don't know how to build these paths: /nix/store/7rb3j0cp5hgmj1p8fjzx9y7ayphnnvya-container-test-run-certificates.drv warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/agk9k3irbcyky3yd991abyz1nxg09gfa-system-path.drv' on nix-store.geninf.io:50051 system-path> build-x86-01: building agk9k3irbcyky3yd991abyz1nxg09gfa-system-path.drv system-path> structuredAttrs is enabled system-path> created 1721 symlinks in user environment building '/nix/store/rfrr54yd7ckxrliy8irmp9bxz2vqxj1q-system-path.drv' on nix-store.geninf.io:50051 system-path> build-x86-01: building rfrr54yd7ckxrliy8irmp9bxz2vqxj1q-system-path.drv building '/nix/store/ppsa9ia0n9fj2vk91m4ybscns5zs7ww3-system-path.drv' on nix-store.geninf.io:50051 system-path> gi-build-x86-02: building ppsa9ia0n9fj2vk91m4ybscns5zs7ww3-system-path.drv system-path> structuredAttrs is enabled system-path> created 1721 symlinks in user environment system-path> structuredAttrs is enabled system-path> created 1721 symlinks in user environment building '/nix/store/h94nrpqjgvxqs77paiy1ir9l2yv25l8q-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build-x86-01: building h94nrpqjgvxqs77paiy1ir9l2yv25l8q-dbus-1.drv building '/nix/store/nb9fa30fad7dr3r4jf6577h0lqlkgym6-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> build-x86-01: building nb9fa30fad7dr3r4jf6577h0lqlkgym6-dbus-1.drv building '/nix/store/r8c2ijl0042cavjx3l3cbqapg28cs9fc-dbus-1.drv' on nix-store.geninf.io:50051 dbus-1> gi-build-x86-02: building r8c2ijl0042cavjx3l3cbqapg28cs9fc-dbus-1.drv building '/nix/store/cxfsqczgbya3fgwlda7yza2w1l5phkp7-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build-x86-01: building cxfsqczgbya3fgwlda7yza2w1l5phkp7-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/5g022bj84wd1sjzhrjy2zq6dv8y92sy8-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> build-x86-01: building 5g022bj84wd1sjzhrjy2zq6dv8y92sy8-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/kbxrvhcglbfkalvkh371p16r5h9m5vng-X-Restart-Triggers-dbus-broker.drv' on nix-store.geninf.io:50051 X-Restart-Triggers-dbus-broker> gi-build-x86-02: building kbxrvhcglbfkalvkh371p16r5h9m5vng-X-Restart-Triggers-dbus-broker.drv X-Restart-Triggers-dbus-broker> structuredAttrs is enabled building '/nix/store/2qlj8z33kiv4k9ca5js1kx95n6nkkz05-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building 2qlj8z33kiv4k9ca5js1kx95n6nkkz05-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/xrnhryy5mnq72zm1skvsv1l0wbsj30ny-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building xrnhryy5mnq72zm1skvsv1l0wbsj30ny-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/5k3bfanrdi3z3yvw7k0mx68v90gmkvp6-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building 5k3bfanrdi3z3yvw7k0mx68v90gmkvp6-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/199fllbi5iwy69q7kkqvvgrrw45pk9pj-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> build-x86-01: building 199fllbi5iwy69q7kkqvvgrrw45pk9pj-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/scan1cmg5pf19i5iggjlwb2yfj1rvvdb-user-units.drv' on nix-store.geninf.io:50051 user-units> build-x86-01: building scan1cmg5pf19i5iggjlwb2yfj1rvvdb-user-units.drv building '/nix/store/bwf22xd9mkcvcrcdfxx143z4wyyndcbd-user-units.drv' on nix-store.geninf.io:50051 user-units> build-x86-01: building bwf22xd9mkcvcrcdfxx143z4wyyndcbd-user-units.drv building '/nix/store/1rj8x60c5iri1zfvp8nyg5gmbha8zizp-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> gi-build-x86-02: building 1rj8x60c5iri1zfvp8nyg5gmbha8zizp-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/axlb60fxc7mmww89aby29nydkb5vkfzc-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building axlb60fxc7mmww89aby29nydkb5vkfzc-system-units.drv building '/nix/store/b9h6j8x6xhna0h2m67c1mshx10qk4x5k-unit-dbus-broker.service.drv' on nix-store.geninf.io:50051 unit-dbus-broker.service> gi-build-x86-02: building b9h6j8x6xhna0h2m67c1mshx10qk4x5k-unit-dbus-broker.service.drv unit-dbus-broker.service> structuredAttrs is enabled building '/nix/store/2b1snwss11vry9hhi7c82npvd5d841g1-system-units.drv' on nix-store.geninf.io:50051 system-units> build-x86-01: building 2b1snwss11vry9hhi7c82npvd5d841g1-system-units.drv building '/nix/store/ri119vgj0dlaijhk684b1kbvkwxpxydv-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building ri119vgj0dlaijhk684b1kbvkwxpxydv-etc.drv building '/nix/store/93iy36gl1rcxwvpx4azhjgjca7lnsv79-user-units.drv' on nix-store.geninf.io:50051 user-units> gi-build-x86-02: building 93iy36gl1rcxwvpx4azhjgjca7lnsv79-user-units.drv building '/nix/store/jljvah2zwx2p37i7bg9whixbiqh7738b-etc.drv' on nix-store.geninf.io:50051 etc> build-x86-01: building jljvah2zwx2p37i7bg9whixbiqh7738b-etc.drv building '/nix/store/3m37qngd9y269l73nm3gsm6pmzmx1b3g-system-units.drv' on nix-store.geninf.io:50051 system-units> gi-build-x86-02: building 3m37qngd9y269l73nm3gsm6pmzmx1b3g-system-units.drv building '/nix/store/mshb21bqk0br0w5lxj3i5irqs7j2pmlp-activate.drv' on nix-store.geninf.io:50051 activate> build-x86-01: building mshb21bqk0br0w5lxj3i5irqs7j2pmlp-activate.drv activate> structuredAttrs is enabled building '/nix/store/n5rjsc97xzm6pwml2kz30x5k0j2jmymg-activate.drv' on nix-store.geninf.io:50051 activate> gi-build-x86-02: building n5rjsc97xzm6pwml2kz30x5k0j2jmymg-activate.drv activate> structuredAttrs is enabled building '/nix/store/yh43986626rfawmxnj1zlim6ilmci1ll-etc.drv' on nix-store.geninf.io:50051 etc> gi-build-x86-02: building yh43986626rfawmxnj1zlim6ilmci1ll-etc.drv building '/nix/store/7h8hrl7gbm19rmdmagrckawp30dwm78p-nixos-system-ca-test.drv' on nix-store.geninf.io:50051 nixos-system-ca-test> gi-build-x86-01: building 7h8hrl7gbm19rmdmagrckawp30dwm78p-nixos-system-ca-test.drv nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/vjxp5754b9jb13d480wzyvlvphnfghpv-nixos-system-client-test.drv' on nix-store.geninf.io:50051 nixos-system-client-test> build-x86-01: building vjxp5754b9jb13d480wzyvlvphnfghpv-nixos-system-client-test.drv nixos-system-client-test> structuredAttrs is enabled building '/nix/store/s2zv46jskdkkg8956xls7sn909s12504-activate.drv' on nix-store.geninf.io:50051 activate> gi-build-x86-02: building s2zv46jskdkkg8956xls7sn909s12504-activate.drv building '/nix/store/9i4bic6blwj65ynsn9jfg23zd6qp0z2x-run-ca-nspawn.drv' on nix-store.geninf.io:50051 run-ca-nspawn> gi-build-x86-01: building 9i4bic6blwj65ynsn9jfg23zd6qp0z2x-run-ca-nspawn.drv activate> structuredAttrs is enabled building '/nix/store/vq93s4vlcdch46g8vxzdiikpbaxg1a1c-run-client-nspawn.drv' on nix-store.geninf.io:50051 run-client-nspawn> build-x86-01: building vq93s4vlcdch46g8vxzdiikpbaxg1a1c-run-client-nspawn.drv building '/nix/store/r89s7nvky9b9ilqyhzfgq7s83xbhjg5j-nixos-system-server-test.drv' on nix-store.geninf.io:50051 nixos-system-server-test> gi-build-x86-02: building r89s7nvky9b9ilqyhzfgq7s83xbhjg5j-nixos-system-server-test.drv nixos-system-server-test> structuredAttrs is enabled building '/nix/store/g4hgh4p0f2pbzihw608yh26kkynyfnwg-run-server-nspawn.drv' on nix-store.geninf.io:50051 run-server-nspawn> gi-build-x86-02: building g4hgh4p0f2pbzihw608yh26kkynyfnwg-run-server-nspawn.drv building '/nix/store/205ncg47m0w8jvz6ngf1mwi55ljzxaa2-driverConfiguration.json.drv' on nix-store.geninf.io:50051 driverConfiguration.json> gi-build-x86-02: building 205ncg47m0w8jvz6ngf1mwi55ljzxaa2-driverConfiguration.json.drv driverConfiguration.json> structuredAttrs is enabled building '/nix/store/cb77g1pshk24p151hz5lhx1ma15ql0k2-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051 nixos-test-driver-certificates> gi-build-x86-02: building cb77g1pshk24p151hz5lhx1ma15ql0k2-nixos-test-driver-certificates.drv nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/7rb3j0cp5hgmj1p8fjzx9y7ayphnnvya-container-test-run-certificates.drv' on nix-store.geninf.io:50051 container-test-run-certificates> build-x86-01: building 7rb3j0cp5hgmj1p8fjzx9y7ayphnnvya-container-test-run-certificates.drv container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # [2706434.320048] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [2706434.320079] ca systemd-journald[81]: Runtime Journal (/run/log/journal/47ef9e6206034b368257cd31ff5f334c) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> ca # [2706434.325937] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [2706434.333782] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [2706434.341520] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [2706434.341874] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [2706434.342167] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [2706434.364074] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/47ef9e6206034b368257cd31ff5f334c is 1.090ms for 7 entries. container-test-run-certificates> ca # [2706434.364074] ca systemd-journald[81]: System Journal (/var/log/journal/47ef9e6206034b368257cd31ff5f334c) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [2706434.372356] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [2706434.372551] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [2706434.373358] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [2706434.373428] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [2706434.373880] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [2706434.373911] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [2706434.374359] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [2706434.374687] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [2706434.374703] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [2706434.395576] ca systemd-tmpfiles[156]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [2706434.395721] ca systemd-tmpfiles[156]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [2706434.395817] ca systemd-tmpfiles[156]: fchmod() of /var/log/journal/47ef9e6206034b368257cd31ff5f334c failed: Operation not permitted container-test-run-certificates> ca # [2706434.395955] ca systemd-tmpfiles[156]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [2706434.396785] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [2706434.397221] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [2706434.397551] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [2706434.404460] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [2706434.407233] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [2706434.407310] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [2706434.407428] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [2706434.407837] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [2706434.408609] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [2706434.409026] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [2706434.414304] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [2706434.873701] ca systemd-networkd[195]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [2706434.873769] ca systemd-networkd[195]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [2706434.880983] ca systemd-networkd[195]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [2706434.881133] ca systemd-networkd[195]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [2706434.881196] ca systemd-networkd[195]: lo: Link UP container-test-run-certificates> ca # [2706434.881197] ca systemd-networkd[195]: lo: Gained carrier container-test-run-certificates> ca # [2706434.881341] ca systemd-networkd[195]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [2706434.881555] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [2706434.881587] ca systemd-networkd[195]: eth1: Link UP container-test-run-certificates> ca # [2706434.881698] ca systemd-networkd[195]: eth1: Gained carrier container-test-run-certificates> ca # [2706434.882117] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [2706434.899081] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [2706434.903029] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [2706435.259369] ca systemd-resolved[118]: Positive Trust Anchors: container-test-run-certificates> ca # [2706435.259376] ca systemd-resolved[118]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [2706435.259379] ca systemd-resolved[118]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [2706435.259395] ca systemd-resolved[118]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [2706435.269551] ca systemd-resolved[118]: Using system hostname 'ca'. container-test-run-certificates> ca # [2706435.270396] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [2706435.270447] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [2706435.270477] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [2706435.270503] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [2706435.270628] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [2706435.270642] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [2706435.270654] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [2706435.270663] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [2706435.270736] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [2706435.270790] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [2706435.270856] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [2706435.270874] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [2706435.270894] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [2706435.271599] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [2706435.271920] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [2706435.271937] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [2706435.272323] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [2706435.272724] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [2706435.273313] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [2706435.299583] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [2706435.318266] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [2706435.387304] ca acme-setup-privileged[204]: + set -euo pipefail container-test-run-certificates> ca # [2706435.387304] ca acme-setup-privileged[204]: + cd /var/lib/acme container-test-run-certificates> ca # [2706435.387475] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [2706435.388074] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [2706435.388883] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [2706435.388896] ca acme-setup-privileged[204]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [2706435.388896] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [2706435.388919] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [2706435.410525] ca nsncd[206]: Oct 05 15:04:09.833 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [2706435.410538] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [2706435.410569] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [2706435.410598] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [2706435.412375] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [2706435.412699] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [2706435.418366] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [2706435.419291] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [2706435.419309] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [2706435.419319] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [2706435.519608] ca dbus-broker-launch[208]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [2706435.520059] ca dbus-broker-launch[208]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [2706435.520059] ca dbus-broker-launch[208]: Invalid user-name in /nix/store/hn7gf5byqcdahj580sz3hhr2r6yk34qr-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [2706435.520294] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [2706435.523817] ca dbus-broker-launch[208]: Ready container-test-run-certificates> ca # [2706435.973917] ca systemd-logind[234]: New seat seat0. container-test-run-certificates> ca # [2706435.974007] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [2706435.974765] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [2706436.002818] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [2706436.002971] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [2706436.025768] ca acme-setup-start[221]: + set -euo pipefail container-test-run-certificates> ca # [2706436.025950] ca acme-setup-start[221]: + test -e ca/key.pem container-test-run-certificates> ca # [2706436.025950] ca acme-setup-start[221]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [2706436.032884] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [2706436.033763] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [2706436.218642] ca step-ca[207]: badger 2026/10/05 15:04:10 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [2706436.220849] ca step-ca[207]: 2026/10/05 15:04:10 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [2706436.222954] ca step-ca[207]: 2026/10/05 15:04:10 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [2706436.222954] ca step-ca[207]: 2026/10/05 15:04:10 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [2706436.222954] ca step-ca[207]: 2026/10/05 15:04:10 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [2706436.222954] ca step-ca[207]: 2026/10/05 15:04:10 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [2706436.222954] ca step-ca[207]: 2026/10/05 15:04:10 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [2706436.222954] ca step-ca[207]: 2026/10/05 15:04:10 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [2706436.222954] ca step-ca[207]: 2026/10/05 15:04:10 X.509 Root Fingerprint: a6b7094ed9cada697e81c0c71bac4084aeeeedb2924b510c8013be30b218b4ae container-test-run-certificates> ca # [2706436.223267] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [2706436.223569] ca step-ca[207]: 2026/10/05 15:04:10 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [2706436.481088] ca systemd-networkd[195]: eth1: Gained IPv6LL container-test-run-certificates> ca # [2706436.658234] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [2706436.660162] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [2706436.660162] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [2706436.664622] ca acme-ca.foo-start[285]: + cd ca.foo container-test-run-certificates> ca # [2706436.664805] ca acme-ca.foo-start[285]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [2706436.665569] ca acme-ca.foo-start[286]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [2706436.665716] ca acme-ca.foo-start[285]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [2706436.666369] ca acme-ca.foo-start[285]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [2706436.666493] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [2706436.667570] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [2706436.668490] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [2706436.669398] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [2706436.669398] ca acme-ca.foo-start[259]: + '[' -d out ']' container-test-run-certificates> ca # [2706436.669441] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [2706436.670285] ca acme-ca.foo-start[259]: + chown -R acme:nginx out container-test-run-certificates> ca # [2706436.671795] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [2706436.671812] ca acme-ca.foo-start[259]: + '[' -d certificates ']' container-test-run-certificates> ca # [2706436.674542] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [2706436.675354] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [2706437.314991] ca nginx-pre-start[297]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [2706437.315280] ca nginx-pre-start[297]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca # [2706437.318223] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [2706437.318457] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [2706437.318991] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [2706437.957176] ca acme-order-renew-ca.foo-start[300]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [2706437.958794] ca acme-order-renew-ca.foo-start[300]: + set -euo pipefail container-test-run-certificates> ca # [2706437.958834] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [2706437.958854] ca acme-order-renew-ca.foo-start[300]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [2706437.959676] ca acme-order-renew-ca.foo-start[312]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [2706437.960991] ca acme-order-renew-ca.foo-start[300]: + '[' -n '' ']' container-test-run-certificates> ca # [2706437.961016] ca acme-order-renew-ca.foo-start[300]: + exec container-test-run-certificates> ca # [2706437.961048] ca acme-order-renew-ca.foo-start[300]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [2706437.961067] ca acme-order-renew-ca.foo-start[300]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [2706437.971390] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.394710624Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [2706437.983898] ca step-ca[207]: time="2026-10-05T15:04:12Z" level=info duration="189.106µs" duration-ns=189106 fields.time="2026-10-05T15:04:12Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=96d04eb9-ce08-457e-b057-8950cfbfefa3 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706437.984165] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.407389164Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [2706438.031434] ca step-ca[207]: time="2026-10-05T15:04:12Z" level=info duration=47.271575ms duration-ns=47271575 fields.time="2026-10-05T15:04:12Z" method=HEAD name=ca nonce=UXJsNWU5bUxqT3dNeDF0a2VzNXRUQUs5RjRZdmtzSm0 path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f7778769-0afa-4ee2-8e7c-f4ef89f69b1a size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706438.037644] ca step-ca[207]: time="2026-10-05T15:04:12Z" level=info duration=5.839909ms duration-ns=5839909 fields.time="2026-10-05T15:04:12Z" method=POST name=ca nonce=RGt3OW1ZVFZjN2JFVDRHeUw2U09icWNOV2hmUll0S3I path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=9d5710f9-6a9b-4b91-96d5-9c06fc7d5b80 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/DDnp891idkXLhUhVE6e2Y7KL5aQijFM9/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706438.037899] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.461221456Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [2706438.037899] ca acme-order-renew-ca.foo-start[313]: Your account credentials have been saved in your container-test-run-certificates> ca # [2706438.037899] ca acme-order-renew-ca.foo-start[313]: configuration directory at "accounts". container-test-run-certificates> ca # [2706438.037899] ca acme-order-renew-ca.foo-start[313]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [2706438.037899] ca acme-order-renew-ca.foo-start[313]: configuration directory will also contain private keys container-test-run-certificates> ca # [2706438.037899] ca acme-order-renew-ca.foo-start[313]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [2706438.037899] ca acme-order-renew-ca.foo-start[313]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [2706438.038017] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.461288362Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [2706438.040111] ca step-ca[207]: time="2026-10-05T15:04:12Z" level=info duration=1.918513ms duration-ns=1918513 fields.time="2026-10-05T15:04:12Z" method=POST name=ca nonce=dGVKZ3JrTnZPM3RpNHQzZk5kYkh1d0lkc1lhbXprTng path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=7c104ef8-8275-4f01-b8e5-731f94d2681d response="{\"id\":\"UwRu0fMQrcLpliOh8laxlSpJsa5hMqAV\",\"status\":\"pending\",\"expires\":\"2026-10-06T15:04:12Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-05T15:03:12Z\",\"notAfter\":\"2027-01-03T15:04:12Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/V9mLJMBBh2q5Z2OSiFR9pNvXdz6vxxwx\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/UwRu0fMQrcLpliOh8laxlSpJsa5hMqAV/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706438.102537] ca step-ca[207]: time="2026-10-05T15:04:12Z" level=info duration=6.009479ms duration-ns=6009479 fields.time="2026-10-05T15:04:12Z" method=POST name=ca nonce=VmVMck40d0Z5UW03bkFIOVZKb2plNlVFSnp3V0wzY1Q path=/acme/acme/authz/V9mLJMBBh2q5Z2OSiFR9pNvXdz6vxxwx protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=c486d81d-0166-4ea9-8ad8-144f6fd057c0 