252.494071] ca nginx-pre-start[395]: nginx: configuration file /nix/store/gh4jnj8l81p1sq7mc0i468485s77940l-nginx.conf test is successful
container-test-run-certificates> ca # [2023252.500276] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # No journal files were found.
container-test-run-certificates> server # No journal boot entry found for the specified boot (+0).
container-test-run-certificates> client # [2023253.458009] client systemd-journald[72]: Journal started
container-test-run-certificates> client # [2023253.458065] client systemd-journald[72]: Runtime Journal (/run/log/journal/ee1871e6287649c8a0ab33db26479b12) is 8M, max 2.5G, 2.4G free.
container-test-run-certificates> client # [2023253.463238] client systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> client # [2023253.475715] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> client # [2023253.489503] client systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> client # [2023253.490307] client systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> client # [2023253.491112] client systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> client # [2023253.500376] client systemd-journald[72]: Time spent on flushing to /var/log/journal/ee1871e6287649c8a0ab33db26479b12 is 1.495ms for 7 entries.
container-test-run-certificates> client # [2023253.500376] client systemd-journald[72]: System Journal (/var/log/journal/ee1871e6287649c8a0ab33db26479b12) is 8M, max 4G, 3.9G free.
container-test-run-certificates> client # [2023253.516966] client systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> client # [2023253.517558] client systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> client # [2023253.518526] client systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> client # [2023253.518677] client systemd[1]: Reached target Local File Systems.
container-test-run-certificates> client # [2023253.519582] client systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> client # [2023253.519636] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [2023253.520575] client systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> client # [2023253.521517] client systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> client # [2023253.521545] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> client # [2023253.539800] client systemd-tmpfiles[125]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> client # [2023253.540050] client systemd-tmpfiles[125]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> client # [2023253.540221] client systemd-tmpfiles[125]: fchmod() of /var/log/journal/ee1871e6287649c8a0ab33db26479b12 failed: Operation not permitted
container-test-run-certificates> client # [2023253.540458] client systemd-tmpfiles[125]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [2023253.542114] client systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> client # [2023253.543197] client systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> client # [2023253.544275] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> client # [2023253.559829] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> client # [2023253.564250] client systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> client # [2023253.565356] client systemd[1]: Starting Update is Completed...
container-test-run-certificates> client # [2023253.576910] client systemd[1]: Finished Update is Completed.
container-test-run-certificates> client # [2023253.577094] client systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> client # [2023253.630542] client systemd[1]: Finished Firewall.
container-test-run-certificates> client # [2023253.630699] client systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> client # [2023253.630903] client systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> client # [2023253.631862] client systemd[1]: Starting Network Management...
container-test-run-certificates> server # [2023253.483220] server systemd-journald[72]: Journal started
container-test-run-certificates> server # [2023253.483278] server systemd-journald[72]: Runtime Journal (/run/log/journal/bd1d091dfda24fb38068d9b52b6032a7) is 8M, max 2.5G, 2.4G free.
container-test-run-certificates> server # [2023253.489873] server systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> server # [2023253.504168] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> server # [2023253.521962] server systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> server # [2023253.522898] server systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> server # [2023253.523752] server systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> server # [2023253.532292] server systemd-journald[72]: Time spent on flushing to /var/log/journal/bd1d091dfda24fb38068d9b52b6032a7 is 2.685ms for 7 entries.
container-test-run-certificates> server # [2023253.532292] server systemd-journald[72]: System Journal (/var/log/journal/bd1d091dfda24fb38068d9b52b6032a7) is 8M, max 4G, 3.9G free.
container-test-run-certificates> server # [2023253.548707] server systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> server # [2023253.549357] server systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> server # [2023253.549475] server systemd[1]: Reached target Local File Systems.
container-test-run-certificates> server # [2023253.550354] server systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> server # [2023253.550405] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [2023253.551201] server systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> server # [2023253.551236] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> server # [2023253.552573] server systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> server # [2023253.553547] server systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> server # [2023253.574875] server systemd-tmpfiles[128]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> server # [2023253.575119] server systemd-tmpfiles[128]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> server # [2023253.575288] server systemd-tmpfiles[128]: fchmod() of /var/log/journal/bd1d091dfda24fb38068d9b52b6032a7 failed: Operation not permitted
container-test-run-certificates> server # [2023253.575539] server systemd-tmpfiles[128]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> server # [2023253.576989] server systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> server # [2023253.577379] server systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> server # [2023253.578968] server systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> server # [2023253.579660] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> server # [2023253.593417] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> server # [2023253.601050] server systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> server # [2023253.602045] server systemd[1]: Starting Update is Completed...
