don't know how to build these paths:
  /nix/store/g018wf0d6691jm94m7cc3bccv6jrwv2z-container-test-run-certificates.drv
warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user
building '/nix/store/p2c9mgnapypf4ac1zz2c3z2dr5q4hxsd-X-Restart-Triggers-acme-ca.foo.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-acme-ca.foo> web01: building p2c9mgnapypf4ac1zz2c3z2dr5q4hxsd-X-Restart-Triggers-acme-ca.foo.drv
X-Restart-Triggers-acme-ca.foo> structuredAttrs is enabled
building '/nix/store/xgnnnfwvl9sgyfkhbz00z8886ma33z54-system-generators.drv' on nix-store.geninf.io:50051
system-generators> web01: building xgnnnfwvl9sgyfkhbz00z8886ma33z54-system-generators.drv
building '/nix/store/kfpcbnz4dh5zmnqihkxw1n26ir8rwf61-vars-check-certificates.drv' on nix-store.geninf.io:50051
vars-check-certificates> gi-build-x86-01: building kfpcbnz4dh5zmnqihkxw1n26ir8rwf61-vars-check-certificates.drv
building '/nix/store/szxcpvwgr74z6wvycdcb6x1warwwskdn-firewall-start.drv' on nix-store.geninf.io:50051
firewall-start> gi-build-x86-01: building szxcpvwgr74z6wvycdcb6x1warwwskdn-firewall-start.drv
firewall-start> structuredAttrs is enabled
building '/nix/store/y9fs414xl5x0ffwgjn4rpc28255cdhrg-etc-hostname.drv' on nix-store.geninf.io:50051
etc-hostname> gi-build-x86-01: building y9fs414xl5x0ffwgjn4rpc28255cdhrg-etc-hostname.drv
etc-hostname> structuredAttrs is enabled
vars-check-certificates> Running vars check using Nix-based executor...
vars-check-certificates> ✓ All vars checks completed successfully
building '/nix/store/537y3yanxipw0f0vxm2g3nyi498d1q72-firewall-reload.drv' on nix-store.geninf.io:50051
firewall-reload> web01: building 537y3yanxipw0f0vxm2g3nyi498d1q72-firewall-reload.drv
firewall-reload> structuredAttrs is enabled
building '/nix/store/jlc2zn98ndwkj9vwzway9bsm1b42k10k-unit-firewall.service.drv' on nix-store.geninf.io:50051
unit-firewall.service> gi-build-x86-01: building jlc2zn98ndwkj9vwzway9bsm1b42k10k-unit-firewall.service.drv
unit-firewall.service> structuredAttrs is enabled
building '/nix/store/54gkiq79j1aaai5nhkv25dyk0b0dp906-acme-postrun.drv' on nix-store.geninf.io:50051
acme-postrun> build-x86-01: building 54gkiq79j1aaai5nhkv25dyk0b0dp906-acme-postrun.drv
acme-postrun> structuredAttrs is enabled
building '/nix/store/xhv4abv4yra7n3fymxkxaxirz9r6ydwb-users-groups.json.drv' on nix-store.geninf.io:50051
users-groups.json> build-x86-01: building xhv4abv4yra7n3fymxkxaxirz9r6ydwb-users-groups.json.drv
users-groups.json> structuredAttrs is enabled
building '/nix/store/b4rfjh6vn5mfr5whkx5nivb7y01zlf42-string-hosts.drv' on nix-store.geninf.io:50051
string-hosts> build-x86-01: building b4rfjh6vn5mfr5whkx5nivb7y01zlf42-string-hosts.drv
building '/nix/store/fxnqf6cza9ibnwj1dq2linzdq88kaddr-unit-acme-renew-ca.foo.timer.drv' on nix-store.geninf.io:50051
unit-acme-renew-ca.foo.timer> build-x86-01: building fxnqf6cza9ibnwj1dq2linzdq88kaddr-unit-acme-renew-ca.foo.timer.drv
building '/nix/store/5zwipm2i2z6h1m04yjg902mqm9bqypdm-unit-acme-renew-test.foo.timer.drv' on nix-store.geninf.io:50051
unit-acme-renew-test.foo.timer> build-x86-01: building 5zwipm2i2z6h1m04yjg902mqm9bqypdm-unit-acme-renew-test.foo.timer.drv
string-hosts> structuredAttrs is enabled
unit-acme-renew-ca.foo.timer> structuredAttrs is enabled
unit-acme-renew-test.foo.timer> structuredAttrs is enabled
building '/nix/store/kyg9b2n9nvakfbsnggh51vj2qxdcrma3-dry-activate.drv' on nix-store.geninf.io:50051
dry-activate> web01: building kyg9b2n9nvakfbsnggh51vj2qxdcrma3-dry-activate.drv
dry-activate> structuredAttrs is enabled
building '/nix/store/2h4vh79dwmchkjj3dyzl80nk32px9in5-unit-acme-account-2c44cb477b4787b2cf13.target.drv' on nix-store.geninf.io:50051
unit-acme-account-2c44cb477b4787b2cf13.target> gi-build-x86-02: building 2h4vh79dwmchkjj3dyzl80nk32px9in5-unit-acme-account-2c44cb477b4787b2cf13.target.drv
building '/nix/store/dwf27gldd6y2cwp69z10g8aqzrf0lcq4-X-Restart-Triggers-acme-test.foo.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-acme-test.foo> gi-build-x86-02: building dwf27gldd6y2cwp69z10g8aqzrf0lcq4-X-Restart-Triggers-acme-test.foo.drv
building '/nix/store/g98hg8my196j9w6qkzl699kyi26y664k-ca.json.drv' on nix-store.geninf.io:50051
ca.json> gi-build-x86-02: building g98hg8my196j9w6qkzl699kyi26y664k-ca.json.drv
unit-acme-account-2c44cb477b4787b2cf13.target> structuredAttrs is enabled
X-Restart-Triggers-acme-test.foo> structuredAttrs is enabled
ca.json> structuredAttrs is enabled
building '/nix/store/7pmalg4ias0nsnzdcv602jmgl24wfxps-X-Reload-Triggers-systemd-networkd.drv' on nix-store.geninf.io:50051
X-Reload-Triggers-systemd-networkd> gi-build-x86-02: building 7pmalg4ias0nsnzdcv602jmgl24wfxps-X-Reload-Triggers-systemd-networkd.drv
building '/nix/store/qlq36rimqjyyfz37xf71961mlflwsb7i-test-script.drv' on nix-store.geninf.io:50051
test-script> gi-build-x86-02: building qlq36rimqjyyfz37xf71961mlflwsb7i-test-script.drv
X-Reload-Triggers-systemd-networkd> structuredAttrs is enabled
test-script> structuredAttrs is enabled
building '/nix/store/b5idh8mcja29mkz02xs3fbb0665w4lcb-unit-acme-account-d22a46d9459bf683a338.target.drv' on nix-store.geninf.io:50051
unit-acme-account-d22a46d9459bf683a338.target> gi-build-x86-02: building b5idh8mcja29mkz02xs3fbb0665w4lcb-unit-acme-account-d22a46d9459bf683a338.target.drv
building '/nix/store/9hpzj734nz40lvrj17nx0g34hg2xalz7-extra-hosts.drv' on nix-store.geninf.io:50051
extra-hosts> gi-build-x86-02: building 9hpzj734nz40lvrj17nx0g34hg2xalz7-extra-hosts.drv
unit-acme-account-d22a46d9459bf683a338.target> structuredAttrs is enabled
extra-hosts> structuredAttrs is enabled
building '/nix/store/d1zyxic95qr7b3lc6ywmdhaajgfsz58k-unit-script-acme-ca.foo-start.drv' on nix-store.geninf.io:50051
unit-script-acme-ca.foo-start> build-x86-01: building d1zyxic95qr7b3lc6ywmdhaajgfsz58k-unit-script-acme-ca.foo-start.drv
unit-script-acme-ca.foo-start> structuredAttrs is enabled
building '/nix/store/3z1rbqv3fmjlix16dhlh37fb3rsbj1vl-acme-setup-privileged.drv' on nix-store.geninf.io:50051
acme-setup-privileged> gi-build-x86-02: building 3z1rbqv3fmjlix16dhlh37fb3rsbj1vl-acme-setup-privileged.drv
acme-setup-privileged> structuredAttrs is enabled
building '/nix/store/cxbyp5cpiqk2qzpppsmi9bvqz3pldsaf-tmpfiles.d.drv' on nix-store.geninf.io:50051
tmpfiles.d> gi-build-x86-02: building cxbyp5cpiqk2qzpppsmi9bvqz3pldsaf-tmpfiles.d.drv
building '/nix/store/yilfk4h1b2hx1spwhbwcphwxc1gbkhq8-users-groups.json.drv' on nix-store.geninf.io:50051
users-groups.json> gi-build-x86-02: building yilfk4h1b2hx1spwhbwcphwxc1gbkhq8-users-groups.json.drv
users-groups.json> structuredAttrs is enabled
building '/nix/store/44g1sh7wzdvxhqvyrhidl9qa7ls0pvz5-nginx.conf.drv' on nix-store.geninf.io:50051
nginx.conf> build-x86-01: building 44g1sh7wzdvxhqvyrhidl9qa7ls0pvz5-nginx.conf.drv
nginx.conf> structuredAttrs is enabled
building '/nix/store/4lypkiza4p9y8kbfp4qv7s9awbir0jgr-decrypt-age-secrets.drv' on nix-store.geninf.io:50051
decrypt-age-secrets> gi-build-x86-02: building 4lypkiza4p9y8kbfp4qv7s9awbir0jgr-decrypt-age-secrets.drv
nginx.conf> 
nginx.conf> ==================== Results ===================
nginx.conf> No issues found.
nginx.conf> 
nginx.conf> ==================== Summary ===================
nginx.conf> Total issues:
nginx.conf>     Unspecified: 0
nginx.conf>     Low: 0
nginx.conf>     Medium: 0
nginx.conf>     High: 0
nginx.conf> 
decrypt-age-secrets> structuredAttrs is enabled
building '/nix/store/2w98by8rlz62mgmn9qyfg8497r31jgy0-nss-cacert-3.126.drv' on nix-store.geninf.io:50051
nss-cacert-3.126> build-x86-01: building 2w98by8rlz62mgmn9qyfg8497r31jgy0-nss-cacert-3.126.drv
building '/nix/store/0qs47hp0ch98kb77aa3j29ha1fy1vg98-nginx.conf.drv' on nix-store.geninf.io:50051
nginx.conf> build-x86-01: building 0qs47hp0ch98kb77aa3j29ha1fy1vg98-nginx.conf.drv
nginx.conf> structuredAttrs is enabled
building '/nix/store/5swb5mdmnm01rs80c37i5s9by315l2x4-acme-setup-privileged.drv' on nix-store.geninf.io:50051
acme-setup-privileged> gi-build-x86-02: building 5swb5mdmnm01rs80c37i5s9by315l2x4-acme-setup-privileged.drv
nss-cacert-3.126> structuredAttrs is enabled
acme-setup-privileged> structuredAttrs is enabled
nss-cacert-3.126> Running phase: unpackPhase
nss-cacert-3.126> Running phase: patchPhase
nss-cacert-3.126> Running phase: updateAutotoolsGnuConfigScriptsPhase
nss-cacert-3.126> Running phase: configurePhase
nss-cacert-3.126> no configure script, doing nothing
nss-cacert-3.126> Running phase: buildPhase
nginx.conf> 
nginx.conf> ==================== Results ===================
nginx.conf> No issues found.
nginx.conf> 
nginx.conf> ==================== Summary ===================
nginx.conf> Total issues:
nginx.conf>     Unspecified: 0
nginx.conf>     Low: 0
nginx.conf>     Medium: 0
nginx.conf>     High: 0
nginx.conf> 
nss-cacert-3.126> Running phase: installPhase
building '/nix/store/241zqcpbjvm4qpzgnign2givzn5gnrfj-unit-script-acme-test.foo-start.drv' on nix-store.geninf.io:50051
unit-script-acme-test.foo-start> build-x86-01: building 241zqcpbjvm4qpzgnign2givzn5gnrfj-unit-script-acme-test.foo-start.drv
nss-cacert-3.126> Running phase: fixupPhase
unit-script-acme-test.foo-start> structuredAttrs is enabled
nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/m39wdsr1n97fbj8vfs56b2z1hv576rqb-nss-cacert-3.126-p11kit
nss-cacert-3.126> checking for references to /build/ in /nix/store/m39wdsr1n97fbj8vfs56b2z1hv576rqb-nss-cacert-3.126-p11kit...
