don't know how to build these paths: /nix/store/p132c8ipwn8wa2jhccmbpd0ivn51nziq-container-test-run-certificates.drv warning: ignoring the client-specified setting 'store', because it is a restricted setting and you are not a trusted user building '/nix/store/12q2vaszslk1n82ypz3wb7yzn8cdrr5f-nix.conf.drv' on nix-store.geninf.io:50051 nix.conf> attached to the build already running on this worker nix.conf> build-x86-01: building 12q2vaszslk1n82ypz3wb7yzn8cdrr5f-nix.conf.drv nix.conf> structuredAttrs is enabled nix.conf> Validating generated nix.conf rxvqmqqbyzf4748kg6n01kbi07hwr5zv-X-Restart-Triggers-nix-daemon.drv: build-x86-01: not scheduled here: rxvqmqqbyzf4748kg6n01kbi07hwr5zv-X-Restart-Triggers-nix-daemon.drv, asking the scheduler again building '/nix/store/8szmw7b61m20x2x0jyji389hknpr8xwc-unit-nix-daemon.service.drv' on nix-store.geninf.io:50051 unit-nix-daemon.service> gi-build-x86-02: building 8szmw7b61m20x2x0jyji389hknpr8xwc-unit-nix-daemon.service.drv unit-nix-daemon.service> structuredAttrs is enabled building '/nix/store/67bk1bqaimp5s2jhzpvlbv3ifzh2llw9-system-units.drv' on nix-store.geninf.io:50051 system-units> web01: building 67bk1bqaimp5s2jhzpvlbv3ifzh2llw9-system-units.drv building '/nix/store/p5gzqnh83agxa6l91prrq1dnalvpwahy-etc.drv' on nix-store.geninf.io:50051 etc> web01: building p5gzqnh83agxa6l91prrq1dnalvpwahy-etc.drv building '/nix/store/vvwignvxwq47jbdffn2ngs0rlzd0fhhc-system-units.drv' on nix-store.geninf.io:50051 system-units> gi-build-x86-02: building vvwignvxwq47jbdffn2ngs0rlzd0fhhc-system-units.drv building '/nix/store/cn54x8pyjz3dwjvgv9nijiam4rg73v3i-activate.drv' on nix-store.geninf.io:50051 activate> web01: building cn54x8pyjz3dwjvgv9nijiam4rg73v3i-activate.drv activate> structuredAttrs is enabled building '/nix/store/2h2gmwq4nz66j70ccc5l97jnbp5ybhdq-system-units.drv' on nix-store.geninf.io:50051 system-units> gi-build-x86-02: building 2h2gmwq4nz66j70ccc5l97jnbp5ybhdq-system-units.drv building '/nix/store/mq7zyjx69fvmy0m2jrx1qql1g93v2zhq-nixos-system-ca-test.drv' on nix-store.geninf.io:50051 nixos-system-ca-test> web01: building mq7zyjx69fvmy0m2jrx1qql1g93v2zhq-nixos-system-ca-test.drv nixos-system-ca-test> structuredAttrs is enabled building '/nix/store/mivf9d5c80hk5v5k5lmy957lhsb1d9b4-run-ca-nspawn.drv' on nix-store.geninf.io:50051 run-ca-nspawn> web01: building mivf9d5c80hk5v5k5lmy957lhsb1d9b4-run-ca-nspawn.drv building '/nix/store/qw27ms88p47i0wlfcrnvpp8vm0m8fib2-etc.drv' on nix-store.geninf.io:50051 etc> gi-build-x86-02: building qw27ms88p47i0wlfcrnvpp8vm0m8fib2-etc.drv building '/nix/store/c9vwn1v18frnqr6jnv5xyjf2vjp2irlg-etc.drv' on nix-store.geninf.io:50051 etc> gi-build-x86-02: building c9vwn1v18frnqr6jnv5xyjf2vjp2irlg-etc.drv building '/nix/store/3833m33ydgjskkvh5b35d3l2d733phk8-activate.drv' on nix-store.geninf.io:50051 activate> gi-build-x86-02: building 3833m33ydgjskkvh5b35d3l2d733phk8-activate.drv activate> structuredAttrs is enabled building '/nix/store/s17sndgdw8d41pz5mhc37d397021za0g-activate.drv' on nix-store.geninf.io:50051 activate> gi-build-x86-02: building s17sndgdw8d41pz5mhc37d397021za0g-activate.drv activate> structuredAttrs is enabled building '/nix/store/1kp21adlgkby3n3y2vyrjzi2ijxdnbds-nixos-system-server-test.drv' on nix-store.geninf.io:50051 nixos-system-server-test> gi-build-x86-02: building 1kp21adlgkby3n3y2vyrjzi2ijxdnbds-nixos-system-server-test.drv nixos-system-server-test> structuredAttrs is enabled building '/nix/store/5b9pk8f5ivdxs4k520qhdch2343jfrkl-nixos-system-client-test.drv' on nix-store.geninf.io:50051 nixos-system-client-test> gi-build-x86-02: building 5b9pk8f5ivdxs4k520qhdch2343jfrkl-nixos-system-client-test.drv nixos-system-client-test> structuredAttrs is enabled building '/nix/store/x2rh971fxlxvvrqr737s99iygfg6r97h-run-server-nspawn.drv' on nix-store.geninf.io:50051 run-server-nspawn> gi-build-x86-02: building x2rh971fxlxvvrqr737s99iygfg6r97h-run-server-nspawn.drv building '/nix/store/lab8jckkypyq7qp0xandprzbfhy37li0-run-client-nspawn.drv' on nix-store.geninf.io:50051 run-client-nspawn> gi-build-x86-02: building lab8jckkypyq7qp0xandprzbfhy37li0-run-client-nspawn.drv building '/nix/store/k5mpxc0l018nsgbgwrdc9afrbhgglzzj-driverConfiguration.json.drv' on nix-store.geninf.io:50051 driverConfiguration.json> gi-build-x86-02: building k5mpxc0l018nsgbgwrdc9afrbhgglzzj-driverConfiguration.json.drv driverConfiguration.json> structuredAttrs is enabled building '/nix/store/lxf3kb1668r8jfia4gkbskhc0fj887il-nixos-test-driver-certificates.drv' on nix-store.geninf.io:50051 nixos-test-driver-certificates> gi-build-x86-02: building lxf3kb1668r8jfia4gkbskhc0fj887il-nixos-test-driver-certificates.drv nixos-test-driver-certificates> Running type check (enable/disable: config.skipTypeCheck) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipTypeCheck nixos-test-driver-certificates> All checks passed! nixos-test-driver-certificates> Linting test script (enable/disable: config.skipLint) nixos-test-driver-certificates> See https://nixos.org/manual/nixos/stable/#test-opt-skipLint nixos-test-driver-certificates> All checks passed! building '/nix/store/p132c8ipwn8wa2jhccmbpd0ivn51nziq-container-test-run-certificates.drv' on nix-store.geninf.io:50051 container-test-run-certificates> build-x86-01: building p132c8ipwn8wa2jhccmbpd0ivn51nziq-container-test-run-certificates.drv container-test-run-certificates> Machine state will be reset. To keep it, pass --keep-machine-state container-test-run-certificates> start all VLans container-test-run-certificates> (finished: start all VLans, in 0.00 seconds) container-test-run-certificates> container-test-run-certificates> Test will time out and terminate in 3600.0 seconds container-test-run-certificates> run the VM test script container-test-run-certificates> additionally exposed symbols: container-test-run-certificates> ca, client, server, container-test-run-certificates> vlan1, container-test-run-certificates> start_all, test_script, machines, machines_qemu, machines_nspawn, vlans, driver, log, os, create_machine, subtest, run_tests, join_all, retry, serial_stdout_off, serial_stdout_on, polling_condition, BaseMachine, QemuMachine, NspawnMachine, t, debug, dump_machine_ssh container-test-run-certificates> ca: systemd-nspawn running (pid 50) container-test-run-certificates> ca: Waiting for journal at /build/vm-state-ca/var/log/journal... container-test-run-certificates> ca: waiting for unit step-ca.service container-test-run-certificates> nixos-nspawn(ca): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(ca): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container ca on /build/vm-state-ca. container-test-run-certificates> ca # [2843350.409602] ca systemd-journald[81]: Journal started container-test-run-certificates> ca # [2843350.409633] ca systemd-journald[81]: Runtime Journal (/run/log/journal/650c4290433b43918301f2f61342e4f1) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> ca # [2843350.415479] ca systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> ca # [2843350.422020] ca systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> ca # [2843350.429489] ca systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> ca # [2843350.429822] ca systemd[1]: Starting Network Name Resolution... container-test-run-certificates> ca # [2843350.430121] ca systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> ca # [2843350.455562] ca systemd-journald[81]: Time spent on flushing to /var/log/journal/650c4290433b43918301f2f61342e4f1 is 1.047ms for 7 entries. container-test-run-certificates> ca # [2843350.455562] ca systemd-journald[81]: System Journal (/var/log/journal/650c4290433b43918301f2f61342e4f1) is 8M, max 4G, 3.9G free. container-test-run-certificates> ca # [2843350.462849] ca systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> ca # [2843350.463027] ca systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> ca # [2843350.463826] ca systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> ca # [2843350.463875] ca systemd[1]: Reached target Local File Systems. container-test-run-certificates> ca # [2843350.464290] ca systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> ca # [2843350.464317] ca systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [2843350.464686] ca systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> ca # [2843350.464996] ca systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> ca # [2843350.465012] ca systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> ca # [2843350.477931] ca systemd-tmpfiles[159]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> ca # [2843350.478080] ca systemd-tmpfiles[159]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> ca # [2843350.478174] ca systemd-tmpfiles[159]: fchmod() of /var/log/journal/650c4290433b43918301f2f61342e4f1 failed: Operation not permitted container-test-run-certificates> ca # [2843350.478312] ca systemd-tmpfiles[159]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> ca # [2843350.479194] ca systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> ca # [2843350.479763] ca systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> ca # [2843350.480142] ca systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> ca # [2843350.486080] ca systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> ca # [2843350.492410] ca systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> ca # [2843350.492935] ca systemd[1]: Starting Update is Completed... container-test-run-certificates> ca # [2843350.495276] ca systemd[1]: Finished Firewall. container-test-run-certificates> ca # [2843350.495383] ca systemd[1]: Reached target Preparation for Network. container-test-run-certificates> ca # [2843350.495527] ca systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> ca # [2843350.496085] ca systemd[1]: Starting Network Management... container-test-run-certificates> ca # [2843350.498788] ca systemd[1]: Finished Update is Completed. container-test-run-certificates> ca # [2843350.530137] ca systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> ca # [2843350.956928] ca systemd-networkd[197]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [2843350.957005] ca systemd-networkd[197]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> ca # [2843350.964268] ca systemd-networkd[197]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [2843350.964409] ca systemd-networkd[197]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> ca # [2843350.964494] ca systemd-networkd[197]: lo: Link UP container-test-run-certificates> ca # [2843350.964498] ca systemd-networkd[197]: lo: Gained carrier container-test-run-certificates> ca # [2843350.964655] ca systemd-networkd[197]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> ca # [2843350.964915] ca systemd[1]: Started Network Management. container-test-run-certificates> ca # [2843350.964949] ca systemd-networkd[197]: eth1: Link UP container-test-run-certificates> ca # [2843350.965106] ca systemd-networkd[197]: eth1: Gained carrier container-test-run-certificates> ca # [2843350.965556] ca systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> ca # [2843350.986099] ca systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> ca # [2843351.318169] ca systemd-resolved[118]: Positive Trust Anchors: container-test-run-certificates> ca # [2843351.318177] ca systemd-resolved[118]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> ca # [2843351.318180] ca systemd-resolved[118]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> ca # [2843351.318195] ca systemd-resolved[118]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> ca # [2843351.328347] ca systemd-resolved[118]: Using system hostname 'ca'. container-test-run-certificates> ca # [2843351.329244] ca systemd[1]: Started Network Name Resolution. container-test-run-certificates> ca # [2843351.329290] ca systemd[1]: Reached target Network. container-test-run-certificates> ca # [2843351.329318] ca systemd[1]: Reached target Network is Online. container-test-run-certificates> ca # [2843351.329351] ca systemd[1]: Reached target System Initialization. container-test-run-certificates> ca # [2843351.329487] ca systemd[1]: Started Renew ACME Certificate for ca.foo. container-test-run-certificates> ca # [2843351.329508] ca systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> ca # [2843351.329524] ca systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> ca # [2843351.329537] ca systemd[1]: Reached target Timer Units. container-test-run-certificates> ca # [2843351.329614] ca systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> ca # [2843351.329690] ca systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> ca # [2843351.329760] ca systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> ca # [2843351.329774] ca systemd[1]: Reached target Socket Units. container-test-run-certificates> ca # [2843351.329793] ca systemd[1]: Reached target Basic System. container-test-run-certificates> ca # [2843351.330508] ca systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> ca # [2843351.330968] ca systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> ca # [2843351.330988] ca systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/ca.foo/fullchain.pem container-test-run-certificates> ca # [2843351.331383] ca systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> ca # [2843351.331799] ca systemd[1]: Starting step-ca service... container-test-run-certificates> ca # [2843351.332465] ca systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> ca # [2843351.356570] ca systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> ca # [2843351.409951] ca systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> ca # [2843351.444853] ca acme-setup-privileged[204]: + set -euo pipefail container-test-run-certificates> ca # [2843351.444853] ca acme-setup-privileged[204]: + cd /var/lib/acme container-test-run-certificates> ca # [2843351.444853] ca acme-setup-privileged[204]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> ca # [2843351.445802] ca acme-setup-privileged[204]: + chown -R acme .lego/accounts container-test-run-certificates> ca # [2843351.446697] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [2843351.446719] ca acme-setup-privileged[204]: + '[' -d ca.foo ']' container-test-run-certificates> ca # [2843351.446719] ca acme-setup-privileged[204]: + for fixpath in ca.foo .lego/ca.foo container-test-run-certificates> ca # [2843351.446719] ca acme-setup-privileged[204]: + '[' -d .lego/ca.foo ']' container-test-run-certificates> ca # [2843351.468737] ca nsncd[206]: Oct 07 05:06:05.892 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> ca # [2843351.468760] ca systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> ca # [2843351.468810] ca systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> ca # [2843351.468852] ca systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> ca # [2843351.478476] ca systemd[1]: Starting User Login Management... container-test-run-certificates> ca # [2843351.478809] ca systemd[1]: Starting Permit User Sessions... container-test-run-certificates> ca # [2843351.483587] ca systemd[1]: Finished Permit User Sessions. container-test-run-certificates> ca # [2843351.484018] ca systemd[1]: Started Console Getty. container-test-run-certificates> ca # [2843351.484037] ca systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> ca # [2843351.484046] ca systemd[1]: Reached target Login Prompts. container-test-run-certificates> ca # [2843351.580783] ca dbus-broker-launch[208]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> ca # [2843351.581247] ca dbus-broker-launch[208]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> ca # [2843351.581247] ca dbus-broker-launch[208]: Invalid user-name in /nix/store/hn7gf5byqcdahj580sz3hhr2r6yk34qr-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> ca # [2843351.581531] ca systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> ca # [2843351.585622] ca dbus-broker-launch[208]: Ready container-test-run-certificates> ca # [2843352.056732] ca systemd-logind[234]: New seat seat0. container-test-run-certificates> ca # [2843352.056865] ca systemd[1]: Started User Login Management. container-test-run-certificates> ca # [2843352.057752] ca systemd[1]: Starting linger-users.service... container-test-run-certificates> ca # [2843352.082753] ca systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> ca # [2843352.082870] ca systemd[1]: Finished linger-users.service. container-test-run-certificates> ca # [2843352.104367] ca acme-setup-start[222]: + set -euo pipefail container-test-run-certificates> ca # [2843352.104367] ca acme-setup-start[222]: + test -e ca/key.pem container-test-run-certificates> ca # [2843352.104708] ca acme-setup-start[222]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> ca # [2843352.114522] ca systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> ca # [2843352.117199] ca systemd[1]: Starting Ensure certificate for ca.foo... container-test-run-certificates> ca # [2843352.193180] ca systemd-networkd[197]: eth1: Gained IPv6LL container-test-run-certificates> ca # [2843352.359395] ca step-ca[207]: badger 2026/10/07 05:06:06 INFO: All 0 tables opened in 0s container-test-run-certificates> ca # [2843352.362036] ca step-ca[207]: 2026/10/07 05:06:06 Building new tls configuration using step-ca x509 Signer Interface container-test-run-certificates> ca # [2843352.364584] ca step-ca[207]: 2026/10/07 05:06:06 Starting Smallstep CA/0.30.2 (linux/amd64) container-test-run-certificates> ca # [2843352.364584] ca step-ca[207]: 2026/10/07 05:06:06 Documentation: https://u.step.sm/docs/ca container-test-run-certificates> ca # [2843352.364584] ca step-ca[207]: 2026/10/07 05:06:06 Community Discord: https://u.step.sm/discord container-test-run-certificates> ca # [2843352.364584] ca step-ca[207]: 2026/10/07 05:06:06 Config file: /etc/smallstep/ca.json container-test-run-certificates> ca # [2843352.364584] ca step-ca[207]: 2026/10/07 05:06:06 The primary server URL is https://ca.foo:1443 container-test-run-certificates> ca # [2843352.364584] ca step-ca[207]: 2026/10/07 05:06:06 Root certificates are available at https://ca.foo:1443/roots.pem container-test-run-certificates> ca # [2843352.364584] ca step-ca[207]: 2026/10/07 05:06:06 X.509 Root Fingerprint: a6b7094ed9cada697e81c0c71bac4084aeeeedb2924b510c8013be30b218b4ae container-test-run-certificates> ca # [2843352.364737] ca systemd[1]: Started step-ca service. container-test-run-certificates> ca # [2843352.364848] ca step-ca[207]: 2026/10/07 05:06:06 Serving HTTPS on 0.0.0.0:1443 ... container-test-run-certificates> ca # [2843352.832717] ca acme-ca.foo-start[259]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [2843352.834197] ca acme-ca.foo-start[259]: + '[' -e out/acme-success ']' container-test-run-certificates> ca # [2843352.834240] ca acme-ca.foo-start[259]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=ca.foo --ip-addresses= container-test-run-certificates> ca # [2843352.839478] ca acme-ca.foo-start[286]: + cd ca.foo container-test-run-certificates> ca # [2843352.840064] ca acme-ca.foo-start[286]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> ca # [2843352.840694] ca acme-ca.foo-start[287]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> ca # [2843352.840869] ca acme-ca.foo-start[286]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> ca # [2843352.841528] ca acme-ca.foo-start[286]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> ca # [2843352.841681] ca acme-ca.foo-start[259]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> ca # [2843352.842929] ca acme-ca.foo-start[259]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> ca # [2843352.843828] ca acme-ca.foo-start[259]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [2843352.844626] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [2843352.844643] ca acme-ca.foo-start[259]: + '[' -d out ']' container-test-run-certificates> ca # [2843352.844643] ca acme-ca.foo-start[259]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [2843352.845746] ca acme-ca.foo-start[259]: + chown -R acme:nginx out container-test-run-certificates> ca # [2843352.847470] ca acme-ca.foo-start[259]: + for fixpath in out certificates container-test-run-certificates> ca # [2843352.847470] ca acme-ca.foo-start[259]: + '[' -d certificates ']' container-test-run-certificates> ca # [2843352.849439] ca systemd[1]: Finished Ensure certificate for ca.foo. container-test-run-certificates> ca # [2843352.850267] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca # [2843353.514635] ca nginx-pre-start[298]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [2843353.514927] ca nginx-pre-start[298]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca # [2843353.517953] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> ca # [2843353.518208] ca systemd[1]: Reached target Multi-User System. container-test-run-certificates> ca # [2843353.518897] ca systemd[1]: Starting Order (and renew) ACME certificate for ca.foo... container-test-run-certificates> ca # [2843354.179388] ca acme-order-renew-ca.foo-start[301]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> ca # [2843354.181009] ca acme-order-renew-ca.foo-start[301]: + set -euo pipefail container-test-run-certificates> ca # [2843354.181042] ca acme-order-renew-ca.foo-start[301]: + exec container-test-run-certificates> ca # [2843354.181074] ca acme-order-renew-ca.foo-start[301]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11 container-test-run-certificates> ca # [2843354.181733] ca acme-order-renew-ca.foo-start[313]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> ca # [2843354.183296] ca acme-order-renew-ca.foo-start[301]: + '[' -n '' ']' container-test-run-certificates> ca # [2843354.183316] ca acme-order-renew-ca.foo-start[301]: + exec container-test-run-certificates> ca # [2843354.183351] ca acme-order-renew-ca.foo-start[301]: + '[' -e certificates/ca.foo.key ']' container-test-run-certificates> ca # [2843354.183367] ca acme-order-renew-ca.foo-start[301]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo:1443/acme/acme/directory --key-type ec256 -d ca.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> ca # [2843354.193432] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.616744639Z INFO Private key saved. filepath=accounts/ca.foo_1443/none@none.tld/none@none.tld.key container-test-run-certificates> ca # [2843354.206404] ca step-ca[207]: time="2026-10-07T05:06:08Z" level=info duration="82.435µs" duration-ns=82435 fields.time="2026-10-07T05:06:08Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=7a4e1e78-4dc6-44ef-97a0-783a43d21d86 response="{\"newNonce\":\"https://ca.foo:1443/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo:1443/acme/acme/new-account\",\"newOrder\":\"https://ca.foo:1443/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo:1443/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo:1443/acme/acme/key-change\"}" size=277 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843354.206687] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.630017840Z INFO Registering the account. email=none@none.tld container-test-run-certificates> ca # [2843354.207739] ca step-ca[207]: time="2026-10-07T05:06:08Z" level=info duration="925.604µs" duration-ns=925604 fields.time="2026-10-07T05:06:08Z" method=HEAD name=ca nonce=RHFNZTMwV2tHMmRrU2tITlQ1cXZLQWRtTVNqZEIwTEU path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=c5c17688-b3f3-4d43-9831-16ca666f88ff size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843354.209067] ca step-ca[207]: time="2026-10-07T05:06:08Z" level=info duration="856.203µs" duration-ns=856203 fields.time="2026-10-07T05:06:08Z" method=POST name=ca nonce=UzJ6c29YQ0tzaU5RcDNQQXpQa1V2aEo4QkxjaGFiMUQ path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=fff12f11-3a79-4562-8b7f-7a8707e57765 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo:1443/acme/acme/account/tMhKJtt5JaoAT5AChYBQAlE7KT7dmBCM/orders\"}" size=143 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843354.209300] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.632629579Z WARN !!!! HEADS UP !!!! container-test-run-certificates> ca # [2843354.209300] ca acme-order-renew-ca.foo-start[314]: Your account credentials have been saved in your container-test-run-certificates> ca # [2843354.209300] ca acme-order-renew-ca.foo-start[314]: configuration directory at "accounts". container-test-run-certificates> ca # [2843354.209300] ca acme-order-renew-ca.foo-start[314]: You should make a secure backup of this folder now. This container-test-run-certificates> ca # [2843354.209300] ca acme-order-renew-ca.foo-start[314]: configuration directory will also contain private keys container-test-run-certificates> ca # [2843354.209300] ca acme-order-renew-ca.foo-start[314]: generated by lego and certificates obtained from the ACME container-test-run-certificates> ca # [2843354.209300] ca acme-order-renew-ca.foo-start[314]: server. Making regular backups of this folder is ideal. container-test-run-certificates> ca # [2843354.209404] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.632701154Z INFO Obtaining bundled SAN certificate. domains=ca.foo container-test-run-certificates> ca # [2843354.210879] ca step-ca[207]: time="2026-10-07T05:06:08Z" level=info duration=1.322751ms duration-ns=1322751 fields.time="2026-10-07T05:06:08Z" method=POST name=ca nonce=TEdSNmNCR1JBOTY0b1FIS0dhR3J6cXpiU2dvV2VrdXo path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=230c7bb4-ad10-4fa8-85d1-1e5120ff2729 