container-test-run-certificates> server # [2023253.612264] server systemd[1]: Finished Update is Completed.
container-test-run-certificates> server # [2023253.659674] server systemd[1]: Finished Firewall.
container-test-run-certificates> server # [2023253.659839] server systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> server # [2023253.660069] server systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> server # [2023253.661072] server systemd[1]: Starting Network Management...
container-test-run-certificates> server # [2023254.348908] server systemd-networkd[190]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [2023254.348995] server systemd-networkd[190]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [2023254.358706] server systemd-networkd[190]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [2023254.358867] server systemd-networkd[190]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [2023254.359003] server systemd-networkd[190]: lo: Link UP
container-test-run-certificates> server # [2023254.359006] server systemd-networkd[190]: lo: Gained carrier
container-test-run-certificates> server # [2023254.359170] server systemd-networkd[190]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> server # [2023254.359592] server systemd[1]: Started Network Management.
container-test-run-certificates> server # [2023254.376320] server systemd-networkd[190]: eth1: Link UP
container-test-run-certificates> server # [2023254.376446] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> server # [2023254.376728] server systemd-networkd[190]: eth1: Gained carrier
container-test-run-certificates> server # [2023254.410528] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> server # [2023254.495296] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> client # [2023254.321879] client systemd-networkd[186]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [2023254.321969] client systemd-networkd[186]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [2023254.333586] client systemd-networkd[186]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [2023254.333749] client systemd-networkd[186]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [2023254.333895] client systemd-networkd[186]: lo: Link UP
container-test-run-certificates> client # [2023254.333899] client systemd-networkd[186]: lo: Gained carrier
container-test-run-certificates> client # [2023254.334087] client systemd-networkd[186]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> client # [2023254.334482] client systemd[1]: Started Network Management.
container-test-run-certificates> client # [2023254.334547] client systemd-networkd[186]: eth1: Link UP
container-test-run-certificates> client # [2023254.334878] client systemd-networkd[186]: eth1: Gained carrier
container-test-run-certificates> client # [2023254.336324] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> client # [2023254.385963] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> client # [2023254.469791] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> client # [2023254.690412] client systemd-resolved[104]: Positive Trust Anchors:
container-test-run-certificates> client # [2023254.690423] client systemd-resolved[104]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> client # [2023254.690426] client systemd-resolved[104]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> client # [2023254.690461] client systemd-resolved[104]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> client # [2023254.712340] client systemd-resolved[104]: Using system hostname 'client'.
container-test-run-certificates> client # [2023254.713704] client systemd[1]: Started Network Name Resolution.
container-test-run-certificates> client # [2023254.713840] client systemd[1]: Reached target Network.
container-test-run-certificates> client # [2023254.713951] client systemd[1]: Reached target System Initialization.
container-test-run-certificates> client # [2023254.714040] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [2023254.714097] client systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> client # [2023254.714135] client systemd[1]: Reached target Timer Units.
container-test-run-certificates> client # [2023254.714361] client systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> client # [2023254.714572] client systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> client # [2023254.714803] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> client # [2023254.714846] client systemd[1]: Reached target Socket Units.
container-test-run-certificates> client # [2023254.714926] client systemd[1]: Reached target Basic System.
container-test-run-certificates> client # [2023254.717407] client systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> client # [2023254.718822] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> client # [2023254.720972] client systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> client # [2023254.775144] client systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> client # [2023254.990101] client nsncd[192]: Sep 27 17:27:54.975 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> client # [2023254.990067] client systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> client # [2023254.990176] client systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> client # [2023254.990280] client systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> server # [2023254.723940] server systemd-resolved[107]: Positive Trust Anchors:
container-test-run-certificates> server # [2023254.723951] server systemd-resolved[107]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> server # [2023254.723955] server systemd-resolved[107]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> server # [2023254.723989] server systemd-resolved[107]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> server # [2023254.745683] server systemd-resolved[107]: Using system hostname 'server'.