nss-cacert-3.126> patching script interpreter paths in /nix/store/m39wdsr1n97fbj8vfs56b2z1hv576rqb-nss-cacert-3.126-p11kit
nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/6cxinc3424b17bpdavbq2h17mlxhbfhm-nss-cacert-3.126-hashed
nss-cacert-3.126> checking for references to /build/ in /nix/store/6cxinc3424b17bpdavbq2h17mlxhbfhm-nss-cacert-3.126-hashed...
nss-cacert-3.126> patching script interpreter paths in /nix/store/6cxinc3424b17bpdavbq2h17mlxhbfhm-nss-cacert-3.126-hashed
nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/vprmygss2b0zj7dvwvxrmns8b0d1ikx7-nss-cacert-3.126
nss-cacert-3.126> checking for references to /build/ in /nix/store/vprmygss2b0zj7dvwvxrmns8b0d1ikx7-nss-cacert-3.126...
nss-cacert-3.126> patching script interpreter paths in /nix/store/vprmygss2b0zj7dvwvxrmns8b0d1ikx7-nss-cacert-3.126
nss-cacert-3.126> shrinking RPATHs of ELF executables and libraries in /nix/store/ckx5m2phw2bvv8iyirnp7ab6zvpg4d79-nss-cacert-3.126-unbundled
nss-cacert-3.126> checking for references to /build/ in /nix/store/ckx5m2phw2bvv8iyirnp7ab6zvpg4d79-nss-cacert-3.126-unbundled...
nss-cacert-3.126> patching script interpreter paths in /nix/store/ckx5m2phw2bvv8iyirnp7ab6zvpg4d79-nss-cacert-3.126-unbundled
building '/nix/store/1xi35qd7zdvi39jf9s7f6334y6a1y39a-acme-postrun.drv' on nix-store.geninf.io:50051
acme-postrun> gi-build-x86-02: building 1xi35qd7zdvi39jf9s7f6334y6a1y39a-acme-postrun.drv
acme-postrun> structuredAttrs is enabled
building '/nix/store/4kzs1vgqx43dlllqp3c8ks5rvjvzwzr2-unit-script-acme-order-renew-test.foo-start.drv' on nix-store.geninf.io:50051
unit-script-acme-order-renew-test.foo-start> build-x86-01: building 4kzs1vgqx43dlllqp3c8ks5rvjvzwzr2-unit-script-acme-order-renew-test.foo-start.drv
unit-script-acme-order-renew-test.foo-start> structuredAttrs is enabled
building '/nix/store/4hx2waaf3ss54dhrahfymxrfp6p6jcnz-unit-nginx-config-reload.service.drv' on nix-store.geninf.io:50051
unit-nginx-config-reload.service> gi-build-x86-02: building 4hx2waaf3ss54dhrahfymxrfp6p6jcnz-unit-nginx-config-reload.service.drv
unit-nginx-config-reload.service> structuredAttrs is enabled
building '/nix/store/bc5gipm9431wbp4jg8rl34xjphz065p6-unit-script-acme-order-renew-ca.foo-start.drv' on nix-store.geninf.io:50051
unit-script-acme-order-renew-ca.foo-start> build-x86-01: building bc5gipm9431wbp4jg8rl34xjphz065p6-unit-script-acme-order-renew-ca.foo-start.drv
unit-script-acme-order-renew-ca.foo-start> structuredAttrs is enabled
building '/nix/store/m8pjrq9nxvby17mf4g3zq8wf90lcip44-unit-nginx-config-reload.service.drv' on nix-store.geninf.io:50051
unit-nginx-config-reload.service> gi-build-x86-02: building m8pjrq9nxvby17mf4g3zq8wf90lcip44-unit-nginx-config-reload.service.drv
unit-nginx-config-reload.service> structuredAttrs is enabled
building '/nix/store/hq62i7jg6nvhzbv4bxs1zcvnfhyiy26i-hosts.drv' on nix-store.geninf.io:50051
hosts> build-x86-01: building hq62i7jg6nvhzbv4bxs1zcvnfhyiy26i-hosts.drv
building '/nix/store/75zfpwc85ywkmn852g34zdadlx57m75z-system-shutdown.drv' on nix-store.geninf.io:50051
system-shutdown> gi-build-x86-02: building 75zfpwc85ywkmn852g34zdadlx57m75z-system-shutdown.drv
building '/nix/store/gicgxddkzs9ygh4ga9lc1fynfyfnv4mx-hosts.drv' on nix-store.geninf.io:50051
hosts> gi-build-x86-02: building gicgxddkzs9ygh4ga9lc1fynfyfnv4mx-hosts.drv
building '/nix/store/wg4lq67n04brfzrv7f34s52k5zha3ssv-X-Restart-Triggers-step-ca.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-step-ca> gi-build-x86-02: building wg4lq67n04brfzrv7f34s52k5zha3ssv-X-Restart-Triggers-step-ca.drv
X-Restart-Triggers-step-ca> structuredAttrs is enabled
building '/nix/store/lb9zgcxyamghdh9rc7zcknccmq7qhplh-unit-systemd-networkd.service.drv' on nix-store.geninf.io:50051
unit-systemd-networkd.service> gi-build-x86-02: building lb9zgcxyamghdh9rc7zcknccmq7qhplh-unit-systemd-networkd.service.drv
building '/nix/store/gf02njpqixzkbg3hv2z3hpbir3mvj3h3-hosts.drv' on nix-store.geninf.io:50051
hosts> gi-build-x86-02: building gf02njpqixzkbg3hv2z3hpbir3mvj3h3-hosts.drv
unit-systemd-networkd.service> structuredAttrs is enabled
building '/nix/store/5z6r6kjivhkbn737pf9s0307390c1qgl-unit-script-nginx-pre-start.drv' on nix-store.geninf.io:50051
unit-script-nginx-pre-start> build-x86-01: building 5z6r6kjivhkbn737pf9s0307390c1qgl-unit-script-nginx-pre-start.drv
unit-script-nginx-pre-start> structuredAttrs is enabled
building '/nix/store/k60vzvk5p8f0aayrj658ja600pn7cp5v-unit-acme-ca.foo.service.drv' on nix-store.geninf.io:50051
unit-acme-ca.foo.service> build-x86-01: building k60vzvk5p8f0aayrj658ja600pn7cp5v-unit-acme-ca.foo.service.drv
unit-acme-ca.foo.service> structuredAttrs is enabled
building '/nix/store/x4smvjwqvcfjfxzr0rm9bqd1b66ccaf4-user-generators.drv' on nix-store.geninf.io:50051
user-generators> build-x86-01: building x4smvjwqvcfjfxzr0rm9bqd1b66ccaf4-user-generators.drv
building '/nix/store/q56lz6945vmlpday519bi23abkngp433-unit-script-nginx-pre-start.drv' on nix-store.geninf.io:50051
unit-script-nginx-pre-start> build-x86-01: building q56lz6945vmlpday519bi23abkngp433-unit-script-nginx-pre-start.drv
unit-script-nginx-pre-start> structuredAttrs is enabled
building '/nix/store/2r5v0bb5jx02gawmh3f65zd9w3y4kp1a-X-Restart-Triggers-systemd-tmpfiles-resetup.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-systemd-tmpfiles-resetup> gi-build-x86-02: building 2r5v0bb5jx02gawmh3f65zd9w3y4kp1a-X-Restart-Triggers-systemd-tmpfiles-resetup.drv
X-Restart-Triggers-systemd-tmpfiles-resetup> structuredAttrs is enabled
building '/nix/store/d6lnwyr3y8mz0bk03xfsy07b3zph7x0n-system-path.drv' on nix-store.geninf.io:50051
system-path> build-x86-01: building d6lnwyr3y8mz0bk03xfsy07b3zph7x0n-system-path.drv
system-path> structuredAttrs is enabled
system-path> created 1721 symlinks in user environment
building '/nix/store/h2363gw9knhd04dv1fpfzzar0bm7zi0v-system-path.drv' on nix-store.geninf.io:50051
system-path> build-x86-01: building h2363gw9knhd04dv1fpfzzar0bm7zi0v-system-path.drv
system-path> structuredAttrs is enabled
system-path> created 1721 symlinks in user environment
building '/nix/store/bp90shrw7gi58pkz1qp2k9zcjdi6c7wc-unit-acme-test.foo.service.drv' on nix-store.geninf.io:50051
unit-acme-test.foo.service> gi-build-x86-02: building bp90shrw7gi58pkz1qp2k9zcjdi6c7wc-unit-acme-test.foo.service.drv
unit-acme-test.foo.service> structuredAttrs is enabled
building '/nix/store/gsrl0r7y8c3a4df0h9y9imrygqfs5v4q-unit-acme-setup.service.drv' on nix-store.geninf.io:50051
unit-acme-setup.service> gi-build-x86-02: building gsrl0r7y8c3a4df0h9y9imrygqfs5v4q-unit-acme-setup.service.drv
building '/nix/store/fcghnpbwvjz2sxsd5483pdyfmrmm753l-unit-acme-order-renew-ca.foo.service.drv' on nix-store.geninf.io:50051
unit-acme-order-renew-ca.foo.service> build-x86-01: building fcghnpbwvjz2sxsd5483pdyfmrmm753l-unit-acme-order-renew-ca.foo.service.drv
unit-acme-order-renew-ca.foo.service> structuredAttrs is enabled
unit-acme-setup.service> structuredAttrs is enabled
building '/nix/store/88p7jpb7acnfk13z28v7m7d36vff1vrr-system-path.drv' on nix-store.geninf.io:50051
system-path> build-x86-01: building 88p7jpb7acnfk13z28v7m7d36vff1vrr-system-path.drv
system-path> structuredAttrs is enabled
system-path> created 1721 symlinks in user environment
building '/nix/store/7smmf7x388i18lbykks9xhl24ll3k5wz-unit-acme-setup.service.drv' on nix-store.geninf.io:50051
unit-acme-setup.service> gi-build-x86-02: building 7smmf7x388i18lbykks9xhl24ll3k5wz-unit-acme-setup.service.drv
unit-acme-setup.service> structuredAttrs is enabled
building '/nix/store/n7jrdixqm8rysc2axg390vycd9zwwj10-dry-activate.drv' on nix-store.geninf.io:50051
dry-activate> gi-build-x86-02: building n7jrdixqm8rysc2axg390vycd9zwwj10-dry-activate.drv
building '/nix/store/734cqcl6kqvgqdn03pjhxxds4w94bjb1-unit-acme-order-renew-test.foo.service.drv' on nix-store.geninf.io:50051
unit-acme-order-renew-test.foo.service> build-x86-01: building 734cqcl6kqvgqdn03pjhxxds4w94bjb1-unit-acme-order-renew-test.foo.service.drv
unit-acme-order-renew-test.foo.service> structuredAttrs is enabled
dry-activate> structuredAttrs is enabled
building '/nix/store/4y4037jfxwnz15yxjw1y7dpr9msx4np5-unit-step-ca.service.drv' on nix-store.geninf.io:50051
unit-step-ca.service> gi-build-x86-02: building 4y4037jfxwnz15yxjw1y7dpr9msx4np5-unit-step-ca.service.drv
unit-step-ca.service> structuredAttrs is enabled
building '/nix/store/8kkmy69anci0gifivyxq0biabhbqwl0v-dbus-1.drv' on nix-store.geninf.io:50051
dbus-1> gi-build-x86-02: building 8kkmy69anci0gifivyxq0biabhbqwl0v-dbus-1.drv
building '/nix/store/njb4vgfcg8nagzhkpnx6bv168bkxvhca-unit-systemd-tmpfiles-resetup.service.drv' on nix-store.geninf.io:50051
unit-systemd-tmpfiles-resetup.service> gi-build-x86-02: building njb4vgfcg8nagzhkpnx6bv168bkxvhca-unit-systemd-tmpfiles-resetup.service.drv
building '/nix/store/j5lfqhinxvqf00ihhb7lg4nkr8jlngrr-unit-nginx.service.drv' on nix-store.geninf.io:50051
unit-nginx.service> build-x86-01: building j5lfqhinxvqf00ihhb7lg4nkr8jlngrr-unit-nginx.service.drv
unit-nginx.service> structuredAttrs is enabled
building '/nix/store/bgcfaiw6cix0nibdcga4l3zz9apdsz2j-unit-nginx.service.drv' on nix-store.geninf.io:50051
unit-nginx.service> build-x86-01: building bgcfaiw6cix0nibdcga4l3zz9apdsz2j-unit-nginx.service.drv
unit-nginx.service> structuredAttrs is enabled
unit-systemd-tmpfiles-resetup.service> structuredAttrs is enabled
building '/nix/store/lz51aaagvjf9g30wa0ihq0nyv0k6iqnz-dbus-1.drv' on nix-store.geninf.io:50051
dbus-1> build-x86-01: building lz51aaagvjf9g30wa0ihq0nyv0k6iqnz-dbus-1.drv
building '/nix/store/mbar5cd8gxx63wwwsyixsxx3ksricxs5-unit-nix-daemon.service.drv' on nix-store.geninf.io:50051
unit-nix-daemon.service> gi-build-x86-02: building mbar5cd8gxx63wwwsyixsxx3ksricxs5-unit-nix-daemon.service.drv
unit-nix-daemon.service> structuredAttrs is enabled
building '/nix/store/alvr9g6qxdkqnyq37wvcqbdchn65wqn0-dbus-1.drv' on nix-store.geninf.io:50051
dbus-1> gi-build-x86-02: building alvr9g6qxdkqnyq37wvcqbdchn65wqn0-dbus-1.drv
building '/nix/store/5zqd67b8qr80pnj94zmq38nyrni9cl6z-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-dbus-broker> build-x86-01: building 5zqd67b8qr80pnj94zmq38nyrni9cl6z-X-Restart-Triggers-dbus-broker.drv
X-Restart-Triggers-dbus-broker> structuredAttrs is enabled
building '/nix/store/3xs1v4xqh6q1cb40spjxpfqzkf7qif1h-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-dbus-broker> build-x86-01: building 3xs1v4xqh6q1cb40spjxpfqzkf7qif1h-X-Restart-Triggers-dbus-broker.drv
X-Restart-Triggers-dbus-broker> structuredAttrs is enabled
building '/nix/store/0l8jrpaamgl0ygh495vim5lp15jjyh0h-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051
X-Restart-Triggers-dbus-broker> gi-build-x86-02: building 0l8jrpaamgl0ygh495vim5lp15jjyh0h-X-Restart-Triggers-dbus-broker.drv
X-Restart-Triggers-dbus-broker> structuredAttrs is enabled