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"ODcgMZSraINdFA49cB0Ga2JPf2MvTVqU\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/V9mLJMBBh2q5Z2OSiFR9pNvXdz6vxxwx/qKcoOFIEg4CC8OkoMWETOcbBmQqjI3mB\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"ODcgMZSraINdFA49cB0Ga2JPf2MvTVqU\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/V9mLJMBBh2q5Z2OSiFR9pNvXdz6vxxwx/ljhzrCVStAbPIqZGzCBS6nYGoocR9Wlg\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"ODcgMZSraINdFA49cB0Ga2JPf2MvTVqU\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/V9mLJMBBh2q5Z2OSiFR9pNvXdz6vxxwx/2W4FK2w0lo7h8DcOSmqnAvhrRqGTpBWj\"}],\"wildcard\":false,\"expires\":\"2026-10-06T15:04:12Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706438.102634] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.525963948Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [2706438.102634] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.525972735Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [2706438.104950] ca step-ca[207]: time="2026-10-05T15:04:12Z" level=info duration=2.121395ms duration-ns=2121395 fields.time="2026-10-05T15:04:12Z" method=POST name=ca nonce=YlNsN28wNERNaU9peWhaT01kYVZ3Wk1hbEY5dGJsT1I path=/acme/acme/challenge/V9mLJMBBh2q5Z2OSiFR9pNvXdz6vxxwx/ljhzrCVStAbPIqZGzCBS6nYGoocR9Wlg protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=c1b3e651-ab0a-4e30-9aeb-a71e2d7a2dca response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"ODcgMZSraINdFA49cB0Ga2JPf2MvTVqU\",\"validated\":\"2026-10-05T15:04:12Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/V9mLJMBBh2q5Z2OSiFR9pNvXdz6vxxwx/ljhzrCVStAbPIqZGzCBS6nYGoocR9Wlg\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706438.105151] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.528477522Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [2706438.105208] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.528542194Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [2706438.108147] ca step-ca[207]: time="2026-10-05T15:04:12Z" level=info duration=2.585961ms duration-ns=2585961 fields.time="2026-10-05T15:04:12Z" method=POST name=ca nonce=Y3NVaUpXSzk1ZWVnNlF1akhKbTFBYThkbTRuWU5PemQ path=/acme/acme/order/UwRu0fMQrcLpliOh8laxlSpJsa5hMqAV/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=0cb3f605-6a0e-4700-b972-fc577e0cac5b response="{\"id\":\"UwRu0fMQrcLpliOh8laxlSpJsa5hMqAV\",\"status\":\"valid\",\"expires\":\"2026-10-06T15:04:12Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-05T15:03:12Z\",\"notAfter\":\"2027-01-03T15:04:12Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/V9mLJMBBh2q5Z2OSiFR9pNvXdz6vxxwx\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/UwRu0fMQrcLpliOh8laxlSpJsa5hMqAV/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/VreCu36g46gk6CTGUBvkRATxy4FzE035\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706438.108938] ca step-ca[207]: time="2026-10-05T15:04:12Z" level=info certificate=MIIB0zCCAXqgAwIBAgIRANHK7oGoErhOJp9RauMTL9IwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDA1MTUwMzEyWhcNMjcwMTAzMTUwNDEyWjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATar53D0WAw7gF9GD3tzPnht+8xpVn+fKv3KQLcWOeougUdqy4dPtMQubJoILPTmFHR7hw1CtCpT8rnPvalpu0/o4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFDLqUu8WPrfKVHQ7jMnCDU5rwvH/MB8GA1UdIwQYMBaAFAU7vohW+ijxy5tV8yqNhVGRUEnlMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDRwAwRAIgeZNafe9xiuRZyqI2DJ5oEXPbqH67jsvgfkofjsVCzwMCIDmrnsnvTy+11FZ4mcJGkCoalEU66YkTyB07inQbv52z duration="566.096µs" duration-ns=566096 fields.time="2026-10-05T15:04:12Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=S0dmalM0TUNGZVA0WmVrZFc0b3h2T1pxUFp5YnBBWlE path=/acme/acme/certificate/VreCu36g46gk6CTGUBvkRATxy4FzE035 protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=83c901d2-ce9d-4537-9558-999568a7f3a7 sans="map[dns:[ca.foo]]" serial=278862332570406198727320238119298740178 size=1340 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-05T15:03:12Z" valid-to="2027-01-03T15:04:12Z" container-test-run-certificates> ca # [2706438.109024] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.532350427Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [2706438.109077] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.532377638Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [2706438.109094] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.532427462Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [2706438.109117] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.532447810Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [2706438.109149] ca acme-order-renew-ca.foo-start[313]: 2026-10-05T15:04:12.532482696Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [2706438.112590] ca acme-order-renew-ca.foo-start[300]: + touch out/acme-success container-test-run-certificates> ca # [2706438.113440] ca acme-order-renew-ca.foo-start[300]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [2706438.114010] ca acme-order-renew-ca.foo-start[300]: + touch out/renewed container-test-run-certificates> ca # [2706438.114708] ca acme-order-renew-ca.foo-start[300]: + echo Installing new certificate container-test-run-certificates> ca # [2706438.114708] ca acme-order-renew-ca.foo-start[300]: Installing new certificate container-test-run-certificates> ca # [2706438.114734] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [2706438.115455] ca acme-order-renew-ca.foo-start[333]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [2706438.115574] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [2706438.116275] ca acme-order-renew-ca.foo-start[334]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [2706438.116383] ca acme-order-renew-ca.foo-start[300]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [2706438.117038] ca acme-order-renew-ca.foo-start[335]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [2706438.117146] ca acme-order-renew-ca.foo-start[300]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [2706438.117947] ca acme-order-renew-ca.foo-start[300]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [2706438.118840] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [2706438.118853] ca acme-order-renew-ca.foo-start[300]: + '[' -d out ']' container-test-run-certificates> ca # [2706438.118853] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [2706438.119614] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx out container-test-run-certificates> ca # [2706438.121140] ca acme-order-renew-ca.foo-start[300]: + for fixpath in out certificates container-test-run-certificates> ca # [2706438.121151] ca acme-order-renew-ca.foo-start[300]: + '[' -d certificates ']' container-test-run-certificates> ca # [2706438.121151] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [2706438.122024] ca acme-order-renew-ca.foo-start[300]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [2706438.123235] ca acme-order-renew-ca.foo-start[300]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [2706438.235623] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [2706438.238309] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [2706438.238427] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [2706438.863685] ca nginx[351]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [2706438.863919] ca nginx[351]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca # [2706439.474437] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [2706439.474601] ca systemd[1]: Startup finished in 5.400s. container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 6.14 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [2706439.963123] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [2706440.004262] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [2706440.004397] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [2706440.004411] ca systemd[1]: nginx.service: Consumed 2.433s CPU time over 3.328s wall clock time. container-test-run-certificates> ca # [2706440.005989] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.71 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 444) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 447) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ca # [2706440.667370] ca nginx-pre-start[375]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [2706440.667599] ca