container-test-run-certificates> server # [2023254.747031] server systemd[1]: Started Network Name Resolution.
container-test-run-certificates> server # [2023254.747164] server systemd[1]: Reached target Network.
container-test-run-certificates> server # [2023254.747272] server systemd[1]: Reached target Network is Online.
container-test-run-certificates> server # [2023254.747354] server systemd[1]: Reached target System Initialization.
container-test-run-certificates> server # [2023254.747728] server systemd[1]: Started Renew ACME Certificate for test.foo.
container-test-run-certificates> server # [2023254.747782] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [2023254.747833] server systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> server # [2023254.747875] server systemd[1]: Reached target Timer Units.
container-test-run-certificates> server # [2023254.748157] server systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> server # [2023254.748352] server systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> server # [2023254.748572] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> server # [2023254.748618] server systemd[1]: Reached target Socket Units.
container-test-run-certificates> server # [2023254.748701] server systemd[1]: Reached target Basic System.
container-test-run-certificates> server # [2023254.757618] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> server # [2023254.758911] server systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> server # [2023254.758979] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem
container-test-run-certificates> server # [2023254.760557] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> server # [2023254.762726] server systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> server # [2023254.782776] server systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> server # [2023254.917288] server acme-setup-privileged[195]: + set -euo pipefail
container-test-run-certificates> server # [2023254.917288] server acme-setup-privileged[195]: + cd /var/lib/acme
container-test-run-certificates> server # [2023254.917740] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> server # [2023254.919268] server acme-setup-privileged[195]: + chown -R acme .lego/accounts
container-test-run-certificates> server # [2023254.921221] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [2023254.921272] server acme-setup-privileged[195]: + '[' -d test.foo ']'
container-test-run-certificates> server # [2023254.921272] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [2023254.921272] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']'
container-test-run-certificates> server # [2023254.942111] server systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> server # [2023254.942583] server nsncd[197]: Sep 27 17:27:54.927 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> server # [2023254.942246] server systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> server # [2023254.942357] server systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> server # [2023254.956736] server systemd[1]: Starting User Login Management...
container-test-run-certificates> server # [2023254.958139] server systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> server # [2023254.970513] server systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> server # [2023254.972316] server systemd[1]: Started Console Getty.
container-test-run-certificates> server # [2023254.972392] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> server # [2023254.972432] server systemd[1]: Reached target Login Prompts.
container-test-run-certificates> server # [2023255.134168] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> server # [2023255.135415] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> server # [2023255.135415] server dbus-broker-launch[198]: Invalid user-name in /nix/store/hhf78xjbhahwklqhs8v1mlicy0h1q0m9-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> client # [2023254.992302] client systemd[1]: Starting User Login Management...
container-test-run-certificates> client # [2023254.993767] client systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> client # [2023255.006857] client systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> client # [2023255.008887] client systemd[1]: Started Console Getty.
container-test-run-certificates> client # [2023255.008958] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> client # [2023255.008998] client systemd[1]: Reached target Login Prompts.
container-test-run-certificates> client # [2023255.146569] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> client # [2023255.148072] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> client # [2023255.148072] client dbus-broker-launch[193]: Invalid user-name in /nix/store/jnwijn22akqm9wx5cbsh5r175688pxrd-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> client # [2023255.148688] client systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> client # [2023255.157444] client dbus-broker-launch[193]: Ready
container-test-run-certificates> server # [2023255.135949] server systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> server # [2023255.145433] server dbus-broker-launch[198]: Ready
container-test-run-certificates> client # [2023255.827690] client systemd-logind[208]: New seat seat0.
container-test-run-certificates> client # [2023255.827875] client systemd[1]: Started User Login Management.
container-test-run-certificates> client # [2023255.848783] client systemd[1]: Starting linger-users.service...
container-test-run-certificates> client # [2023255.863094] client systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> client # [2023255.863211] client systemd[1]: Finished linger-users.service.
container-test-run-certificates> client # [2023255.863784] client systemd[1]: Reached target Multi-User System.
container-test-run-certificates> client # [2023255.864016] client systemd[1]: Startup finished in 2.829s.
container-test-run-certificates> server # [2023255.820948] server systemd-logind[222]: New seat seat0.
container-test-run-certificates> server # [2023255.821140] server systemd[1]: Started User Login Management.