building '/nix/store/afi8qpx4zssr2dq3kvbmmdjqihgzm41y-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> gi-build-x86-02: building afi8qpx4zssr2dq3kvbmmdjqihgzm41y-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/jcd8y6hrmjr80gaja3696j9csnyn9zcn-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building jcd8y6hrmjr80gaja3696j9csnyn9zcn-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/swnxsw36zm66hd73ia24mdzzczcndz4p-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building swnxsw36zm66hd73ia24mdzzczcndz4p-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/36liiz1262z9lhf7lb93cqinqrhkaa59-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building 36liiz1262z9lhf7lb93cqinqrhkaa59-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/f6x8655mylkg02bj6w9r2v47h98aq0wc-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> gi-build-x86-02: building f6x8655mylkg02bj6w9r2v47h98aq0wc-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/m119kcwl3x9p9lq85z3w7zzvjra952r3-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051
unit-dbus-broker.service> build-x86-01: building m119kcwl3x9p9lq85z3w7zzvjra952r3-unit-dbus-broker.service.drv
unit-dbus-broker.service> structuredAttrs is enabled
building '/nix/store/agcldshxh7ipiwvgqaw64knwa9f6jwr2-system-units.drv' on nix-store.geninf.io:50051
system-units> build-x86-01: building agcldshxh7ipiwvgqaw64knwa9f6jwr2-system-units.drv
building '/nix/store/hzvnlv0cgzcqn2diydv1kcfi4wnfnx1w-system-units.drv' on nix-store.geninf.io:50051
system-units> build-x86-01: building hzvnlv0cgzcqn2diydv1kcfi4wnfnx1w-system-units.drv
building '/nix/store/kxyzf316669fmplhsj8skdyr12p3q055-user-units.drv' on nix-store.geninf.io:50051
user-units> web01: building kxyzf316669fmplhsj8skdyr12p3q055-user-units.drv
building '/nix/store/k5j19qgicmy2h5srfgpgaaw7qdsrawwb-user-units.drv' on nix-store.geninf.io:50051
user-units> web01: building k5j19qgicmy2h5srfgpgaaw7qdsrawwb-user-units.drv
building '/nix/store/lfs1agl9fgljxa5yy3pv9fyrcq0vx1aa-system-units.drv' on nix-store.geninf.io:50051
system-units> build-x86-01: building lfs1agl9fgljxa5yy3pv9fyrcq0vx1aa-system-units.drv
building '/nix/store/1vm9yrxhicragjv8mwvm00a0lh1v5abp-etc.drv' on nix-store.geninf.io:50051
etc> build-x86-01: building 1vm9yrxhicragjv8mwvm00a0lh1v5abp-etc.drv
building '/nix/store/ajimxx0hp97g1bp8yfaq3jxkh3rc5afv-user-units.drv' on nix-store.geninf.io:50051
user-units> gi-build-x86-02: building ajimxx0hp97g1bp8yfaq3jxkh3rc5afv-user-units.drv
building '/nix/store/r8xm4d946v55c8bvqvxqf8c5ww72ja9k-activate.drv' on nix-store.geninf.io:50051
activate> build-x86-01: building r8xm4d946v55c8bvqvxqf8c5ww72ja9k-activate.drv
activate> structuredAttrs is enabled
building '/nix/store/791p1b241ig71a7r0f1vjfkws59bz5d3-etc.drv' on nix-store.geninf.io:50051
etc> build-x86-01: building 791p1b241ig71a7r0f1vjfkws59bz5d3-etc.drv
building '/nix/store/dkwlgj65n1469iikhywq3q9dqlz0ayci-nixos-system-server-test.drv' on nix-store.geninf.io:50051
nixos-system-server-test> build-x86-01: building dkwlgj65n1469iikhywq3q9dqlz0ayci-nixos-system-server-test.drv
nixos-system-server-test> structuredAttrs is enabled
building '/nix/store/d5zprq9xwjma9w642did8g0wcqzfkha3-activate.drv' on nix-store.geninf.io:50051
activate> build-x86-01: building d5zprq9xwjma9w642did8g0wcqzfkha3-activate.drv
activate> structuredAttrs is enabled
building '/nix/store/6y18ql3rim9jbrygwmwq01jkymk3ikkj-etc.drv' on nix-store.geninf.io:50051
etc> gi-build-x86-02: building 6y18ql3rim9jbrygwmwq01jkymk3ikkj-etc.drv
building '/nix/store/5c371hsnnwikbcrdb3xp3537phn1240h-nixos-system-client-test.drv' on nix-store.geninf.io:50051
nixos-system-client-test> build-x86-01: building 5c371hsnnwikbcrdb3xp3537phn1240h-nixos-system-client-test.drv
nixos-system-client-test> structuredAttrs is enabled
building '/nix/store/plmy3q458idamz4fg9w59q1ki5ggfiph-run-server-nspawn.drv' on nix-store.geninf.io:50051
run-server-nspawn> build-x86-01: building plmy3q458idamz4fg9w59q1ki5ggfiph-run-server-nspawn.drv
building '/nix/store/iqd7013wliy3wr9azchm59h2665dh1rl-activate.drv' on nix-store.geninf.io:50051
activate> gi-build-x86-02: building iqd7013wliy3wr9azchm59h2665dh1rl-activate.drv
activate> structuredAttrs is enabled
building '/nix/store/35y70z6c80rd4w1724ca3iza9qvfs3ma-run-client-nspawn.drv' on nix-store.geninf.io:50051
run-client-nspawn> build-x86-01: building 35y70z6c80rd4w1724ca3iza9qvfs3ma-run-client-nspawn.drv
building '/nix/store/yv1vxwbajhvk804fk4wdl03v65dpw8xh-nixos-system-ca-test.drv' on nix-store.geninf.io:50051
nixos-system-ca-test> build-x86-01: building yv1vxwbajhvk804fk4wdl03v65dpw8xh-nixos-system-ca-test.drv
nixos-system-ca-test> structuredAttrs is enabled
building '/nix/store/2a4swcpcip5xxzkf4cqpxzs350dkf6r4-run-ca-nspawn.drv' on nix-store.geninf.io:50051
run-ca-nspawn> build-x86-01: building 2a4swcpcip5xxzkf4cqpxzs350dkf6r4-run-ca-nspawn.drv
building '/nix/store/491ghzd6cn36r3z35771mzfvdd0fsmr4-driverConfiguration.json.drv' on nix-store.geninf.io:50051
driverConfiguration.json> build-x86-01: building 491ghzd6cn36r3z35771mzfvdd0fsmr4-driverConfiguration.json.drv
driverConfiguration.json> structuredAttrs is enabled
building '/nix/store/khjrpk2grrjly5ra7pirkcqsvjmymczj-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051
nixos-test-driver-certificates> build-x86-01: building khjrpk2grrjly5ra7pirkcqsvjmymczj-nixos-test-driver-certificates.drv
nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck
nixos-test-driver-certificates> All checks passed!
nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint)
nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint
nixos-test-driver-certificates> All checks passed!
building '/nix/store/g018wf0d6691jm94m7cc3bccv6jrwv2z-container-test-run-certificates.drv' on nix-store.geninf.io:50051
container-test-run-certificates> build-x86-01: building g018wf0d6691jm94m7cc3bccv6jrwv2z-container-test-run-certificates.drv
container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state
container-test-run-certificates> start all VLans
container-test-run-certificates> (finished: start all VLans, in 0.00 seconds)
container-test-run-certificates> 
container-test-run-certificates> Test will time out and terminate in 3600.0 seconds
container-test-run-certificates> run the VM test script
container-test-run-certificates> additionally exposed symbols:
container-test-run-certificates>     ca, client, server,
container-test-run-certificates>     vlan1,
container-test-run-certificates>     start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh
container-test-run-certificates> ca: systemd-nspawn running (pid 50)
container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal...
container-test-run-certificates> ca: waiting for unit step-ca.service
container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca.
container-test-run-certificates> ca # [2257247.375322] ca systemd-journald[81]: Journal started
container-test-run-certificates> ca # [2257247.375353] ca systemd-journald[81]: Runtime Journal (/run/log/journal/50665361540e4b428ff168a7ae120bcd) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> ca # [2257247.381706] ca systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> ca # [2257247.388494] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> ca # [2257247.396109] ca systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> ca # [2257247.396502] ca systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> ca # [2257247.396804] ca systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> ca # [2257247.401319] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/50665361540e4b428ff168a7ae120bcd is 1.202ms for 7 entries.
container-test-run-certificates> ca # [2257247.401319] ca systemd-journald[81]: System Journal (/var/log/journal/50665361540e4b428ff168a7ae120bcd) is 8M, max 4G, 3.9G free.
container-test-run-certificates> ca # [2257247.410596] ca systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> ca # [2257247.411223] ca systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> ca # [2257247.411779] ca systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> ca # [2257247.411825] ca systemd[1]: Reached target Local File Systems.
container-test-run-certificates> ca # [2257247.412277] ca systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> ca # [2257247.412303] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [2257247.412731] ca systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> ca # [2257247.413049] ca systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> ca # [2257247.413064] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> ca # [2257247.422979] ca systemd-tmpfiles[143]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> ca # [2257247.423135] ca systemd-tmpfiles[143]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [2257247.423231] ca systemd-tmpfiles[143]: fchmod() of /var/log/journal/50665361540e4b428ff168a7ae120bcd failed: Operation not permitted
container-test-run-certificates> ca # [2257247.423372] ca systemd-tmpfiles[143]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> ca # [2257247.424308] ca systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> ca # [2257247.424897] ca systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> ca # [2257247.425210] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> ca # [2257247.431648] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> ca # [2257247.437344] ca systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> ca # [2257247.437843] ca systemd[1]: Starting Update is Completed...
container-test-run-certificates> ca # [2257247.442780] ca systemd[1]: Finished Update is Completed.
container-test-run-certificates> ca # [2257247.461824] ca systemd[1]: Finished Firewall.
container-test-run-certificates> ca # [2257247.461946] ca systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> ca # [2257247.462085] ca systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> ca # [2257247.462595] ca systemd[1]: Starting Network Management...
container-test-run-certificates> ca # [2257247.502807] ca systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> ca # [2257247.955924] ca systemd-networkd[198]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [2257247.955996] ca systemd-networkd[198]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> ca # [2257247.963440] ca systemd-networkd[198]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [2257247.963581] ca systemd-networkd[198]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> ca # [2257247.963666] ca systemd-networkd[198]: lo: Link UP
container-test-run-certificates> ca # [2257247.963669] ca systemd-networkd[198]: lo: Gained carrier
container-test-run-certificates> ca # [2257247.963797] ca systemd-networkd[198]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> ca # [2257247.964054] ca systemd[1]: Started Network Management.