nginx-pre-start[375]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca # [2706440.670222] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> client # [2706441.305319] client systemd-journald[72]: Journal started container-test-run-certificates> client # [2706441.305349] client systemd-journald[72]: Runtime Journal (/run/log/journal/1ce6cdd4e15940b8bd23cf9fa5199c25) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [2706441.310510] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [2706441.317888] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [2706441.328390] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [2706441.328731] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [2706441.329022] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [2706441.358678] client systemd-journald[72]: Time spent on flushing to /var/log/journal/1ce6cdd4e15940b8bd23cf9fa5199c25 is 1.445ms for 7 entries. container-test-run-certificates> client # [2706441.358678] client systemd-journald[72]: System Journal (/var/log/journal/1ce6cdd4e15940b8bd23cf9fa5199c25) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [2706441.371778] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [2706441.372287] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [2706441.372834] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [2706441.372891] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [2706441.373624] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [2706441.373651] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [2706441.374103] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [2706441.374396] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [2706441.374410] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [2706441.392517] client systemd[1]: Finished Firewall. container-test-run-certificates> client # [2706441.392631] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [2706441.392789] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [2706441.393279] client systemd[1]: Starting Network Management... container-test-run-certificates> client # [2706441.407832] client systemd-tmpfiles[160]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [2706441.407979] client systemd-tmpfiles[160]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [2706441.408084] client systemd-tmpfiles[160]: fchmod() of /var/log/journal/1ce6cdd4e15940b8bd23cf9fa5199c25 failed: Operation not permitted container-test-run-certificates> client # [2706441.408226] client systemd-tmpfiles[160]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [2706441.410346] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [2706441.410900] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [2706441.411232] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [2706441.417623] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [2706441.423693] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [2706441.424144] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [2706441.429901] client systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [2706441.311637] server systemd-journald[72]: Journal started container-test-run-certificates> server # [2706441.311667] server systemd-journald[72]: Runtime Journal (/run/log/journal/cc3ecc45d1704f9ab4fd2d54f58babe1) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [2706441.316507] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [2706441.324098] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [2706441.355162] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [2706441.355525] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [2706441.355810] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [2706441.359745] server systemd-journald[72]: Time spent on flushing to /var/log/journal/cc3ecc45d1704f9ab4fd2d54f58babe1 is 1.037ms for 7 entries. container-test-run-certificates> server # [2706441.359745] server systemd-journald[72]: System Journal (/var/log/journal/cc3ecc45d1704f9ab4fd2d54f58babe1) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [2706441.372220] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [2706441.372408] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [2706441.373371] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [2706441.373420] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [2706441.373843] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [2706441.373868] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [2706441.374271] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [2706441.374547] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [2706441.374560] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [2706441.402036] server systemd[1]: Finished Firewall. container-test-run-certificates> server # [2706441.402137] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [2706441.402263] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [2706441.402759] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [2706441.408142] server systemd-tmpfiles[153]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [2706441.408288] server systemd-tmpfiles[153]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [2706441.408387] server systemd-tmpfiles[153]: fchmod() of /var/log/journal/cc3ecc45d1704f9ab4fd2d54f58babe1 failed: Operation not permitted container-test-run-certificates> server # [2706441.408534] server systemd-tmpfiles[153]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [2706441.410363] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [2706441.410888] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [2706441.411258] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [2706441.418570] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [2706441.423772] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [2706441.424335] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [2706441.430040] server systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [2706441.899795] server systemd-networkd[182]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [2706441.899866] server systemd-networkd[182]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [2706441.907513] server systemd-networkd[182]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [2706441.907655] server systemd-networkd[182]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [2706441.907723] server systemd-networkd[182]: lo: Link UP container-test-run-certificates> server # [2706441.907726] server systemd-networkd[182]: lo: Gained carrier container-test-run-certificates> server # [2706441.907861] server systemd-networkd[182]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [2706441.908092] server systemd[1]: Started Network Management. container-test-run-certificates> server # [2706441.908125] server systemd-networkd[182]: eth1: Link UP container-test-run-certificates> server # [2706441.908237] server systemd-networkd[182]: eth1: Gained carrier container-test-run-certificates> server # [2706441.908844] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [2706441.935132] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> client # [2706441.898067] client systemd-networkd[178]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [2706441.898146] client systemd-networkd[178]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [2706441.905749] client systemd-networkd[178]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [2706441.905945] client systemd-networkd[178]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [2706441.906087] client systemd-networkd[178]: lo: Link UP container-test-run-certificates> client # [2706441.906093] client systemd-networkd[178]: lo: Gained carrier container-test-run-certificates> client # [2706441.906306] client systemd-networkd[178]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [2706441.906607] client systemd[1]: Started Network Management. container-test-run-certificates> client # [2706441.906688] client systemd-networkd[178]: eth1: Link UP container-test-run-certificates> client # [2706441.906834] client systemd-networkd[178]: eth1: Gained carrier container-test-run-certificates> client # [2706441.907523] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [2706441.930442] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [2706442.185400] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> server # [2706442.306734] server systemd-resolved[128]: Positive Trust Anchors: container-test-run-certificates> server # [2706442.306740] server systemd-resolved[128]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [2706442.306743] server systemd-resolved[128]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [2706442.306758] server systemd-resolved[128]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [2706442.309084] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [2706442.316839] server systemd-resolved[128]: Using system hostname 'server'. container-test-run-certificates> server # [2706442.317612] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [2706442.317651] server systemd[1]: Reached target Network. container-test-run-certificates> server # [2706442.317680] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [2706442.317702] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [2706442.317828] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [2706442.317845] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [2706442.317857] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [2706442.317866] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [2706442.317933] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [2706442.317985] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [2706442.318057] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [2706442.318068] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [2706442.318087] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [2706442.323424] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [2706442.323726] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [2706442.323742] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [2706442.324097] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [2706442.324633] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [2706442.333322] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [2706442.418815] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [2706442.418815] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [2706442.419188] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [2706442.419685] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [2706442.420556] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [2706442.420584] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [2706442.420584] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [2706442.420584] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> client # [2706442.185386] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [2706442.298936] client systemd-resolved[110]: Positive Trust Anchors: container-test-run-certificates> client # [2706442.298943] client systemd-resolved[110]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [2706442.298945] client systemd-resolved[110]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [2706442.298962] client systemd-resolved[110]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [2706442.303040] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [2706442.309149] client systemd-resolved[110]: Using system hostname 'client'. container-test-run-certificates> client # [2706442.309976] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [2706442.310009] client systemd[1]: Reached target Network. container-test-run-certificates> client # [2706442.310044] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [2706442.310068] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [2706442.310081] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [2706442.310089] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [2706442.310159] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [2706442.310215] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [2706442.310280] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [2706442.310288] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [2706442.310307] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [2706442.310771] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [2706442.311189] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [2706442.311687] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [2706442.331317] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [2706442.439789] client nsncd[192]: Oct 05 15:04:16.863 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [2706442.439762] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [2706442.439785] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [2706442.439809] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [2706442.440297] client systemd[1]: Starting User Login Management... container-test-run-certificates> server # [2706442.442258] server nsncd[197]: Oct 05 15:04:16.865 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [2706442.442293] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [2706442.442328] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [2706442.442362] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [2706442.442930] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [2706442.443226] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [2706442.448173] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [2706442.448556] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [2706442.448574] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [2706442.448583] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [2706442.555556] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [2706442.556065] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [2706442.556065] server dbus-broker-launch[198]: Invalid user-name in /nix/store/z0d64q8chnmjqdlbzb043chi9x35wxn5-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [2706442.556362] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [2706442.559948] server dbus-broker-launch[198]: Ready container-test-run-certificates> client # [2706442.440598] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [2706442.446472] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [2706442.446893] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [2706442.446910] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [2706442.446920] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [2706442.556584] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [2706442.556964] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [2706442.556964] client dbus-broker-launch[193]: Invalid user-name in /nix/store/nnivh8i0fvyhb4r4rj6a70snas6kdx1y-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> client # [2706442.557211] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [2706442.560861] client dbus-broker-launch[193]: Ready container-test-run-certificates> client # [2706443.002881] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [2706443.002993] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [2706443.021238] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [2706443.026864] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [2706443.026905] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [2706443.027110] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [2706443.027226] client systemd[1]: Startup finished in 2.097s. container-test-run-certificates> server # [2706442.997863] server systemd-logind[227]: New seat seat0. container-test-run-certificates> server # [2706442.997962] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [2706442.998628] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [2706443.025651] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [2706443.025744] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [2706443.052682] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [2706443.052844] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [2706443.052844] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [2706443.060096] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [2706443.060881] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> server # [2706443.457083] server systemd-networkd[182]: eth1: Gained IPv6LL container-test-run-certificates> server # [2706443.665824] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [2706443.667508] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [2706443.667532] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [2706443.671593] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [2706443.671736] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [2706443.672437] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [2706443.672550] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [2706443.673160] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [2706443.673279] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [2706443.674085] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [2706443.674826] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [2706443.675983] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [2706443.675997] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [2706443.675997] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [2706443.676905] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [2706443.678185] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [2706443.678185] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [2706443.680229] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [2706443.680967] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> client # [2706443.585071] client systemd-networkd[178]: eth1: Gained IPv6LL container-test-run-certificates> server # [2706444.305360] server nginx-pre-start[270]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [2706444.305561] server nginx-pre-start[270]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [2706444.308064] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [2706444.308694] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [2706444.309325] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [2706444.959007] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [2706444.960625] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [2706444.960695] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [2706444.960695] server acme-order-renew-test.foo-start[273]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [2706444.961513] server acme-order-renew-test.foo-start[285]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [2706444.962788] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [2706444.962788] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [2706444.962837] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [2706444.962852] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [2706444.973442] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.396756081Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [2706444.987092] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.410417021Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [2706445.012558] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.435889278Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [2706445.012558] server acme-order-renew-test.foo-start[286]: Your account credentials have been saved in your container-test-run-certificates> server # [2706445.012558] server acme-order-renew-test.foo-start[286]: configuration directory at "accounts". container-test-run-certificates> server # [2706445.012558] server acme-order-renew-test.foo-start[286]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [2706445.012558] server acme-order-renew-test.foo-start[286]: configuration directory will also contain private keys container-test-run-certificates> server # [2706445.012558] server acme-order-renew-test.foo-start[286]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [2706445.012558] server acme-order-renew-test.foo-start[286]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [2706445.012674] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.435950834Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [2706445.072403] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.495732793Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [2706445.072403] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.495742070Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [2706445.074429] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.497761233Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [2706445.074457] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.497792312Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [2706445.078330] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.501662060Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [2706445.078355] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.501684673Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [2706445.078384] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.501719499Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [2706445.078408] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.501744436Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [2706445.078446] server acme-order-renew-test.foo-start[286]: 2026-10-05T15:04:19.501781485Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [2706445.081688] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [2706445.082495] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [2706445.083057] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [2706445.083778] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [2706445.083778] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [2706445.083778] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [2706445.084452] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [2706445.084578] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [2706445.085261] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [2706445.085369] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [2706445.086201] server acme-order-renew-test.foo-start[308]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [2706445.086313] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [2706445.087250] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [2706445.088056] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [2706445.088068] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [2706445.088068] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [2706445.088796] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [2706445.090032] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [2706445.090032] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [2706445.090059] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [2706445.090764] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [2706445.092022] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> server # [2706445.195367] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [2706445.197618] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [2706445.197732] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> ca # [2706444.986885] ca step-ca[207]: time="2026-10-05T15:04:19Z" level=info duration="35.387µs" duration-ns=35387 fields.time="2026-10-05T15:04:19Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=22826013-4376-4595-bfd5-b80d8ccc7ba0 response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706445.007878] ca step-ca[207]: time="2026-10-05T15:04:19Z" level=info duration=20.070854ms duration-ns=20070854 fields.time="2026-10-05T15:04:19Z" method=HEAD name=ca nonce=RktuV2xnZEFucnFab1pkOWdYRU5wME9vRkFSQmp5aFQ path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=dd0dbece-1a9c-4132-9303-80e776133f37 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706445.012391] ca step-ca[207]: time="2026-10-05T15:04:19Z" level=info duration=3.600371ms duration-ns=3600371 fields.time="2026-10-05T15:04:19Z" method=POST name=ca nonce=WnpMQ29IRkc2Y0JvYVBDV25RcFcyR3lqSDNCMHNDNzQ path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=a6fc93dd-1744-4e29-b040-b8189d60d84d response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/6EfXDRxUyTqglEFj3Z2tnTzxZqe9qqnl/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706445.014558] ca