container-test-run-certificates> server # [2023255.823342] server systemd[1]: Starting linger-users.service...
container-test-run-certificates> server # [2023255.858405] server systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> server # [2023255.858710] server systemd[1]: Finished linger-users.service.
container-test-run-certificates> server # [2023255.912418] server acme-setup-start[211]: + set -euo pipefail
container-test-run-certificates> server # [2023255.912418] server acme-setup-start[211]: + test -e ca/key.pem
container-test-run-certificates> server # [2023255.912765] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> server # [2023255.935794] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> server # [2023255.938451] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> server # [2023256.128132] server systemd-networkd[190]: eth1: Gained IPv6LL
container-test-run-certificates> client # [2023256.352118] client systemd-networkd[186]: eth1: Gained IPv6LL
container-test-run-certificates> server # [2023256.788452] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [2023256.791994] server acme-test.foo-start[248]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [2023256.791994] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [2023256.807138] server acme-test.foo-start[258]: + cd test.foo
container-test-run-certificates> server # [2023256.807722] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [2023256.809086] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [2023256.809425] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [2023256.810906] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [2023256.811148] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [2023256.812832] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [2023256.814609] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [2023256.816667] server acme-test.foo-start[248]: + for fixpath in out certificates
container-test-run-certificates> server # [2023256.816667] server acme-test.foo-start[248]: + '[' -d out ']'
container-test-run-certificates> server # [2023256.816792] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [2023256.818472] server acme-test.foo-start[248]: + chown -R acme:nginx out
container-test-run-certificates> server # [2023256.822272] server acme-test.foo-start[248]: + for fixpath in out certificates
container-test-run-certificates> server # [2023256.822272] server acme-test.foo-start[248]: + '[' -d certificates ']'
container-test-run-certificates> server # [2023256.827588] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [2023256.829926] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> server # [2023257.733024] server nginx-pre-start[270]: nginx: the configuration file /nix/store/0kdv0bhdg6q74n8gxxvaq68qd56jnn35-nginx.conf syntax is ok
container-test-run-certificates> server # [2023257.733657] server nginx-pre-start[270]: nginx: configuration file /nix/store/0kdv0bhdg6q74n8gxxvaq68qd56jnn35-nginx.conf test is successful
container-test-run-certificates> server # [2023257.738230] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [2023257.739128] server systemd[1]: Reached target Multi-User System.
container-test-run-certificates> server # [2023257.740658] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> server # [2023258.674363] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [2023258.677604] server acme-order-renew-test.foo-start[273]: + set -euo pipefail
container-test-run-certificates> server # [2023258.677682] server acme-order-renew-test.foo-start[273]: + exec
container-test-run-certificates> server # [2023258.677751] server acme-order-renew-test.foo-start[273]: + /nix/store/fxkh6pl0y4nfbhdqdnhfkvsq7pbxq655-flock-0.4.0/bin/flock 11
container-test-run-certificates> server # [2023258.679369] server acme-order-renew-test.foo-start[284]: ++ find accounts -path '*/keys/*.key' -print -quit
container-test-run-certificates> server # [2023258.682399] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']'
container-test-run-certificates> server # [2023258.682482] server acme-order-renew-test.foo-start[273]: + exec
container-test-run-certificates> server # [2023258.682535] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']'
container-test-run-certificates> server # [2023258.682535] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains
container-test-run-certificates> server # [2023258.703495] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.689275796Z INFO  Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key
container-test-run-certificates> server # [2023258.738709] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.724509560Z INFO  Registering the account. email=none@none.tld
container-test-run-certificates> server # [2023258.754736] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.740537100Z WARN  !!!! HEADS UP !!!!
container-test-run-certificates> server # [2023258.754736] server acme-order-renew-test.foo-start[286]: Your account credentials have been saved in your
container-test-run-certificates> server # [2023258.754736] server acme-order-renew-test.foo-start[286]: configuration directory at "accounts".