container-test-run-certificates> ca # [2257247.964094] ca systemd-networkd[198]: eth1: Link UP
container-test-run-certificates> ca # [2257247.964224] ca systemd-networkd[198]: eth1: Gained carrier
container-test-run-certificates> ca # [2257247.964680] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> ca # [2257247.984993] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> ca # [2257248.270039] ca systemd-resolved[120]: Positive Trust Anchors:
container-test-run-certificates> ca # [2257248.270048] ca systemd-resolved[120]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> ca # [2257248.270051] ca systemd-resolved[120]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> ca # [2257248.270067] ca systemd-resolved[120]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> ca # [2257248.280208] ca systemd-resolved[120]: Using system hostname 'ca'.
container-test-run-certificates> ca # [2257248.281054] ca systemd[1]: Started Network Name Resolution.
container-test-run-certificates> ca # [2257248.281107] ca systemd[1]: Reached target Network.
container-test-run-certificates> ca # [2257248.281136] ca systemd[1]: Reached target Network is Online.
container-test-run-certificates> ca # [2257248.281161] ca systemd[1]: Reached target System Initialization.
container-test-run-certificates> ca # [2257248.281292] ca systemd[1]: Started Renew ACME Certificate for ca.foo.
container-test-run-certificates> ca # [2257248.281321] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> ca # [2257248.281334] ca systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> ca # [2257248.281344] ca systemd[1]: Reached target Timer Units.
container-test-run-certificates> ca # [2257248.281418] ca systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> ca # [2257248.281478] ca systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> ca # [2257248.281546] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> ca # [2257248.281555] ca systemd[1]: Reached target Socket Units.
container-test-run-certificates> ca # [2257248.281574] ca systemd[1]: Reached target Basic System.
container-test-run-certificates> ca # [2257248.282325] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> ca # [2257248.282640] ca systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> ca # [2257248.282656] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem
container-test-run-certificates> ca # [2257248.283030] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> ca # [2257248.283443] ca systemd[1]: Starting step-ca service...
container-test-run-certificates> ca # [2257248.284034] ca systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> ca # [2257248.316048] ca systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> ca # [2257248.372464] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> ca # [2257248.396128] ca acme-setup-privileged[204]: + set -euo pipefail
container-test-run-certificates> ca # [2257248.396128] ca acme-setup-privileged[204]: + cd /var/lib/acme
container-test-run-certificates> ca # [2257248.396128] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> ca # [2257248.396984] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts
container-test-run-certificates> ca # [2257248.397820] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [2257248.397820] ca acme-setup-privileged[204]: + '[' -d ca.foo ']'
container-test-run-certificates> ca # [2257248.397867] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo
container-test-run-certificates> ca # [2257248.397867] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']'
container-test-run-certificates> ca # [2257248.419447] ca nsncd[206]: Sep 30 10:17:42.842 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> ca # [2257248.419480] ca systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> ca # [2257248.419525] ca systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> ca # [2257248.419561] ca systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> ca # [2257248.425391] ca systemd[1]: Starting User Login Management...
container-test-run-certificates> ca # [2257248.425717] ca systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> ca # [2257248.431419] ca systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> ca # [2257248.431831] ca systemd[1]: Started Console Getty.
container-test-run-certificates> ca # [2257248.431849] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> ca # [2257248.431860] ca systemd[1]: Reached target Login Prompts.
container-test-run-certificates> ca # [2257248.527362] ca dbus-broker-launch[208]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> ca # [2257248.527817] ca dbus-broker-launch[208]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> ca # [2257248.527817] ca dbus-broker-launch[208]: Invalid user-name in /nix/store/f84a25ppavmhvxvgbfwp8jwas0gi59k9-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> ca # [2257248.528095] ca systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> ca # [2257248.531600] ca dbus-broker-launch[208]: Ready
container-test-run-certificates> ca # [2257248.996800] ca systemd-logind[234]: New seat seat0.
container-test-run-certificates> ca # [2257248.996949] ca systemd[1]: Started User Login Management.
container-test-run-certificates> ca # [2257248.997817] ca systemd[1]: Starting linger-users.service...
container-test-run-certificates> ca # [2257249.020783] ca systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> ca # [2257249.020916] ca systemd[1]: Finished linger-users.service.
container-test-run-certificates> ca # [2257249.053036] ca acme-setup-start[222]: + set -euo pipefail
container-test-run-certificates> ca # [2257249.053036] ca acme-setup-start[222]: + test -e ca/key.pem
container-test-run-certificates> ca # [2257249.053229] ca acme-setup-start[222]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> ca # [2257249.060163] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> ca # [2257249.060914] ca systemd[1]: Starting Ensure certificate for ca.foo...
container-test-run-certificates> ca # [2257249.217068] ca systemd-networkd[198]: eth1: Gained IPv6LL
container-test-run-certificates> ca # [2257249.223871] ca step-ca[207]: badger 2026/09/30 10:17:43 INFO: All 0 tables opened in 0s
container-test-run-certificates> ca # [2257249.225588] ca step-ca[207]: 2026/09/30 10:17:43 Building new tls configuration using step-ca x509 Signer Interface
container-test-run-certificates> ca # [2257249.227483] ca step-ca[207]: 2026/09/30 10:17:43 Starting Smallstep CA/0.30.2 (linux/amd64)
container-test-run-certificates> ca # [2257249.227483] ca step-ca[207]: 2026/09/30 10:17:43 Documentation: https://u.step.sm/docs/ca
container-test-run-certificates> ca # [2257249.227483] ca step-ca[207]: 2026/09/30 10:17:43 Community Discord: https://u.step.sm/discord
container-test-run-certificates> ca # [2257249.227483] ca step-ca[207]: 2026/09/30 10:17:43 Config file: /etc/smallstep/ca.json
container-test-run-certificates> ca # [2257249.227552] ca step-ca[207]: 2026/09/30 10:17:43 The primary server URL is https://ca.foo:1443
container-test-run-certificates> ca # [2257249.227552] ca step-ca[207]: 2026/09/30 10:17:43 Root certificates are available at https://ca.foo:1443/roots.pem
container-test-run-certificates> ca # [2257249.227552] ca step-ca[207]: 2026/09/30 10:17:43 X.509 Root Fingerprint: a6b7094ed9cada697e81c0c71bac4084aeeeedb2924b510c8013be30b218b4ae
container-test-run-certificates> ca # [2257249.227617] ca systemd[1]: Started step-ca service.
container-test-run-certificates> ca # [2257249.227692] ca step-ca[207]: 2026/09/30 10:17:43 Serving HTTPS on 0.0.0.0:1443 ...
container-test-run-certificates> ca # [2257249.685753] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [2257249.687161] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']'
container-test-run-certificates> ca # [2257249.687202] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses=
container-test-run-certificates> ca # [2257249.691478] ca acme-ca.foo-start[285]: + cd ca.foo
container-test-run-certificates> ca # [2257249.691702] ca acme-ca.foo-start[285]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> ca # [2257249.692649] ca acme-ca.foo-start[286]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> ca # [2257249.692827] ca acme-ca.foo-start[285]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> ca # [2257249.693445] ca acme-ca.foo-start[285]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> ca # [2257249.693558] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> ca # [2257249.694531] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> ca # [2257249.695301] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [2257249.696065] ca acme-ca.foo-start[259]: + for fixpath in out certificates
container-test-run-certificates> ca # [2257249.696080] ca acme-ca.foo-start[259]: + '[' -d out ']'
container-test-run-certificates> ca # [2257249.696080] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [2257249.696798] ca acme-ca.foo-start[259]: + chown -R acme:nginx out
container-test-run-certificates> ca # [2257249.698470] ca acme-ca.foo-start[259]: + for fixpath in out certificates
container-test-run-certificates> ca # [2257249.698482] ca acme-ca.foo-start[259]: + '[' -d certificates ']'
container-test-run-certificates> ca # [2257249.700607] ca systemd[1]: Finished Ensure certificate for ca.foo.
container-test-run-certificates> ca # [2257249.701424] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca # [2257250.345297] ca nginx-pre-start[297]: nginx: the configuration file /nix/store/np6rvzd2hf2crp7jf2s2misipfn66lrq-nginx.conf syntax is ok
container-test-run-certificates> ca # [2257250.345512] ca nginx-pre-start[297]: nginx: configuration file /nix/store/np6rvzd2hf2crp7jf2s2misipfn66lrq-nginx.conf test is successful
container-test-run-certificates> ca # [2257250.348698] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> ca # [2257250.348977] ca systemd[1]: Reached target Multi-User System.
container-test-run-certificates> ca # [2257250.349738] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo...
container-test-run-certificates> ca # [2257250.985212] ca acme-order-renew-ca.foo-start[300]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> ca # [2257250.986748] ca acme-order-renew-ca.foo-start[300]: + set -euo pipefail
container-test-run-certificates> ca # [2257250.986778] ca acme-order-renew-ca.foo-start[300]: + exec
container-test-run-certificates> ca # [2257250.986803] ca acme-order-renew-ca.foo-start[300]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11
container-test-run-certificates> ca # [2257250.987531] ca acme-order-renew-ca.foo-start[312]: ++ find accounts -path '*/keys/*.key' -print -quit
container-test-run-certificates> ca # [2257250.988821] ca acme-order-renew-ca.foo-start[300]: + '[' -n '' ']'
container-test-run-certificates> ca # [2257250.988853] ca acme-order-renew-ca.foo-start[300]: + exec
container-test-run-certificates> ca # [2257250.988892] ca acme-order-renew-ca.foo-start[300]: + '[' -e certificates/ca.foo.key ']'
container-test-run-certificates> ca # [2257250.988918] ca acme-order-renew-ca.foo-start[300]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains
container-test-run-certificates> ca # [2257250.998397] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.421716230Z INFO  Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key
container-test-run-certificates> ca # [2257251.009960] ca step-ca[207]: time="2026-09-30T10:17:45Z" level=info duration="116.67µs" duration-ns=116670 fields.time="2026-09-30T10:17:45Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=ef0872ae-e294-4307-8a36-d969238609bd response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257251.010358] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.433482632Z INFO  Registering the account. email=none@none.tld
container-test-run-certificates> ca # [2257251.011357] ca step-ca[207]: time="2026-09-30T10:17:45Z" level=info duration=1.073683ms duration-ns=1073683 fields.time="2026-09-30T10:17:45Z" method=HEAD name=ca nonce=eml5aU5zTExyTmhNaXBJVHhOTWlkbFdNOVNvV1FpMDI path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=c7414a4a-ca8a-46ec-8ab8-211c98cc8144 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257251.012515] ca step-ca[207]: time="2026-09-30T10:17:45Z" level=info duration="854.8µs" duration-ns=854800 fields.time="2026-09-30T10:17:45Z" method=POST name=ca nonce=UG02ZlFOVU1QZlRtbTJyYWlYU3Q2VFJQYUFHSWNKR3k path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=3cd165a9-a766-4a5a-ab91-f9c9a31bffe3 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/0kuVJMZAQofLtVdCyDnuz8wqPWXyiAbm/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257251.012673] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.436002308Z WARN  !!!! HEADS UP !!!!
container-test-run-certificates> ca # [2257251.012673] ca acme-order-renew-ca.foo-start[313]: Your account credentials have been saved in your
container-test-run-certificates> ca # [2257251.012673] ca acme-order-renew-ca.foo-start[313]: configuration directory at "accounts".