response="{\"id\":\"I4tigTOR2bgRr9Lz7SLXoXQKZeGuPgxL\",\"status\":\"pending\",\"expires\":\"2026-10-08T05:06:08Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-07T05:05:08Z\",\"notAfter\":\"2027-01-05T05:06:08Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/sJXVUMFTQongpIfBJdBqRkTme3tKg6vX\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/I4tigTOR2bgRr9Lz7SLXoXQKZeGuPgxL/finalize\"}" size=392 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843354.268294] ca step-ca[207]: time="2026-10-07T05:06:08Z" level=info duration=1.005394ms duration-ns=1005394 fields.time="2026-10-07T05:06:08Z" method=POST name=ca nonce=aWZPSHkxeXZKczl3OGVHcm9kRU13a0MwZW1lVDhXVEc path=/acme/acme/authz/sJXVUMFTQongpIfBJdBqRkTme3tKg6vX protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=f9e9b83e-87c3-4c0f-a461-1d15c7637a30 response="{\"identifier\":{\"type\":\"dns\",\"value\":\"ca.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"CjOT5YZUtGeBU6TsgOIgkApsvuD7osOt\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sJXVUMFTQongpIfBJdBqRkTme3tKg6vX/MSDakyCRfzDYnhhjc4QD1Pym8mT3DuTV\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"CjOT5YZUtGeBU6TsgOIgkApsvuD7osOt\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sJXVUMFTQongpIfBJdBqRkTme3tKg6vX/DqKY4J5g4JSoHE91WcufvxMqRmwNxeKa\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"CjOT5YZUtGeBU6TsgOIgkApsvuD7osOt\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sJXVUMFTQongpIfBJdBqRkTme3tKg6vX/JCAqWYNpECUbpVN9IM7p8GMw9MnRRkeo\"}],\"wildcard\":false,\"expires\":\"2026-10-08T05:06:08Z\"}" size=719 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843354.268388] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.691720683Z INFO Use solver. domain=ca.foo type=http-01 container-test-run-certificates> ca # [2843354.268403] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.691729640Z INFO http01: Trying to solve HTTP-01. domain=ca.foo container-test-run-certificates> ca # [2843354.270192] ca step-ca[207]: time="2026-10-07T05:06:08Z" level=info duration=1.632285ms duration-ns=1632285 fields.time="2026-10-07T05:06:08Z" method=POST name=ca nonce=WHN1VFh4a29COEk5Q3Y0REVta1piOVRGZmpkRk9MYTM path=/acme/acme/challenge/sJXVUMFTQongpIfBJdBqRkTme3tKg6vX/DqKY4J5g4JSoHE91WcufvxMqRmwNxeKa protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=328d15ec-b743-48e9-9869-cb84cbe5ad83 response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"CjOT5YZUtGeBU6TsgOIgkApsvuD7osOt\",\"validated\":\"2026-10-07T05:06:08Z\",\"url\":\"https://ca.foo:1443/acme/acme/challenge/sJXVUMFTQongpIfBJdBqRkTme3tKg6vX/DqKY4J5g4JSoHE91WcufvxMqRmwNxeKa\"}" size=228 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843354.270295] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.693627274Z INFO The server validated our request. domain=ca.foo container-test-run-certificates> ca # [2843354.270325] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.693660637Z INFO Validations succeeded; requesting certificates. domains=ca.foo container-test-run-certificates> ca # [2843354.272538] ca step-ca[207]: time="2026-10-07T05:06:08Z" level=info duration=1.970261ms duration-ns=1970261 fields.time="2026-10-07T05:06:08Z" method=POST name=ca nonce=aE0wRHdaZ0s2WHc3QWZCZ1V0amt0M1Jqa3JTVEh1bGQ path=/acme/acme/order/I4tigTOR2bgRr9Lz7SLXoXQKZeGuPgxL/finalize protocol=HTTP/1.1 referer= remote-address="2001:db8:1::1" request-id=e4cc2ee9-891f-444a-8122-0fabe99c74d3 response="{\"id\":\"I4tigTOR2bgRr9Lz7SLXoXQKZeGuPgxL\",\"status\":\"valid\",\"expires\":\"2026-10-08T05:06:08Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"ca.foo\"}],\"notBefore\":\"2026-10-07T05:05:08Z\",\"notAfter\":\"2027-01-05T05:06:08Z\",\"authorizations\":[\"https://ca.foo:1443/acme/acme/authz/sJXVUMFTQongpIfBJdBqRkTme3tKg6vX\"],\"finalize\":\"https://ca.foo:1443/acme/acme/order/I4tigTOR2bgRr9Lz7SLXoXQKZeGuPgxL/finalize\",\"certificate\":\"https://ca.foo:1443/acme/acme/certificate/ZbKIYzLBtHintogA3hpV3xGLUnGYcV7W\"}" size=481 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843354.273174] ca step-ca[207]: time="2026-10-07T05:06:08Z" level=info certificate="MIIB1DCCAXqgAwIBAgIRAPqPMkALuVvDofwHTSW1VigwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDA3MDUwNTA4WhcNMjcwMTA1MDUwNjA4WjARMQ8wDQYDVQQDEwZjYS5mb28wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASKIp7QrovSpJRwpqw4hkHJB/n4y3q4c/49X+CZ5ETsZmisNH0/3oBQSw1fqvp/ogBQOBs+zVZpaHHYKEDZ0niOo4GkMIGhMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFCrxPn0aEmydpP/uDMpcuKPatNU5MB8GA1UdIwQYMBaAFAU7vohW+ijxy5tV8yqNhVGRUEnlMBEGA1UdEQQKMAiCBmNhLmZvbzAdBgwrBgEEAYKkZMYoQAEEDTALAgEGBARhY21lBAAwCgYIKoZIzj0EAwIDSAAwRQIgKCbrx1Io9ChVdSsO23zs3460Q8RDzZKOk6m6nOsKcOcCIQDSG4raPfQcLCfIvZiSQeMIFkjunxy/JyBNSqBVNdIAoQ==" duration="365.027µs" duration-ns=365027 fields.time="2026-10-07T05:06:08Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=RzdBOUM1SG94b0lDZndna1BFc3NsR25yZlFNTjJVQUY path=/acme/acme/certificate/ZbKIYzLBtHintogA3hpV3xGLUnGYcV7W protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address="2001:db8:1::1" request-id=fd0472c0-de9b-4c24-9118-ace234eabae4 sans="map[dns:[ca.foo]]" serial=333050516591710451802071179421075985960 size=1344 status=200 subject=ca.