container-test-run-certificates> server # [2023258.754736] server acme-order-renew-test.foo-start[286]: You should make a secure backup of this folder now. This
container-test-run-certificates> server # [2023258.754736] server acme-order-renew-test.foo-start[286]: configuration directory will also contain private keys
container-test-run-certificates> server # [2023258.754736] server acme-order-renew-test.foo-start[286]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> server # [2023258.754736] server acme-order-renew-test.foo-start[286]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> server # [2023258.755075] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.740735663Z INFO  Obtaining bundled SAN certificate. domains=test.foo
container-test-run-certificates> server # [2023258.827543] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.813320940Z INFO  Use solver. domain=test.foo type=http-01
container-test-run-certificates> server # [2023258.827543] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.813380781Z INFO  http01: Trying to solve HTTP-01. domain=test.foo
container-test-run-certificates> server # [2023258.837429] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.823224476Z INFO  The server validated our request. domain=test.foo
container-test-run-certificates> server # [2023258.837543] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.823353998Z INFO  Validations succeeded; requesting certificates. domains=test.foo
container-test-run-certificates> server # [2023258.858066] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.843864200Z INFO  Server responded with a certificate. domains=test.foo
container-test-run-certificates> server # [2023258.858137] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.843961481Z INFO  Writing file. filepath=certificates/test.foo.crt
container-test-run-certificates> server # [2023258.858300] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.844109483Z INFO  Writing file. filepath=certificates/test.foo.issuer.crt
container-test-run-certificates> server # [2023258.858379] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.844193604Z INFO  Writing file. filepath=certificates/test.foo.key
container-test-run-certificates> server # [2023258.858538] server acme-order-renew-test.foo-start[286]: 2026-09-27T17:27:58.844348006Z INFO  Writing file. filepath=certificates/test.foo.json
container-test-run-certificates> server # [2023258.864072] server acme-order-renew-test.foo-start[273]: + touch out/acme-success
container-test-run-certificates> server # [2023258.866051] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [2023258.867373] server acme-order-renew-test.foo-start[273]: + touch out/renewed
container-test-run-certificates> server # [2023258.869139] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate
container-test-run-certificates> server # [2023258.869139] server acme-order-renew-test.foo-start[273]: Installing new certificate
container-test-run-certificates> server # [2023258.869139] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [2023258.871141] server acme-order-renew-test.foo-start[317]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> server # [2023258.871494] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem
container-test-run-certificates> server # [2023258.873393] server acme-order-renew-test.foo-start[318]: 'certificates/test.foo.key' -> 'out/key.pem'
container-test-run-certificates> server # [2023258.873714] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem
container-test-run-certificates> server # [2023258.875465] server acme-order-renew-test.foo-start[319]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> server # [2023258.875778] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> server # [2023258.877719] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [2023258.879712] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates
container-test-run-certificates> server # [2023258.879712] server acme-order-renew-test.foo-start[273]: + '[' -d out ']'
container-test-run-certificates> server # [2023258.879803] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [2023258.881349] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out
container-test-run-certificates> server # [2023258.885132] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates
container-test-run-certificates> server # [2023258.885132] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']'
container-test-run-certificates> server # [2023258.885132] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> server # [2023258.886810] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates
container-test-run-certificates> server # [2023258.890339] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [2023258.738158] ca step-ca[206]: time="2026-09-27T17:27:58Z" level=info duration="61.761µs" duration-ns=61761 fields.time="2026-09-27T17:27:58Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=6959fd68-9d05-4da8-ab4e-6551a7750b2b response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023258.748724] ca step-ca[206]: time="2026-09-27T17:27:58Z" level=info duration=6.827894ms duration-ns=6827894 fields.time="2026-09-27T17:27:58Z" method=HEAD name=ca nonce=a2lXOWpMUkd6Y3phVjg0YkxVczZtdUpQcTFSUTd4S2c path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=6bd28661-d9ad-4571-9131-eb199e659df0 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023258.753993] ca step-ca[206]: time="2026-09-27T17:27:58Z" level=info duration=2.543875ms duration-ns=2543875 fields.time="2026-09-27T17:27:58Z" method=POST name=ca nonce=OXJzOGFNdGpYVWpCdEczQVBXZW1MRjVraEhmZnROQVI path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=ac2b4794-bd9c-4e69-a611-7a55af464ada response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/hidYCy0CCDFi76kLWj3DOL7Y4eZoQkYk/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023258.763094] ca step-ca[206]: time="2026-09-27T17:27:58Z" level=info duration=4.262619ms duration-ns=4262619 fields.time="2026-09-27T17:27:58Z" method=POST name=ca nonce=Zm5pb1N4dWl5bExBQzhLbDFmWDdqUU43Y1FqM0VJSk8 path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=8b61a775-ce62-4752-87b5-5cd236c8be00 response="{\"id\":\"Be72plV3MF0KMHYqWPpxFBeQSeGrPJVH\",\"status\":\"pending\",\"expires\":\"2026-09-28T17:27:58Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-27T17:26:58Z\",\"notAfter\":\"2026-12-26T17:27:58Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/AD9qCCZP2hVcW98idVOFNKiUHngx6VVB\"],\"finalize\":\"https://ca.foo/acme/acme/order/Be72plV3MF0KMHYqWPpxFBeQSeGrPJVH/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023258.826677] ca step-ca[206]: time="2026-09-27T17:27:58Z" level=info duration=2.363192ms duration-ns=2363192 fields.time="2026-09-27T17:27:58Z" method=POST name=ca nonce=UHM0YTlRNmpxeWRVVE5uYWk4ZUI5Z2U0SFd6QTZONlc path=/acme/acme/authz/AD9qCCZP2hVcW98idVOFNKiUHngx6VVB protocol=HTTP/1.1 referer= remote-address="::1" request-id=f5f73aa6-6f5e-4ea0-9dc2-491d613ae3d5 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"TCX9yKq1Byy6LTKrX7ucjghdxc2eyp1v\",\"url\":\"https://ca.foo/acme/acme/challenge/AD9qCCZP2hVcW98idVOFNKiUHngx6VVB/dm5AaW4eck72Hoh5QO78UY4lT9a8i4qE\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"TCX9yKq1Byy6LTKrX7ucjghdxc2eyp1v\",\"url\":\"https://ca.foo/acme/acme/challenge/AD9qCCZP2hVcW98idVOFNKiUHngx6VVB/Yj6607piU7kRNlFmoXicJNZVIVBuL8W5\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"TCX9yKq1Byy6LTKrX7ucjghdxc2eyp1v\",\"url\":\"https://ca.foo/acme/acme/challenge/AD9qCCZP2hVcW98idVOFNKiUHngx6VVB/8mmQV5fh8AconFkDwVKSFfqor0XDlFq4\"}],\"wildcard\":false,\"expires\":\"2026-09-28T17:27:58Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023258.836531] ca step-ca[206]: time="2026-09-27T17:27:58Z" level=info duration=4.765905ms duration-ns=4765905 fields.time="2026-09-27T17:27:58Z" method=POST name=ca nonce=Y1lTdUpVS2RkeWdWR1o2N0sxUkk1TDVCbkpKYVd1TEU path=/acme/acme/challenge/AD9qCCZP2hVcW98idVOFNKiUHngx6VVB/Yj6607piU7kRNlFmoXicJNZVIVBuL8W5 protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=344c6c70-6a18-4981-a913-ac73f7c415a3 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"TCX9yKq1Byy6LTKrX7ucjghdxc2eyp1v\",\"validated\":\"2026-09-27T17:27:58Z\",\"url\":\"https://ca.foo/acme/acme/challenge/AD9qCCZP2hVcW98idVOFNKiUHngx6VVB/Yj6607piU7kRNlFmoXicJNZVIVBuL8W5\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023258.851082] ca step-ca[206]: time="2026-09-27T17:27:58Z" level=info duration=8.585198ms duration-ns=8585198 fields.time="2026-09-27T17:27:58Z" method=POST name=ca nonce=WmFCTlprd2huMW1CVkFUMVR4QUZEalJ6MVdTNnN5U3Y path=/acme/acme/order/Be72plV3MF0KMHYqWPpxFBeQSeGrPJVH/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=665f478a-c78c-4e9d-9f42-da9900930025 response="{\"id\":\"Be72plV3MF0KMHYqWPpxFBeQSeGrPJVH\",\"status\":\"valid\",\"expires\":\"2026-09-28T17:27:58Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-27T17:26:58Z\",\"notAfter\":\"2026-12-26T17:27:58Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/AD9qCCZP2hVcW98idVOFNKiUHngx6VVB\"],\"finalize\":\"https://ca.foo/acme/acme/order/Be72plV3MF0KMHYqWPpxFBeQSeGrPJVH/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/DRTkOqNBAAqsU55IkwSmHnZdtmABreqh\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id=