container-test-run-certificates> ca # [2257251.012673] ca acme-order-renew-ca.foo-start[313]: You should make a secure backup of this folder now. This
container-test-run-certificates> ca # [2257251.012673] ca acme-order-renew-ca.foo-start[313]: configuration directory will also contain private keys
container-test-run-certificates> ca # [2257251.012673] ca acme-order-renew-ca.foo-start[313]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> ca # [2257251.012673] ca acme-order-renew-ca.foo-start[313]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> ca # [2257251.012779] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.436070146Z INFO  Obtaining bundled SAN certificate. domains=ca.foo
container-test-run-certificates> ca # [2257251.014080] ca step-ca[207]: time="2026-09-30T10:17:45Z" level=info duration=1.172078ms duration-ns=1172078 fields.time="2026-09-30T10:17:45Z" method=POST name=ca nonce=a1NTME9KT0lPbjJaUExKd3VzSUFoYXlramVZS0Z3Ujg path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=a750b097-d0e8-47cf-ad29-bdef9aa28b92 response="{\"id\":\"8z0QXT6G5eTzzp1PFKsn0zwbIHfgTpdk\",\"status\":\"pending\",\"expires\":\"2026-10-01T10:17:45Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-30T10:16:45Z\",\"notAfter\":\"2026-12-29T10:17:45Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/iXwpcKlpKOVu60J1N74SzLEgNw9Oj8ks\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/8z0QXT6G5eTzzp1PFKsn0zwbIHfgTpdk/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257251.071191] ca step-ca[207]: time="2026-09-30T10:17:45Z" level=info duration="588.288µs" duration-ns=588288 fields.time="2026-09-30T10:17:45Z" method=POST name=ca nonce=bFVZb0hWQk5xSVdnR3RMd0h6SnczbXBZZDV0UjVPdXQ path=/acme/acme/authz/iXwpcKlpKOVu60J1N74SzLEgNw9Oj8ks protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=6e9470a3-b2f6-4a03-84c1-cd19bedcef7a response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"8nUA3DIaKdYYPrLKoculE6GwxLiJAeVQ\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/iXwpcKlpKOVu60J1N74SzLEgNw9Oj8ks/rFVI9PD968RSw6HJdlnLhPU7xn5hWeAy\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"8nUA3DIaKdYYPrLKoculE6GwxLiJAeVQ\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/iXwpcKlpKOVu60J1N74SzLEgNw9Oj8ks/8kFklyZFI7xoyLUBzLvt7HWyJkJ4EDRU\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"8nUA3DIaKdYYPrLKoculE6GwxLiJAeVQ\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/iXwpcKlpKOVu60J1N74SzLEgNw9Oj8ks/d0fCp5X1kZ51E2QMY48ESsZHg65mwStQ\"}],\"wildcard\":false,\"expires\":\"2026-10-01T10:17:45Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257251.071318] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.494643209Z INFO  Use solver. domain=ca.foo type=http-01
container-test-run-certificates> ca # [2257251.071318] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.494658207Z INFO  http01: Trying to solve HTTP-01. domain=ca.foo
container-test-run-certificates> ca # [2257251.072976] ca step-ca[207]: time="2026-09-30T10:17:45Z" level=info duration=1.477693ms duration-ns=1477693 fields.time="2026-09-30T10:17:45Z" method=POST name=ca nonce=T1RwUmU0eVFRZ2RWNDlhY1RXN3FiYmh5UTFhSlpvNnM path=/acme/acme/challenge/iXwpcKlpKOVu60J1N74SzLEgNw9Oj8ks/8kFklyZFI7xoyLUBzLvt7HWyJkJ4EDRU protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=8de2993b-fa93-414a-80e5-b9941b356198 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"8nUA3DIaKdYYPrLKoculE6GwxLiJAeVQ\",\"validated\":\"2026-09-30T10:17:45Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/iXwpcKlpKOVu60J1N74SzLEgNw9Oj8ks/8kFklyZFI7xoyLUBzLvt7HWyJkJ4EDRU\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257251.073094] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.496425866Z INFO  The server validated our request. domain=ca.foo
container-test-run-certificates> ca # [2257251.073123] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.496458628Z INFO  Validations succeeded; requesting certificates. domains=ca.foo
container-test-run-certificates> ca # [2257251.075162] ca step-ca[207]: time="2026-09-30T10:17:45Z" level=info duration=1.793468ms duration-ns=1793468 fields.time="2026-09-30T10:17:45Z" method=POST name=ca nonce=TW52YXQ0d0ZuVkJtVUpjYkxUY0UxNjBtam1YUDBVcWE path=/acme/acme/order/8z0QXT6G5eTzzp1PFKsn0zwbIHfgTpdk/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=741375b5-cf49-4b56-a96d-70e9ce4fc06c response="{\"id\":\"8z0QXT6G5eTzzp1PFKsn0zwbIHfgTpdk\",\"status\":\"valid\",\"expires\":\"2026-10-01T10:17:45Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-09-30T10:16:45Z\",\"notAfter\":\"2026-12-29T10:17:45Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/iXwpcKlpKOVu60J1N74SzLEgNw9Oj8ks\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/8z0QXT6G5eTzzp1PFKsn0zwbIHfgTpdk/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/YmQN5Kwf2gmZeWN6SmQbqggRxzWsCK6w\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257251.075795] ca step-ca[207]: time="2026-09-30T10:17:45Z" level=info certificate="MIIB0jCCAXmgAwIBAgIQNpcFprlJBSBPBMJysiV22DAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MzAxMDE2NDVaFw0yNjEyMjkxMDE3NDVaMBExDzANBgNVBAMTBmNhLmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLut+iDNBQDe75ZR++jl2igcoeda7jGRCrG5tOwwONEC2611vRFbEV8d8nYtzIhqckU13CWhF/8LmGe26hOkQUGjgaQwgaEwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUpBYxFhxiTER4ZTZCfDTAW56SPRwwHwYDVR0jBBgwFoAUBTu+iFb6KPHLm1XzKo2FUZFQSeUwEQYDVR0RBAowCIIGY2EuZm9vMB0GDCsGAQQBgqRkxihAAQQNMAsCAQYEBGFjbWUEADAKBggqhkjOPQQDAgNHADBEAiABRzauxeECGHVCMPrhOfJOxE4FZMUXiP/ZKGy0l35FJQIgUCp2PIKw31lSlbDy4BrSluMf4K8w23CRXI7LV2wI+LQ=" duration="438.446µs" duration-ns=438446 fields.time="2026-09-30T10:17:45Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=VWxUcmZtbEt4ZUR2NUJiNGhMamljUjRjbWV4dUxkUkM path=/acme/acme/certificate/YmQN5Kwf2gmZeWN6SmQbqggRxzWsCK6w protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=011c86dd-fd3c-44d5-89a3-fe0677cd5444 sans="map[dns:[ca.foo]]" serial=72562463219290214344548666442946803416 size=1340 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-09-30T10:16:45Z" valid-to="2026-12-29T10:17:45Z"
container-test-run-certificates> ca # [2257251.075860] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.499192587Z INFO  Server responded with a certificate. domains=ca.foo
container-test-run-certificates> ca # [2257251.075878] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.499214068Z INFO  Writing file. filepath=certificates/ca.foo.crt
container-test-run-certificates> ca # [2257251.075909] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.499245247Z INFO  Writing file. filepath=certificates/ca.foo.issuer.crt
container-test-run-certificates> ca # [2257251.075929] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.499265445Z INFO  Writing file. filepath=certificates/ca.foo.key
container-test-run-certificates> ca # [2257251.075964] ca acme-order-renew-ca.foo-start[313]: 2026-09-30T10:17:45.499300420Z INFO  Writing file. filepath=certificates/ca.foo.json
container-test-run-certificates> ca # [2257251.078735] ca acme-order-renew-ca.foo-start[300]: + touch out/acme-success
container-test-run-certificates> ca # [2257251.079819] ca acme-order-renew-ca.foo-start[300]: + cmp -s certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [2257251.080476] ca acme-order-renew-ca.foo-start[300]: + touch out/renewed
container-test-run-certificates> ca # [2257251.081245] ca acme-order-renew-ca.foo-start[300]: + echo Installing new certificate
container-test-run-certificates> ca # [2257251.081245] ca acme-order-renew-ca.foo-start[300]: Installing new certificate
container-test-run-certificates> ca # [2257251.081245] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.crt out/fullchain.pem
container-test-run-certificates> ca # [2257251.082005] ca acme-order-renew-ca.foo-start[333]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> ca # [2257251.082137] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.key out/key.pem
container-test-run-certificates> ca # [2257251.082896] ca acme-order-renew-ca.foo-start[334]: 'certificates/ca.foo.key' -> 'out/key.pem'
container-test-run-certificates> ca # [2257251.083061] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem
container-test-run-certificates> ca # [2257251.084078] ca acme-order-renew-ca.foo-start[335]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> ca # [2257251.084217] ca acme-order-renew-ca.foo-start[300]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> ca # [2257251.085004] ca acme-order-renew-ca.foo-start[300]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> ca # [2257251.085812] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates
container-test-run-certificates> ca # [2257251.085812] ca acme-order-renew-ca.foo-start[300]: + '[' -d out ']'
container-test-run-certificates> ca # [2257251.085851] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> ca # [2257251.086764] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx out
container-test-run-certificates> ca # [2257251.088082] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates
container-test-run-certificates> ca # [2257251.088082] ca acme-order-renew-ca.foo-start[300]: + '[' -d certificates ']'
container-test-run-certificates> ca # [2257251.088101] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> ca # [2257251.088874] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx certificates
container-test-run-certificates> ca # [2257251.090174] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> ca # [2257251.204320] ca systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> ca # [2257251.207449] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully.
container-test-run-certificates> ca # [2257251.207566] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo.
container-test-run-certificates> ca # [2257251.834579] ca nginx[351]: nginx: the configuration file /nix/store/np6rvzd2hf2crp7jf2s2misipfn66lrq-nginx.conf syntax is ok
container-test-run-certificates> ca # [2257251.834866] ca nginx[351]: nginx: configuration file /nix/store/np6rvzd2hf2crp7jf2s2misipfn66lrq-nginx.conf test is successful
container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 5.64 seconds)
container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem'
container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds)
container-test-run-certificates> ca: must succeed: systemctl restart nginx.service
container-test-run-certificates> ca # [2257252.459239] ca systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> ca # [2257252.459427] ca systemd[1]: Startup finished in 5.321s.
container-test-run-certificates> ca # [2257252.530148] ca systemd[1]: Stopping Nginx Web Server...
container-test-run-certificates> ca # [2257252.576294] ca systemd[1]: nginx.service: Deactivated successfully.
container-test-run-certificates> ca # [2257252.576428] ca systemd[1]: Stopped Nginx Web Server.
container-test-run-certificates> ca # [2257252.576444] ca systemd[1]: nginx.service: Consumed 2.436s CPU time over 2.874s wall clock time.
container-test-run-certificates> ca # [2257252.577918] ca systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.68 seconds)
container-test-run-certificates> server: systemd-nspawn running (pid 444)
container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal...
container-test-run-certificates> client: systemd-nspawn running (pid 447)
container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal...
container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem'
container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE
container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container server on /build/vm-state-server.
container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file.
container-test-run-certificates> ░ Spawning container client on /build/vm-state-client.
container-test-run-certificates> ca # [2257253.203586] ca nginx-pre-start[375]: nginx: the configuration file /nix/store/np6rvzd2hf2crp7jf2s2misipfn66lrq-nginx.conf syntax is ok
container-test-run-certificates> ca # [2257253.203862] ca nginx-pre-start[375]: nginx: configuration file /nix/store/np6rvzd2hf2crp7jf2s2misipfn66lrq-nginx.conf test is successful
container-test-run-certificates> ca # [2257253.206546] ca systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [2257253.703726] server systemd-journald[72]: Journal started
container-test-run-certificates> server # [2257253.703757] server systemd-journald[72]: Runtime Journal (/run/log/journal/0c14b48b3826413b87497b586802fce2) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> server # [2257253.708478] server systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> server # [2257253.715179] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> server # [2257253.722715] server systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> server # [2257253.723041] server systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> client # [2257253.704265] client systemd-journald[72]: Journal started
container-test-run-certificates> server # [2257253.723299] server systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> client # [2257253.704297] client systemd-journald[72]: Runtime Journal (/run/log/journal/19d9f54a88c64fd38277ca6d98f53706) is 8M, max 3.7G, 3.7G free.
container-test-run-certificates> server # [2257253.747482] server systemd-journald[72]: Time spent on flushing to /var/log/journal/0c14b48b3826413b87497b586802fce2 is 1.212ms for 7 entries.
container-test-run-certificates> client # [2257253.708096] client systemd[1]: Finished Apply Kernel Variables.
container-test-run-certificates> server # [2257253.747482] server systemd-journald[72]: System Journal (/var/log/journal/0c14b48b3826413b87497b586802fce2) is 8M, max 4G, 3.9G free.
container-test-run-certificates> client # [2257253.714797] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully.
container-test-run-certificates> server # [2257253.758817] server systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> client # [2257253.722323] client systemd[1]: Starting Flush Journal to Persistent Storage...
container-test-run-certificates> server # [2257253.759089] server systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> client # [2257253.722648] client systemd[1]: Starting Network Name Resolution...
container-test-run-certificates> server # [2257253.760226] server systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> client # [2257253.722962] client systemd[1]: Starting Create Static Device Nodes in /dev...
container-test-run-certificates> server # [2257253.760273] server systemd[1]: Reached target Local File Systems.