step-ca[207]: time="2026-10-05T15:04:19Z" level=info duration=1.223635ms duration-ns=1223635 fields.time="2026-10-05T15:04:19Z" method=POST name=ca nonce=M3U4NzNFTUVVdWtsT0t0VXdGV1VCYmljWlVMcmdjcXU path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=7ba773f0-728b-4bdd-8df4-17d877725fcc response="{\"id\":\"BFrgUnyXE1c7CiWYzUlvDpDh7cQmIk05\",\"status\":\"pending\",\"expires\":\"2026-10-06T15:04:19Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-05T15:03:19Z\",\"notAfter\":\"2027-01-03T15:04:19Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/z03OowwAjdJItSnNdRr5W9gdfYEu8e7k\"],\"finalize\":\"https://ca.foo/acme/acme/order/BFrgUnyXE1c7CiWYzUlvDpDh7cQmIk05/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706445.072176] ca step-ca[207]: time="2026-10-05T15:04:19Z" level=info duration="469.464µs" duration-ns=469464 fields.time="2026-10-05T15:04:19Z" method=POST name=ca nonce=cWpnSmRKWDlXSERKamhHMnNWZ2FyUXpCR0hiRkQ0ejA path=/acme/acme/authz/z03OowwAjdJItSnNdRr5W9gdfYEu8e7k protocol=HTTP/1.1 referer= remote-address="::1" request-id=f44fdcb0-7748-426a-8219-2bef2cd6734c response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"fHGjE87FoaVXQewJQ3PUyRSutxOMFm56\",\"url\":\"https://ca.foo/acme/acme/challenge/z03OowwAjdJItSnNdRr5W9gdfYEu8e7k/tHbIQfxcVeJIODscvFbVPaCE1fGOtN5O\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"fHGjE87FoaVXQewJQ3PUyRSutxOMFm56\",\"url\":\"https://ca.foo/acme/acme/challenge/z03OowwAjdJItSnNdRr5W9gdfYEu8e7k/wOFeDkCRzxUfVtuxco0pAKkQvFTiNiEk\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"fHGjE87FoaVXQewJQ3PUyRSutxOMFm56\",\"url\":\"https://ca.foo/acme/acme/challenge/z03OowwAjdJItSnNdRr5W9gdfYEu8e7k/E8xccRUDmJ3fHnQSI8RXmNzE78TMuMNJ\"}],\"wildcard\":false,\"expires\":\"2026-10-06T15:04:19Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706445.074284] ca step-ca[207]: time="2026-10-05T15:04:19Z" level=info duration=1.237631ms duration-ns=1237631 fields.time="2026-10-05T15:04:19Z" method=POST name=ca nonce=MDVtQzZpTzVYckk4WlJ5bFRRQWptMkdJaXFJUlVNSEo path=/acme/acme/challenge/z03OowwAjdJItSnNdRr5W9gdfYEu8e7k/wOFeDkCRzxUfVtuxco0pAKkQvFTiNiEk protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=e5e70d24-f1a2-465d-ae06-65e0baf0d558 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"fHGjE87FoaVXQewJQ3PUyRSutxOMFm56\",\"validated\":\"2026-10-05T15:04:19Z\",\"url\":\"https://ca.foo/acme/acme/challenge/z03OowwAjdJItSnNdRr5W9gdfYEu8e7k/wOFeDkCRzxUfVtuxco0pAKkQvFTiNiEk\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706445.077039] ca step-ca[207]: time="2026-10-05T15:04:19Z" level=info duration=1.858ms duration-ns=1858000 fields.time="2026-10-05T15:04:19Z" method=POST name=ca nonce=VGdnNlVMaGF3MnNDbWJjR2habnpXNWIyTExSYmJ2dE8 path=/acme/acme/order/BFrgUnyXE1c7CiWYzUlvDpDh7cQmIk05/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=822d3b93-40b5-4e66-a14f-342c49ce9bc6 response="{\"id\":\"BFrgUnyXE1c7CiWYzUlvDpDh7cQmIk05\",\"status\":\"valid\",\"expires\":\"2026-10-06T15:04:19Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-05T15:03:19Z\",\"notAfter\":\"2027-01-03T15:04:19Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/z03OowwAjdJItSnNdRr5W9gdfYEu8e7k\"],\"finalize\":\"https://ca.foo/acme/acme/order/BFrgUnyXE1c7CiWYzUlvDpDh7cQmIk05/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/oXYGqJ30Nb23ZCez4eSqfjbZnqHMqWjJ\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2706445.078206] ca step-ca[207]: time="2026-10-05T15:04:19Z" level=info certificate=MIIB2TCCAX6gAwIBAgIRAJhEhLHHKVpIUvv2CdCla8QwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDA1MTUwMzE5WhcNMjcwMTAzMTUwNDE5WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABM6b3ErvZQ/0b2BC9t96vA4b3cHtcn+7rgBuMeAiiLwE2pQWiwxAEaW4hT/xFwCBfd6aL2bDBr2b+iyE8GRqKnmjgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU7Cu/VNEWIVHQyTxJHdXKm0vBh38wHwYDVR0jBBgwFoAUBTu+iFb6KPHLm1XzKo2FUZFQSeUwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0kAMEYCIQCW3sGleNsoK5vFf4ODSHclyvpgTNO9gmi61HXmauEKGwIhAMGNMHSihArI6gQGNsPK3hFt5HsgiRvFjv2l5x2+1LL1 duration="405.393µs" duration-ns=405393 fields.time="2026-10-05T15:04:19Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=QkVBY1JQbWpkR2RyMHU1RjFsZjhaUGZYdVEyeThibm4 path=/acme/acme/certificate/oXYGqJ30Nb23ZCez4eSqfjbZnqHMqWjJ protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=2ec1f0f8-f0f1-4f4b-9104-b3f5afa74894 sans="map[dns:[test.foo]]" serial=202398422908777537265583005507279743940 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-05T15:03:19Z" valid-to="2027-01-03T15:04:19Z" container-test-run-certificates> server # [2706445.815402] server nginx[324]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [2706445.815698] server nginx[324]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [2706446.421821] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [2706446.421979] server systemd[1]: Startup finished in 5.492s. container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 6.14 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [2706446.815817] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [2706446.866649] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [2706446.866740] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [2706446.866761] server systemd[1]: nginx.service: Consumed 3.671s CPU time over 3.185s wall clock time. container-test-run-certificates> server # [2706446.867953] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.69 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 50218 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 57884 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> server # [2706447.496700] server nginx-pre-start[347]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [2706447.496990] server nginx-pre-start[347]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [2706447.500041] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1554 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [933 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [79 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Oct 5 15:03:19 2026 GMT container-test-run-certificates> * expire date: Jan 3 15:04:19 2027 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 50224 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1928 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.03 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> 98:44:84:b1:c7:29:5a:48:52:fb:f6:09:d0:a5:6b:c4 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Oct 5 15:03:19 2026 GMT container-test-run-certificates> Not After : Jan 3 15:04:19 2027 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:ce:9b:dc:4a:ef:65:0f:f4:6f:60:42:f6:df:7a: container-test-run-certificates> bc:0e:1b:dd:c1:ed:72:7f:bb:ae:00:6e:31:e0:22: container-test-run-certificates> 88:bc:04:da:94:16:8b:0c:40:11:a5:b8:85:3f:f1: container-test-run-certificates> 17:00:81:7d:de:9a:2f:66:c3:06:bd:9b:fa:2c:84: container-test-run-certificates> f0:64:6a:2a:79 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> EC:2B:BF:54:D1:16:21:51:D0:C9:3C:49:1D:D5:CA:9B:4B:C1:87:7F container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 05:3B:BE:88:56:FA:28:F1:CB:9B:55:F3:2A:8D:85:51:91:50:49:E5 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:46:02:21:00:96:de:c1:a5:78:db:28:2b:9b:c5:7f:83:83: container-test-run-certificates> 48:77:25:ca:fa:60:4c:d3:bd:82:68:ba:d4:75:e6:6a:e1:0a: container-test-run-certificates> 1b:02:21:00:c1:8d:30:74:a2:84:0a:c8:ea:04:06:36:c3:ca: container-test-run-certificates> de:11:6d:e4:7b:20:89:1b:c5:8e:fd:a5:e7:1d:be:d4:b2:f5 container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds) container-test-run-certificates> (finished: run the VM test script, in 14.73 seconds) container-test-run-certificates> test script finished in 14.76s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 447) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> kill NspawnMachine (pid 444) container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> Container server terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.29 seconds)