container-test-run-certificates> ca # [2023258.857417] ca step-ca[206]: time="2026-09-27T17:27:58Z" level=info certificate="MIIB2DCCAX6gAwIBAgIRAPmON1UZ6wCNx7wowMqigwswCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYwOTI3MTcyNjU4WhcNMjYxMjI2MTcyNzU4WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABP2EP0PIB9PEAplErla0lxrDT+DxgALVOvNxnu5mgCGJ0AcRg9Wcinhcp8m0ns4qg+1b6lkE07wIFcv4xowiBvSjgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUDJCn7ZlmxvkD1S6NGV7JJzCNWPMwHwYDVR0jBBgwFoAUWJbl4o5YXz6udD6/8rpkM5hjEr8wEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0gAMEUCICNkR/3pkaiIvK0nkgeMWgCs+SRcbrrFJJoGxlXZgn4iAiEArDQNL88NNJ+M//xHq/l313hF91jqXE/8cmvJi7oZzJI=" duration=1.836146ms duration-ns=1836146 fields.time="2026-09-27T17:27:58Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=UXhYc2oyTXhrT1FaS3ZIdHFqYVVTWG9UdE8wY3ZtQnk path=/acme/acme/certificate/DRTkOqNBAAqsU55IkwSmHnZdtmABreqh protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=df139ed2-746e-42dd-b194-4d99842a0cee sans="map[dns:[test.foo]]" serial=331716199379299237859167703323501560587 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; arm64)" user-id= valid-from="2026-09-27T17:26:58Z" valid-to="2026-12-26T17:27:58Z"
container-test-run-certificates> server # [2023259.071340] server systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> server # [2023259.076252] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [2023259.076499] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> server # [2023259.076713] server systemd[1]: acme-order-renew-test.foo.service: Consumed 1.124s CPU time over 1.335s wall clock time.
container-test-run-certificates> server # [2023260.016773] server nginx[335]: nginx: the configuration file /nix/store/0kdv0bhdg6q74n8gxxvaq68qd56jnn35-nginx.conf syntax is ok
container-test-run-certificates> server # [2023260.017335] server nginx[335]: nginx: configuration file /nix/store/0kdv0bhdg6q74n8gxxvaq68qd56jnn35-nginx.conf test is successful
container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 8.67 seconds)
container-test-run-certificates> server: must succeed: systemctl restart nginx.service
container-test-run-certificates> server # [2023260.969982] server systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> server # [2023260.970453] server systemd[1]: Startup finished in 7.936s.
container-test-run-certificates> server # [2023261.187706] server systemd[1]: Stopping Nginx Web Server...
container-test-run-certificates> server # [2023261.270845] server systemd[1]: nginx.service: Deactivated successfully.
container-test-run-certificates> server # [2023261.271140] server systemd[1]: Stopped Nginx Web Server.
container-test-run-certificates> server # [2023261.271217] server systemd[1]: nginx.service: Consumed 5.428s CPU time over 4.440s wall clock time.
container-test-run-certificates> server # [2023261.276448] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 1.07 seconds)
container-test-run-certificates> client: waiting for success: curl -v https://test.foo
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 37562 failed: Connection refused
container-test-run-certificates> *   Trying 192.168.1.3:443...
container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 60268 failed: Connection refused
container-test-run-certificates> * Failed to connect to test.foo:443 after 2 ms: Could not connect to server
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 2 ms: Could not connect to server
container-test-run-certificates> server # [2023262.234786] server nginx-pre-start[358]: nginx: the configuration file /nix/store/0kdv0bhdg6q74n8gxxvaq68qd56jnn35-nginx.conf syntax is ok
container-test-run-certificates> server # [2023262.235320] server nginx-pre-start[358]: nginx: configuration file /nix/store/0kdv0bhdg6q74n8gxxvaq68qd56jnn35-nginx.conf test is successful
container-test-run-certificates> server # [2023262.240400] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1552 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [932 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [79 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Sep 27 17:26:58 2026 GMT
container-test-run-certificates> *   expire date: Dec 26 17:27:58 2026 GMT
container-test-run-certificates> *   issuer: CN=Clan Intermediate CA
container-test-run-certificates> *   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 0
container-test-run-certificates> * SSL certificate verified via OpenSSL.