container-test-run-certificates> client # [2257253.747789] client systemd-journald[72]: Time spent on flushing to /var/log/journal/19d9f54a88c64fd38277ca6d98f53706 is 1.159ms for 7 entries.
container-test-run-certificates> server # [2257253.760702] server systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> client # [2257253.747789] client systemd-journald[72]: System Journal (/var/log/journal/19d9f54a88c64fd38277ca6d98f53706) is 8M, max 4G, 3.9G free.
container-test-run-certificates> server # [2257253.760728] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [2257253.759456] client systemd[1]: Finished Flush Journal to Persistent Storage.
container-test-run-certificates> server # [2257253.761208] server systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> client # [2257253.759603] client systemd[1]: Finished Create Static Device Nodes in /dev.
container-test-run-certificates> server # [2257253.761534] server systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> client # [2257253.760487] client systemd[1]: Reached target Preparation for Local File Systems.
container-test-run-certificates> server # [2257253.761548] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> client # [2257253.760530] client systemd[1]: Reached target Local File Systems.
container-test-run-certificates> server # [2257253.771334] server systemd-tmpfiles[152]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> client # [2257253.760932] client systemd[1]: Listening on Boot Loader Control Service Socket.
container-test-run-certificates> server # [2257253.771536] server systemd-tmpfiles[152]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> client # [2257253.760959] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [2257253.771665] server systemd-tmpfiles[152]: fchmod() of /var/log/journal/0c14b48b3826413b87497b586802fce2 failed: Operation not permitted
container-test-run-certificates> client # [2257253.761343] client systemd[1]: Starting Save Transient machine-id to Disk...
container-test-run-certificates> server # [2257253.771831] server systemd-tmpfiles[152]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> client # [2257253.761625] client systemd[1]: Starting Create System Files and Directories...
container-test-run-certificates> server # [2257253.772788] server systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> client # [2257253.761637] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys
container-test-run-certificates> server # [2257253.773240] server systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> client # [2257253.770476] client systemd-tmpfiles[151]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted
container-test-run-certificates> server # [2257253.773546] server systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> client # [2257253.770617] client systemd-tmpfiles[151]: fchmod() of /var/log/journal failed: Operation not permitted
container-test-run-certificates> server # [2257253.779273] server systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> client # [2257253.770715] client systemd-tmpfiles[151]: fchmod() of /var/log/journal/19d9f54a88c64fd38277ca6d98f53706 failed: Operation not permitted
container-test-run-certificates> server # [2257253.786670] server systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> client # [2257253.770857] client systemd-tmpfiles[151]: fchmod() of /run/log/journal failed: Operation not permitted
container-test-run-certificates> server # [2257253.786850] server systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> client # [2257253.771536] client systemd[1]: Finished Create System Files and Directories.
container-test-run-certificates> server # [2257253.788238] server systemd[1]: Starting Update is Completed...
container-test-run-certificates> client # [2257253.771983] client systemd[1]: Starting Rebuild Journal Catalog...
container-test-run-certificates> server # [2257253.791854] server systemd[1]: Finished Firewall.
container-test-run-certificates> client # [2257253.772305] client systemd[1]: Starting Record System Boot/Shutdown in UTMP...
container-test-run-certificates> server # [2257253.791926] server systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> client # [2257253.777837] client systemd[1]: Finished Record System Boot/Shutdown in UTMP.
container-test-run-certificates> server # [2257253.792099] server systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> client # [2257253.783515] client systemd[1]: Finished Rebuild Journal Catalog.
container-test-run-certificates> server # [2257253.792729] server systemd[1]: Starting Network Management...
container-test-run-certificates> client # [2257253.783969] client systemd[1]: Starting Update is Completed...
container-test-run-certificates> server # [2257253.794355] server systemd[1]: Finished Update is Completed.
container-test-run-certificates> client # [2257253.786028] client systemd[1]: Finished Save Transient machine-id to Disk.
container-test-run-certificates> client # [2257253.787309] client systemd[1]: Finished Firewall.
container-test-run-certificates> client # [2257253.787394] client systemd[1]: Reached target Preparation for Network.
container-test-run-certificates> client # [2257253.787522] client systemd[1]: Listening on Network Management Resolve Hook Socket.
container-test-run-certificates> client # [2257253.787919] client systemd[1]: Starting Network Management...
container-test-run-certificates> client # [2257253.788655] client systemd[1]: Finished Update is Completed.
container-test-run-certificates> client # [2257254.271505] client systemd-networkd[185]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [2257254.271573] client systemd-networkd[185]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> client # [2257254.278482] client systemd-networkd[185]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [2257254.278621] client systemd-networkd[185]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> client # [2257254.278688] client systemd-networkd[185]: lo: Link UP
container-test-run-certificates> client # [2257254.278691] client systemd-networkd[185]: lo: Gained carrier
container-test-run-certificates> client # [2257254.278822] client systemd-networkd[185]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> client # [2257254.279061] client systemd[1]: Started Network Management.
container-test-run-certificates> client # [2257254.299128] client systemd-networkd[185]: eth1: Link UP
container-test-run-certificates> client # [2257254.299173] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> client # [2257254.299254] client systemd-networkd[185]: eth1: Gained carrier
container-test-run-certificates> client # [2257254.307248] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> server # [2257254.265856] server systemd-networkd[189]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [2257254.265931] server systemd-networkd[189]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted
container-test-run-certificates> server # [2257254.273397] server systemd-networkd[189]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [2257254.273537] server systemd-networkd[189]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section.
container-test-run-certificates> server # [2257254.273611] server systemd-networkd[189]: lo: Link UP
container-test-run-certificates> server # [2257254.273614] server systemd-networkd[189]: lo: Gained carrier
container-test-run-certificates> server # [2257254.273755] server systemd-networkd[189]: eth1: Configuring with /etc/systemd/network/40-eth1.network.
container-test-run-certificates> server # [2257254.273972] server systemd[1]: Started Network Management.
container-test-run-certificates> server # [2257254.274026] server systemd-networkd[189]: eth1: Link UP
container-test-run-certificates> server # [2257254.274144] server systemd-networkd[189]: eth1: Gained carrier
container-test-run-certificates> server # [2257254.274569] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd...
container-test-run-certificates> server # [2257254.303230] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd.
container-test-run-certificates> client # [2257254.643000] client systemd-resolved[106]: Positive Trust Anchors:
container-test-run-certificates> client # [2257254.643008] client systemd-resolved[106]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> client # [2257254.643015] client systemd-resolved[106]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> client # [2257254.643030] client systemd-resolved[106]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> client # [2257254.653048] client systemd-resolved[106]: Using system hostname 'client'.
container-test-run-certificates> client # [2257254.653918] client systemd[1]: Started Network Name Resolution.
container-test-run-certificates> client # [2257254.653969] client systemd[1]: Reached target Network.
container-test-run-certificates> client # [2257254.654008] client systemd[1]: Reached target System Initialization.
container-test-run-certificates> client # [2257254.654040] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> client # [2257254.654055] client systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> client # [2257254.654063] client systemd[1]: Reached target Timer Units.
container-test-run-certificates> client # [2257254.654145] client systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> client # [2257254.654210] client systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> client # [2257254.654279] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> client # [2257254.654288] client systemd[1]: Reached target Socket Units.
container-test-run-certificates> client # [2257254.654306] client systemd[1]: Reached target Basic System.
container-test-run-certificates> client # [2257254.654914] client systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> client # [2257254.655288] client systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> client # [2257254.655824] client systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> client # [2257254.686453] client systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> client # [2257254.705035] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> client # [2257254.791349] client nsncd[192]: Sep 30 10:17:49.214 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> client # [2257254.791368] client systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> client # [2257254.791391] client systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> client # [2257254.791415] client systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> client # [2257254.797154] client systemd[1]: Starting User Login Management...
container-test-run-certificates> client # [2257254.797536] client systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> client # [2257254.802548] client systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> client # [2257254.802951] client systemd[1]: Started Console Getty.
container-test-run-certificates> client # [2257254.802971] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> client # [2257254.802981] client systemd[1]: Reached target Login Prompts.
container-test-run-certificates> client # [2257254.905932] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> client # [2257254.906310] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> client # [2257254.906310] client dbus-broker-launch[193]: Invalid user-name in /nix/store/bm7cvm6hb370vbhx8a18pnm3vybahzdj-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> server # [2257254.647775] server systemd-resolved[106]: Positive Trust Anchors:
container-test-run-certificates> server # [2257254.647783] server systemd-resolved[106]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
container-test-run-certificates> server # [2257254.647785] server systemd-resolved[106]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16
container-test-run-certificates> server # [2257254.647804] server systemd-resolved[106]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test
container-test-run-certificates> server # [2257254.658062] server systemd-resolved[106]: Using system hostname 'server'.
container-test-run-certificates> server # [2257254.658902] server systemd[1]: Started Network Name Resolution.
container-test-run-certificates> server # [2257254.658962] server systemd[1]: Reached target Network.
container-test-run-certificates> server # [2257254.658999] server systemd[1]: Reached target Network is Online.
container-test-run-certificates> server # [2257254.659038] server systemd[1]: Reached target System Initialization.
container-test-run-certificates> server # [2257254.659192] server systemd[1]: Started Renew ACME Certificate for test.foo.
container-test-run-certificates> server # [2257254.659216] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container
container-test-run-certificates> server # [2257254.659230] server systemd[1]: Started Daily Cleanup of Temporary Directories.
container-test-run-certificates> server # [2257254.659243] server systemd[1]: Reached target Timer Units.
container-test-run-certificates> server # [2257254.659342] server systemd[1]: Listening on D-Bus System Message Bus Socket.
container-test-run-certificates> server # [2257254.659418] server systemd[1]: Listening on Nix Daemon Socket.
container-test-run-certificates> server # [2257254.659501] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket.
container-test-run-certificates> server # [2257254.659516] server systemd[1]: Reached target Socket Units.
container-test-run-certificates> server # [2257254.659542] server systemd[1]: Reached target Basic System.
container-test-run-certificates> server # [2257254.678539] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure...
container-test-run-certificates> server # [2257254.678928] server systemd[1]: Starting Import lastlog data into lastlog2 database...
container-test-run-certificates> server # [2257254.678948] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem
container-test-run-certificates> server # [2257254.679363] server systemd[1]: Starting Name Service Cache Daemon (nsncd)...
container-test-run-certificates> server # [2257254.680051] server systemd[1]: Starting D-Bus System Message Bus...
container-test-run-certificates> server # [2257254.688601] server systemd[1]: Finished Import lastlog data into lastlog2 database.
container-test-run-certificates> server # [2257254.704788] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully.
container-test-run-certificates> server # [2257254.768425] server acme-setup-privileged[195]: + set -euo pipefail
container-test-run-certificates> server # [2257254.768425] server acme-setup-privileged[195]: + cd /var/lib/acme
container-test-run-certificates> server # [2257254.768623] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts
container-test-run-certificates> server # [2257254.769207] server acme-setup-privileged[195]: + chown -R acme .lego/accounts
container-test-run-certificates> server # [2257254.769998] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [2257254.770021] server acme-setup-privileged[195]: + '[' -d test.foo ']'
container-test-run-certificates> server # [2257254.770021] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo
container-test-run-certificates> server # [2257254.770021] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']'
container-test-run-certificates> server # [2257254.791345] server nsncd[197]: Sep 30 10:17:49.214 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket"
container-test-run-certificates> server # [2257254.791376] server systemd[1]: Started Name Service Cache Daemon (nsncd).
container-test-run-certificates> server # [2257254.791416] server systemd[1]: Reached target Host and Network Name Lookups.
container-test-run-certificates> server # [2257254.791448] server systemd[1]: Reached target User and Group Name Lookups.
container-test-run-certificates> server # [2257254.797191] server systemd[1]: Starting User Login Management...
container-test-run-certificates> server # [2257254.797590] server systemd[1]: Starting Permit User Sessions...
container-test-run-certificates> server # [2257254.802546] server systemd[1]: Finished Permit User Sessions.
container-test-run-certificates> server # [2257254.802953] server systemd[1]: Started Console Getty.
container-test-run-certificates> server # [2257254.802971] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0
container-test-run-certificates> server # [2257254.802981] server systemd[1]: Reached target Login Prompts.
container-test-run-certificates> server # [2257254.908257] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'...
container-test-run-certificates> server # [2257254.908612] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync'
container-test-run-certificates> server # [2257254.908612] server dbus-broker-launch[198]: Invalid user-name in /nix/store/2hrd1hxpb53fbkpi6jyn7vgp8g0z1hmi-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync"
container-test-run-certificates> server # [2257254.908809] server systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> server # [2257254.912172] server dbus-broker-launch[198]: Ready
container-test-run-certificates> client # [2257254.906546] client systemd[1]: Started D-Bus System Message Bus.
container-test-run-certificates> client # [2257254.909930] client dbus-broker-launch[193]: Ready
container-test-run-certificates> client # [2257255.365465] client systemd-logind[208]: New seat seat0.
container-test-run-certificates> server # [2257255.360835] server systemd-logind[222]: New seat seat0.
container-test-run-certificates> client # [2257255.365614] client systemd[1]: Started User Login Management.
container-test-run-certificates> server # [2257255.360929] server systemd[1]: Started User Login Management.
container-test-run-certificates> client # [2257255.381171] client systemd[1]: Starting linger-users.service...
container-test-run-certificates> server # [2257255.361677] server systemd[1]: Starting linger-users.service...
container-test-run-certificates> client # [2257255.387429] client systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> server # [2257255.386012] server systemd[1]: linger-users.service: Deactivated successfully.
container-test-run-certificates> client # [2257255.387478] client systemd[1]: Finished linger-users.service.
container-test-run-certificates> server # [2257255.386138] server systemd[1]: Finished linger-users.service.
container-test-run-certificates> client # [2257255.388133] client systemd[1]: Reached target Multi-User System.
container-test-run-certificates> client # [2257255.388222] client systemd[1]: Startup finished in 1.922s.
container-test-run-certificates> server # [2257255.424516] server acme-setup-start[210]: + set -euo pipefail
container-test-run-certificates> server # [2257255.424516] server acme-setup-start[210]: + test -e ca/key.pem
container-test-run-certificates> server # [2257255.424726] server acme-setup-start[210]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local
container-test-run-certificates> server # [2257255.431457] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure.
container-test-run-certificates> server # [2257255.432197] server systemd[1]: Starting Ensure certificate for test.foo...
container-test-run-certificates> server # [2257255.553090] server systemd-networkd[189]: eth1: Gained IPv6LL
container-test-run-certificates> server # [2257256.054447] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [2257256.056141] server acme-test.foo-start[248]: + '[' -e out/acme-success ']'
container-test-run-certificates> server # [2257256.056141] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses=
container-test-run-certificates> server # [2257256.060618] server acme-test.foo-start[258]: + cd test.foo
container-test-run-certificates> server # [2257256.060820] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem
container-test-run-certificates> server # [2257256.061494] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem'
container-test-run-certificates> server # [2257256.061631] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem
container-test-run-certificates> server # [2257256.062310] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem'
container-test-run-certificates> server # [2257256.062453] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem
container-test-run-certificates> server # [2257256.063274] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem
container-test-run-certificates> server # [2257256.064082] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [2257256.064926] server acme-test.foo-start[248]: + for fixpath in out certificates
container-test-run-certificates> server # [2257256.064947] server acme-test.foo-start[248]: + '[' -d out ']'
container-test-run-certificates> server # [2257256.064947] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [2257256.065742] server acme-test.foo-start[248]: + chown -R acme:nginx out
container-test-run-certificates> server # [2257256.067206] server acme-test.foo-start[248]: + for fixpath in out certificates
container-test-run-certificates> server # [2257256.067216] server acme-test.foo-start[248]: + '[' -d certificates ']'
container-test-run-certificates> server # [2257256.069209] server systemd[1]: Finished Ensure certificate for test.foo.
container-test-run-certificates> server # [2257256.070024] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> client # [2257256.128118] client systemd-networkd[185]: eth1: Gained IPv6LL
container-test-run-certificates> server # [2257256.791263] server nginx-pre-start[270]: nginx: the configuration file /nix/store/wgcw2kfadpsawk465kcbcrhx7g7w6wna-nginx.conf syntax is ok
container-test-run-certificates> server # [2257256.791623] server nginx-pre-start[270]: nginx: configuration file /nix/store/wgcw2kfadpsawk465kcbcrhx7g7w6wna-nginx.conf test is successful
container-test-run-certificates> server # [2257256.794676] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> server # [2257256.794961] server systemd[1]: Reached target Multi-User System.
container-test-run-certificates> server # [2257256.795638] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo...
container-test-run-certificates> server # [2257257.473949] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/
container-test-run-certificates> server # [2257257.475557] server acme-order-renew-test.foo-start[273]: + set -euo pipefail
container-test-run-certificates> server # [2257257.475596] server acme-order-renew-test.foo-start[273]: + exec
container-test-run-certificates> server # [2257257.475620] server acme-order-renew-test.foo-start[273]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11
container-test-run-certificates> server # [2257257.476217] server acme-order-renew-test.foo-start[284]: ++ find accounts -path '*/keys/*.key' -print -quit
container-test-run-certificates> server # [2257257.477517] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']'
container-test-run-certificates> server # [2257257.477536] server acme-order-renew-test.foo-start[273]: + exec
container-test-run-certificates> server # [2257257.477568] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']'
container-test-run-certificates> server # [2257257.477588] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains
container-test-run-certificates> server # [2257257.487166] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:51.910486274Z INFO  Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key
container-test-run-certificates> server # [2257257.501021] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:51.924335108Z INFO  Registering the account. email=none@none.tld
container-test-run-certificates> server # [2257257.546797] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:51.970117961Z WARN  !!!! HEADS UP !!!!
container-test-run-certificates> server # [2257257.546797] server acme-order-renew-test.foo-start[285]: Your account credentials have been saved in your
container-test-run-certificates> server # [2257257.546797] server acme-order-renew-test.foo-start[285]: configuration directory at "accounts".
container-test-run-certificates> server # [2257257.546797] server acme-order-renew-test.foo-start[285]: You should make a secure backup of this folder now. This
container-test-run-certificates> server # [2257257.546797] server acme-order-renew-test.foo-start[285]: configuration directory will also contain private keys
container-test-run-certificates> server # [2257257.546797] server acme-order-renew-test.foo-start[285]: generated by lego and certificates obtained from the ACME
container-test-run-certificates> server # [2257257.546797] server acme-order-renew-test.foo-start[285]: server. Making regular backups of this folder is ideal.
container-test-run-certificates> server # [2257257.546933] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:51.970198342Z INFO  Obtaining bundled SAN certificate. domains=test.foo
container-test-run-certificates> server # [2257257.607635] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:52.030949257Z INFO  Use solver. domain=test.foo type=http-01
container-test-run-certificates> server # [2257257.607635] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:52.030971839Z INFO  http01: Trying to solve HTTP-01. domain=test.foo
container-test-run-certificates> server # [2257257.610010] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:52.033334239Z INFO  The server validated our request. domain=test.foo
container-test-run-certificates> server # [2257257.610047] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:52.033381909Z INFO  Validations succeeded; requesting certificates. domains=test.foo
container-test-run-certificates> server # [2257257.614104] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:52.037431807Z INFO  Server responded with a certificate. domains=test.foo
container-test-run-certificates> server # [2257257.614145] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:52.037470369Z INFO  Writing file. filepath=certificates/test.foo.crt
container-test-run-certificates> server # [2257257.614201] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:52.037534380Z INFO  Writing file. filepath=certificates/test.foo.issuer.crt
container-test-run-certificates> server # [2257257.614231] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:52.037565849Z INFO  Writing file. filepath=certificates/test.foo.key
container-test-run-certificates> server # [2257257.614298] server acme-order-renew-test.foo-start[285]: 2026-09-30T10:17:52.037632084Z INFO  Writing file. filepath=certificates/test.foo.json
container-test-run-certificates> server # [2257257.616882] server acme-order-renew-test.foo-start[273]: + touch out/acme-success
container-test-run-certificates> server # [2257257.617752] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [2257257.618333] server acme-order-renew-test.foo-start[273]: + touch out/renewed
container-test-run-certificates> server # [2257257.619077] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate
container-test-run-certificates> server # [2257257.619077] server acme-order-renew-test.foo-start[273]: Installing new certificate
container-test-run-certificates> server # [2257257.619077] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem
container-test-run-certificates> server # [2257257.619763] server acme-order-renew-test.foo-start[305]: 'certificates/test.foo.crt' -> 'out/fullchain.pem'
container-test-run-certificates> server # [2257257.619899] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem
container-test-run-certificates> server # [2257257.620570] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.key' -> 'out/key.pem'
container-test-run-certificates> server # [2257257.620700] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem
container-test-run-certificates> server # [2257257.621372] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem'
container-test-run-certificates> server # [2257257.621487] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem
container-test-run-certificates> server # [2257257.622258] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem
container-test-run-certificates> server # [2257257.623048] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates
container-test-run-certificates> server # [2257257.623048] server acme-order-renew-test.foo-start[273]: + '[' -d out ']'
container-test-run-certificates> server # [2257257.623081] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out
container-test-run-certificates> server # [2257257.623785] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out
container-test-run-certificates> server # [2257257.625227] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates
container-test-run-certificates> server # [2257257.625227] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']'
container-test-run-certificates> server # [2257257.625257] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates
container-test-run-certificates> server # [2257257.626022] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates
container-test-run-certificates> server # [2257257.627468] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/.
container-test-run-certificates> server # [2257257.733751] server systemd[1]: Reloading Nginx Web Server...