container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 37570 
container-test-run-certificates>   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
container-test-run-certificates>                                  Dload  Upload  Total   Spent   Left   Speed
container-test-run-certificates>   0      0   0      0   0      0      0      0                              0* using HTTP/2
container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/
container-test-run-certificates> * [HTTP/2] [1] [:method: GET]
container-test-run-certificates> * [HTTP/2] [1] [:scheme: https]
container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo]
container-test-run-certificates> * [HTTP/2] [1] [:path: /]
container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0]
container-test-run-certificates> * [HTTP/2] [1] [accept: */*]
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> * Request completely sent off
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> 100     20 100     20   0      0    662      0                              0
container-test-run-certificates> * Connection #0 to host test.foo:443 left intact
container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.07 seconds)
container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2
container-test-run-certificates> Certificate:
container-test-run-certificates>     Data:
container-test-run-certificates>         Version: 3 (0x2)
container-test-run-certificates>         Serial Number:
container-test-run-certificates>             f9:8e:37:55:19:eb:00:8d:c7:bc:28:c0:ca:a2:83:0b
container-test-run-certificates>         Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>         Issuer: CN=Clan Intermediate CA
container-test-run-certificates>         Validity
container-test-run-certificates>             Not Before: Sep 27 17:26:58 2026 GMT
container-test-run-certificates>             Not After : Dec 26 17:27:58 2026 GMT
container-test-run-certificates>         Subject: CN=test.foo
container-test-run-certificates>         Subject Public Key Info:
container-test-run-certificates>             Public Key Algorithm: id-ecPublicKey
container-test-run-certificates>                 Public-Key: (256 bit)
container-test-run-certificates>                 pub:
container-test-run-certificates>                     04:fd:84:3f:43:c8:07:d3:c4:02:99:44:ae:56:b4:
container-test-run-certificates>                     97:1a:c3:4f:e0:f1:80:02:d5:3a:f3:71:9e:ee:66:
container-test-run-certificates>                     80:21:89:d0:07:11:83:d5:9c:8a:78:5c:a7:c9:b4:
container-test-run-certificates>                     9e:ce:2a:83:ed:5b:ea:59:04:d3:bc:08:15:cb:f8:
container-test-run-certificates>                     c6:8c:22:06:f4
container-test-run-certificates>                 ASN1 OID: prime256v1
container-test-run-certificates>                 NIST CURVE: P-256
container-test-run-certificates>         X509v3 extensions:
container-test-run-certificates>             X509v3 Key Usage: critical
container-test-run-certificates>                 Digital Signature
container-test-run-certificates>             X509v3 Extended Key Usage: 
container-test-run-certificates>                 TLS Web Server Authentication, TLS Web Client Authentication
container-test-run-certificates>             X509v3 Subject Key Identifier: 
container-test-run-certificates>                 0C:90:A7:ED:99:66:C6:F9:03:D5:2E:8D:19:5E:C9:27:30:8D:58:F3
container-test-run-certificates>             X509v3 Authority Key Identifier: 
container-test-run-certificates>                 58:96:E5:E2:8E:58:5F:3E:AE:74:3E:BF:F2:BA:64:33:98:63:12:BF
container-test-run-certificates>             X509v3 Subject Alternative Name: 
container-test-run-certificates>                 DNS:test.foo
container-test-run-certificates>             1.3.6.1.4.1.37476.9000.64.1: 
container-test-run-certificates>                 0......acme..
container-test-run-certificates>     Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>     Signature Value:
container-test-run-certificates>         30:45:02:20:23:64:47:fd:e9:91:a8:88:bc:ad:27:92:07:8c:
container-test-run-certificates>         5a:00:ac:f9:24:5c:6e:ba:c5:24:9a:06:c6:55:d9:82:7e:22:
container-test-run-certificates>         02:21:00:ac:34:0d:2f:cf:0d:34:9f:8c:ff:fc:47:ab:f9:77:
container-test-run-certificates>         d7:78:45:f7:58:ea:5c:4f:fc:72:6b:c9:8b:ba:19:cc:92
container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.05 seconds)
container-test-run-certificates> (finished: run the VM test script, in 21.13 seconds)
container-test-run-certificates> test script finished in 21.18s
container-test-run-certificates> cleanup
container-test-run-certificates> kill NspawnMachine (pid 50)
container-test-run-certificates> kill NspawnMachine (pid 468)
container-test-run-certificates> Container ca terminated by signal KILL.
container-test-run-certificates> kill NspawnMachine (pid 465)
container-test-run-certificates> Container client terminated by signal KILL.
container-test-run-certificates> Container server terminated by signal KILL.
container-test-run-certificates> (finished: cleanup, in 0.49 seconds)