container-test-run-certificates> ca # [2257257.500784] ca step-ca[207]: time="2026-09-30T10:17:51Z" level=info duration="39.825µs" duration-ns=39825 fields.time="2026-09-30T10:17:51Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=1aacf475-e7db-4333-a7cc-32b12cf0d7d7 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257257.544438] ca step-ca[207]: time="2026-09-30T10:17:51Z" level=info duration=42.614515ms duration-ns=42614515 fields.time="2026-09-30T10:17:51Z" method=HEAD name=ca nonce=cVAwTXZWanZlN3dpNkYzNjFKN3g1RDhDU2lQNzZYRWQ path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=0d80c5d3-706c-4f54-8c9d-0a7c91616545 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257257.546567] ca step-ca[207]: time="2026-09-30T10:17:51Z" level=info duration="764.05µs" duration-ns=764050 fields.time="2026-09-30T10:17:51Z" method=POST name=ca nonce=eHpCb1dNS1FTRzhPYWM4b0E2clJpTUl1QVNVazVUd1E path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=e12646d1-3fcb-4064-8537-73790e125650 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/YFKgl4cz931DOJH74KgXt1ArwhzFOQ7r/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257257.548921] ca step-ca[207]: time="2026-09-30T10:17:51Z" level=info duration=1.318133ms duration-ns=1318133 fields.time="2026-09-30T10:17:51Z" method=POST name=ca nonce=M0g3aFRBamtCVWI2dDFSTWRzMFQyVlczVElyZjRCWTE path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=d1b0ed78-317e-4abf-8a11-f807b2700714 response="{\"id\":\"Hv9dlune5jWvPJiEwxJrlPOjtlbWR32H\",\"status\":\"pending\",\"expires\":\"2026-10-01T10:17:51Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-30T10:16:51Z\",\"notAfter\":\"2026-12-29T10:17:51Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/SAZaAgQAV0cNVpRwTBj10se86f0Z6p8l\"],\"finalize\":\"https://ca.foo/acme/acme/order/Hv9dlune5jWvPJiEwxJrlPOjtlbWR32H/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257257.607305] ca step-ca[207]: time="2026-09-30T10:17:52Z" level=info duration="691.261µs" duration-ns=691261 fields.time="2026-09-30T10:17:52Z" method=POST name=ca nonce=aldldnAxdmZ2clluSjhyNmEyOVZiTFZCQnJtMGlKZGk path=/acme/acme/authz/SAZaAgQAV0cNVpRwTBj10se86f0Z6p8l protocol=HTTP/1.1 referer= remote-address="::1" request-id=453d90f4-9b51-4492-9edc-96b974cbff27 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"4r4BrOzYSDeL95EGj1AkGkW1e5h9Gcux\",\"url\":\"https://ca.foo/acme/acme/challenge/SAZaAgQAV0cNVpRwTBj10se86f0Z6p8l/ZThcovLJyvWoTGa1r0PTs4yalCEC7ssu\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"4r4BrOzYSDeL95EGj1AkGkW1e5h9Gcux\",\"url\":\"https://ca.foo/acme/acme/challenge/SAZaAgQAV0cNVpRwTBj10se86f0Z6p8l/stIPF3gMgr6PIzwvwt9KkeyBLZQMSATl\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"4r4BrOzYSDeL95EGj1AkGkW1e5h9Gcux\",\"url\":\"https://ca.foo/acme/acme/challenge/SAZaAgQAV0cNVpRwTBj10se86f0Z6p8l/E2lq9VkYow3fRgHgB9RuNQaqoqqcUBg2\"}],\"wildcard\":false,\"expires\":\"2026-10-01T10:17:51Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257257.609844] ca step-ca[207]: time="2026-09-30T10:17:52Z" level=info duration=1.43864ms duration-ns=1438640 fields.time="2026-09-30T10:17:52Z" method=POST name=ca nonce=MEpGMDE0d2FuYUJYU1drQ1VDcTVzUnE2blQzYU8wTnc path=/acme/acme/challenge/SAZaAgQAV0cNVpRwTBj10se86f0Z6p8l/stIPF3gMgr6PIzwvwt9KkeyBLZQMSATl protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=698c37e2-d7f0-44dc-b0c0-dca353c65d7e response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"4r4BrOzYSDeL95EGj1AkGkW1e5h9Gcux\",\"validated\":\"2026-09-30T10:17:52Z\",\"url\":\"https://ca.foo/acme/acme/challenge/SAZaAgQAV0cNVpRwTBj10se86f0Z6p8l/stIPF3gMgr6PIzwvwt9KkeyBLZQMSATl\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257257.612731] ca step-ca[207]: time="2026-09-30T10:17:52Z" level=info duration=1.856466ms duration-ns=1856466 fields.time="2026-09-30T10:17:52Z" method=POST name=ca nonce=NUYybjZ3YnRwWWxxZU9kUXdEQ25KemJ0NFlyUkN1aHQ path=/acme/acme/order/Hv9dlune5jWvPJiEwxJrlPOjtlbWR32H/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=223c81d8-5ee9-4559-b0ca-19521da07cc3 response="{\"id\":\"Hv9dlune5jWvPJiEwxJrlPOjtlbWR32H\",\"status\":\"valid\",\"expires\":\"2026-10-01T10:17:51Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-09-30T10:16:51Z\",\"notAfter\":\"2026-12-29T10:17:51Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/SAZaAgQAV0cNVpRwTBj10se86f0Z6p8l\"],\"finalize\":\"https://ca.foo/acme/acme/order/Hv9dlune5jWvPJiEwxJrlPOjtlbWR32H/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/1a1JnuYfQGM9EJgPqcakpInCZpSqHYPe\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id=
container-test-run-certificates> ca # [2257257.613934] ca step-ca[207]: time="2026-09-30T10:17:52Z" level=info certificate="MIIB2DCCAX2gAwIBAgIQVOH7Jfghc6iFRAn9Kc38GjAKBggqhkjOPQQDAjAfMR0wGwYDVQQDExRDbGFuIEludGVybWVkaWF0ZSBDQTAeFw0yNjA5MzAxMDE2NTFaFw0yNjEyMjkxMDE3NTFaMBMxETAPBgNVBAMTCHRlc3QuZm9vMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2BSF3zEwhZaZwaJP7yguKosQ06wn05/ALelStrQ3/Wcdno6IuOrfe+JKW1RWloUIGZ3IyyFgvdluriV0qbM81aOBpjCBozAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQjbOzbohJ++LeaZscUcdZTcqBQLzAfBgNVHSMEGDAWgBQFO76IVvoo8cubVfMqjYVRkVBJ5TATBgNVHREEDDAKggh0ZXN0LmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSQAwRgIhAOfUh+tDXh+DwtX3cOWZNxhrlnf1cIG8fDWO9dsN5WUuAiEAqlrEL66o5Lsw3xjHs19On15rs9MDqp9GjYJ7wxBzSrc=" duration="400.204µs" duration-ns=400204 fields.time="2026-09-30T10:17:52Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=ZnhlOXFmQWpSMnRXNVF1Z2U0cktaSVhOdHBVb2s0U1c path=/acme/acme/certificate/1a1JnuYfQGM9EJgPqcakpInCZpSqHYPe protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=229ab75d-3d92-4a53-b18f-57130ad8ac76 sans="map[dns:[test.foo]]" serial=112828512332148522305938261946131151898 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-09-30T10:16:51Z" valid-to="2026-12-29T10:17:51Z"
container-test-run-certificates> server # [2257257.736030] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully.
container-test-run-certificates> server # [2257257.736153] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo.
container-test-run-certificates> server # [2257258.351820] server nginx[323]: nginx: the configuration file /nix/store/wgcw2kfadpsawk465kcbcrhx7g7w6wna-nginx.conf syntax is ok
container-test-run-certificates> server # [2257258.352082] server nginx[323]: nginx: configuration file /nix/store/wgcw2kfadpsawk465kcbcrhx7g7w6wna-nginx.conf test is successful
container-test-run-certificates> server # [2257258.967052] server systemd[1]: Reloaded Nginx Web Server.
container-test-run-certificates> server # [2257258.967329] server systemd[1]: Startup finished in 5.501s.
container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 6.14 seconds)
container-test-run-certificates> server: must succeed: systemctl restart nginx.service
container-test-run-certificates> server # [2257259.353153] server systemd[1]: Stopping Nginx Web Server...
container-test-run-certificates> server # [2257259.385789] server systemd[1]: nginx.service: Deactivated successfully.
container-test-run-certificates> server # [2257259.385928] server systemd[1]: Stopped Nginx Web Server.
container-test-run-certificates> server # [2257259.385954] server systemd[1]: nginx.service: Consumed 3.805s CPU time over 3.315s wall clock time.
container-test-run-certificates> server # [2257259.387453] server systemd[1]: Starting Nginx Web Server...
container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.67 seconds)
container-test-run-certificates> client: waiting for success: curl -v https://test.foo
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 47902 failed: Connection refused
container-test-run-certificates> *   Trying 192.168.1.3:443...
container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 44702 failed: Connection refused
container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server
container-test-run-certificates> * closing connection #0
container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server
container-test-run-certificates> server # [2257260.016517] server nginx-pre-start[346]: nginx: the configuration file /nix/store/wgcw2kfadpsawk465kcbcrhx7g7w6wna-nginx.conf syntax is ok
container-test-run-certificates> server # [2257260.016772] server nginx-pre-start[346]: nginx: configuration file /nix/store/wgcw2kfadpsawk465kcbcrhx7g7w6wna-nginx.conf test is successful
container-test-run-certificates> server # [2257260.019586] server systemd[1]: Started Nginx Web Server.
container-test-run-certificates> * Host test.foo:443 was resolved.
container-test-run-certificates> * IPv6: 2001:db8:1::3
container-test-run-certificates> * IPv4: 192.168.1.3
container-test-run-certificates> *   Trying [2001:db8:1::3]:443...
container-test-run-certificates> * ALPN: curl offers h2,http/1.1
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
container-test-run-certificates> } [1554 bytes data]
container-test-run-certificates> * SSL Trust Anchors:
container-test-run-certificates> *   OpenSSL default paths (fallback)
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2):
container-test-run-certificates> { [1210 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> { [1 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
container-test-run-certificates> { [19 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11):
container-test-run-certificates> { [932 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
container-test-run-certificates> { [80 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20):
container-test-run-certificates> { [52 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
container-test-run-certificates> } [1 bytes data]
container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20):
container-test-run-certificates> } [52 bytes data]
container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
container-test-run-certificates> * ALPN: server accepted h2
container-test-run-certificates> * Server certificate:
container-test-run-certificates> *   subject: CN=test.foo
container-test-run-certificates> *   start date: Sep 30 10:16:51 2026 GMT
container-test-run-certificates> *   expire date: Dec 29 10:17:51 2026 GMT
container-test-run-certificates> *   issuer: CN=Clan Intermediate CA
container-test-run-certificates> *   Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
container-test-run-certificates> *   subjectAltName: "test.foo" matches cert's "test.foo"
container-test-run-certificates> * OpenSSL verify result: 0
container-test-run-certificates> * SSL certificate verified via OpenSSL.
container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 47908 
container-test-run-certificates>   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
container-test-run-certificates>                                  Dload  Upload  Total   Spent   Left   Speed
container-test-run-certificates>   0      0   0      0   0      0      0      0                              0* using HTTP/2
container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/
container-test-run-certificates> * [HTTP/2] [1] [:method: GET]
container-test-run-certificates> * [HTTP/2] [1] [:scheme: https]
container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo]
container-test-run-certificates> * [HTTP/2] [1] [:path: /]
container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0]
container-test-run-certificates> * [HTTP/2] [1] [accept: */*]
container-test-run-certificates> } [5 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> * Request completely sent off
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
container-test-run-certificates> { [265 bytes data]
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> 
container-test-run-certificates> { [5 bytes data]
container-test-run-certificates> 100     20 100     20   0      0   1846      0                              0
container-test-run-certificates> * Connection #0 to host test.foo:443 left intact
container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.03 seconds)
container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2
container-test-run-certificates> Certificate:
container-test-run-certificates>     Data:
container-test-run-certificates>         Version: 3 (0x2)
container-test-run-certificates>         Serial Number:
container-test-run-certificates>             54:e1:fb:25:f8:21:73:a8:85:44:09:fd:29:cd:fc:1a
container-test-run-certificates>         Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>         Issuer: CN=Clan Intermediate CA
container-test-run-certificates>         Validity
container-test-run-certificates>             Not Before: Sep 30 10:16:51 2026 GMT
container-test-run-certificates>             Not After : Dec 29 10:17:51 2026 GMT
container-test-run-certificates>         Subject: CN=test.foo
container-test-run-certificates>         Subject Public Key Info:
container-test-run-certificates>             Public Key Algorithm: id-ecPublicKey
container-test-run-certificates>                 Public-Key: (256 bit)
container-test-run-certificates>                 pub:
container-test-run-certificates>                     04:d8:14:85:df:31:30:85:96:99:c1:a2:4f:ef:28:
container-test-run-certificates>                     2e:2a:8b:10:d3:ac:27:d3:9f:c0:2d:e9:52:b6:b4:
container-test-run-certificates>                     37:fd:67:1d:9e:8e:88:b8:ea:df:7b:e2:4a:5b:54:
container-test-run-certificates>                     56:96:85:08:19:9d:c8:cb:21:60:bd:d9:6e:ae:25:
container-test-run-certificates>                     74:a9:b3:3c:d5
container-test-run-certificates>                 ASN1 OID: prime256v1
container-test-run-certificates>                 NIST CURVE: P-256
container-test-run-certificates>         X509v3 extensions:
container-test-run-certificates>             X509v3 Key Usage: critical
container-test-run-certificates>                 Digital Signature
container-test-run-certificates>             X509v3 Extended Key Usage: 
container-test-run-certificates>                 TLS Web Server Authentication, TLS Web Client Authentication
container-test-run-certificates>             X509v3 Subject Key Identifier: 
container-test-run-certificates>                 23:6C:EC:DB:A2:12:7E:F8:B7:9A:66:C7:14:71:D6:53:72:A0:50:2F
container-test-run-certificates>             X509v3 Authority Key Identifier: 
container-test-run-certificates>                 05:3B:BE:88:56:FA:28:F1:CB:9B:55:F3:2A:8D:85:51:91:50:49:E5
container-test-run-certificates>             X509v3 Subject Alternative Name: 
container-test-run-certificates>                 DNS:test.foo
container-test-run-certificates>             1.3.6.1.4.1.37476.9000.64.1: 
container-test-run-certificates>                 0......acme..
container-test-run-certificates>     Signature Algorithm: ecdsa-with-SHA256
container-test-run-certificates>     Signature Value:
container-test-run-certificates>         30:46:02:21:00:e7:d4:87:eb:43:5e:1f:83:c2:d5:f7:70:e5:
container-test-run-certificates>         99:37:18:6b:96:77:f5:70:81:bc:7c:35:8e:f5:db:0d:e5:65:
container-test-run-certificates>         2e:02:21:00:aa:5a:c4:2f:ae:a8:e4:bb:30:df:18:c7:b3:5f:
container-test-run-certificates>         4e:9f:5e:6b:b3:d3:03:aa:9f:46:8d:82:7b:c3:10:73:4a:b7
container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo </dev/null 2>/dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds)
container-test-run-certificates> (finished: run the VM test script, in 14.19 seconds)
container-test-run-certificates> test script finished in 14.48s
container-test-run-certificates> cleanup
container-test-run-certificates> kill NspawnMachine (pid 50)
container-test-run-certificates> kill NspawnMachine (pid 447)
container-test-run-certificates> Container ca terminated by signal KILL.
container-test-run-certificates> kill NspawnMachine (pid 444)
container-test-run-certificates> Container client terminated by signal KILL.
container-test-run-certificates> Container server terminated by signal KILL.
container-test-run-certificates> (finished: cleanup, in 0.24 seconds)