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-07T05:05:08Z" valid-to="2027-01-05T05:06:08Z" container-test-run-certificates> ca # [2843354.273245] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.696578493Z INFO Server responded with a certificate. domains=ca.foo container-test-run-certificates> ca # [2843354.273266] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.696601917Z INFO Writing file. filepath=certificates/ca.foo.crt container-test-run-certificates> ca # [2843354.273299] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.696634639Z INFO Writing file. filepath=certificates/ca.foo.issuer.crt container-test-run-certificates> ca # [2843354.273319] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.696654847Z INFO Writing file. filepath=certificates/ca.foo.key container-test-run-certificates> ca # [2843354.273358] ca acme-order-renew-ca.foo-start[314]: 2026-10-07T05:06:08.696693550Z INFO Writing file. filepath=certificates/ca.foo.json container-test-run-certificates> ca # [2843354.276435] ca acme-order-renew-ca.foo-start[301]: + touch out/acme-success container-test-run-certificates> ca # [2843354.277357] ca acme-order-renew-ca.foo-start[301]: + cmp -s certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [2843354.278107] ca acme-order-renew-ca.foo-start[301]: + touch out/renewed container-test-run-certificates> ca # [2843354.279179] ca acme-order-renew-ca.foo-start[301]: + echo Installing new certificate container-test-run-certificates> ca # [2843354.279179] ca acme-order-renew-ca.foo-start[301]: Installing new certificate container-test-run-certificates> ca # [2843354.279179] ca acme-order-renew-ca.foo-start[301]: + cp -vp certificates/ca.foo.crt out/fullchain.pem container-test-run-certificates> ca # [2843354.280065] ca acme-order-renew-ca.foo-start[334]: 'certificates/ca.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> ca # [2843354.280226] ca acme-order-renew-ca.foo-start[301]: + cp -vp certificates/ca.foo.key out/key.pem container-test-run-certificates> ca # [2843354.281128] ca acme-order-renew-ca.foo-start[335]: 'certificates/ca.foo.key' -> 'out/key.pem' container-test-run-certificates> ca # [2843354.281261] ca acme-order-renew-ca.foo-start[301]: + cp -vp certificates/ca.foo.issuer.crt out/chain.pem container-test-run-certificates> ca # [2843354.282023] ca acme-order-renew-ca.foo-start[336]: 'certificates/ca.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> ca # [2843354.282142] ca acme-order-renew-ca.foo-start[301]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> ca # [2843354.282987] ca acme-order-renew-ca.foo-start[301]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> ca # [2843354.283850] ca acme-order-renew-ca.foo-start[301]: + for fixpath in out certificates container-test-run-certificates> ca # [2843354.283861] ca acme-order-renew-ca.foo-start[301]: + '[' -d out ']' container-test-run-certificates> ca # [2843354.283861] ca acme-order-renew-ca.foo-start[301]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> ca # [2843354.284684] ca acme-order-renew-ca.foo-start[301]: + chown -R acme:nginx out container-test-run-certificates> ca # [2843354.286029] ca acme-order-renew-ca.foo-start[301]: + for fixpath in out certificates container-test-run-certificates> ca # [2843354.286029] ca acme-order-renew-ca.foo-start[301]: + '[' -d certificates ']' container-test-run-certificates> ca # [2843354.286046] ca acme-order-renew-ca.foo-start[301]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> ca # [2843354.287064] ca acme-order-renew-ca.foo-start[301]: + chown -R acme:nginx certificates container-test-run-certificates> ca # [2843354.288509] ca acme-order-renew-ca.foo-start[301]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> ca # [2843354.406526] ca systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> ca # [2843354.408879] ca systemd[1]: acme-order-renew-ca.foo.service: Deactivated successfully. container-test-run-certificates> ca # [2843354.408986] ca systemd[1]: Finished Order (and renew) ACME certificate for ca.foo. container-test-run-certificates> ca # [2843355.033671] ca nginx[352]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [2843355.033853] ca nginx[352]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca: (finished: waiting for unit step-ca.service, in 6.14 seconds) container-test-run-certificates> ca: waiting for file '/var/lib/acme/ca.foo/fullchain.pem' container-test-run-certificates> ca: (finished: waiting for file '/var/lib/acme/ca.foo/fullchain.pem', in 0.00 seconds) container-test-run-certificates> ca: must succeed: systemctl restart nginx.service container-test-run-certificates> ca # [2843355.665553] ca systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> ca # [2843355.665706] ca systemd[1]: Startup finished in 5.497s. container-test-run-certificates> ca # [2843356.053825] ca systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> ca # [2843356.103131] ca systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> ca # [2843356.103285] ca systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> ca # [2843356.103302] ca systemd[1]: nginx.service: Consumed 2.494s CPU time over 3.252s wall clock time. container-test-run-certificates> ca # [2843356.104710] ca systemd[1]: Starting Nginx Web Server... container-test-run-certificates> ca: (finished: must succeed: systemctl restart nginx.service, in 0.69 seconds) container-test-run-certificates> server: systemd-nspawn running (pid 445) container-test-run-certificates> server: Waiting for journal at /build/vm-state-server/var/log/journal... container-test-run-certificates> client: systemd-nspawn running (pid 448) container-test-run-certificates> client: Waiting for journal at /build/vm-state-client/var/log/journal... container-test-run-certificates> server: waiting for file '/var/lib/acme/test.foo/fullchain.pem' container-test-run-certificates> nixos-nspawn(client): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(client): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> nixos-nspawn(server): TAP vde-tap1 not found; container will be isolated from VDE container-test-run-certificates> nixos-nspawn(server): A common reason for this is that /dev/net is not available in the Nix sandbox. Try adding /dev/net to extra-sandbox-paths. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> Note: in a future version of systemd-nspawn the default set of permitted socket address families will be restricted to AF_INET, AF_INET6 and AF_UNIX. Use --restrict-address-families= to configure the set of permitted socket address families, or set RestrictAddressFamilies= in a .nspawn file. container-test-run-certificates> ░ Spawning container server on /build/vm-state-server. container-test-run-certificates> ░ Spawning container client on /build/vm-state-client. container-test-run-certificates> ca # [2843356.732582] ca nginx-pre-start[376]: nginx: the configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf syntax is ok container-test-run-certificates> ca # [2843356.732798] ca nginx-pre-start[376]: nginx: configuration file /nix/store/ida2iff94jz18kiyicmh6cj8qk1j24fw-nginx.conf test is successful container-test-run-certificates> ca # [2843356.735798] ca systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [2843357.231524] server systemd-journald[72]: Journal started container-test-run-certificates> server # [2843357.231554] server systemd-journald[72]: Runtime Journal (/run/log/journal/8803b800d1f34cceafa82e1a7922529e) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> server # [2843357.234844] server systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> server # [2843357.241710] server systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> server # [2843357.249271] server systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> server # [2843357.249605] server systemd[1]: Starting Network Name Resolution... container-test-run-certificates> server # [2843357.249911] server systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> server # [2843357.274249] server systemd-journald[72]: Time spent on flushing to /var/log/journal/8803b800d1f34cceafa82e1a7922529e is 1.289ms for 7 entries. container-test-run-certificates> server # [2843357.274249] server systemd-journald[72]: System Journal (/var/log/journal/8803b800d1f34cceafa82e1a7922529e) is 8M, max 4G, 3.9G free. container-test-run-certificates> server # [2843357.286787] server systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> server # [2843357.286979] server systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> server # [2843357.287723] server systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> server # [2843357.287774] server systemd[1]: Reached target Local File Systems. container-test-run-certificates> server # [2843357.288191] server systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> server # [2843357.288217] server systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [2843357.288573] server systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> server # [2843357.288891] server systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> server # [2843357.288905] server systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> server # [2843357.298738] server systemd-tmpfiles[152]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> server # [2843357.298887] server systemd-tmpfiles[152]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> server # [2843357.298985] server systemd-tmpfiles[152]: fchmod() of /var/log/journal/8803b800d1f34cceafa82e1a7922529e failed: Operation not permitted container-test-run-certificates> server # [2843357.299134] server systemd-tmpfiles[152]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> server # [2843357.300067] server systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> server # [2843357.300709] server systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> server # [2843357.301251] server systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> server # [2843357.317871] server systemd[1]: Finished Firewall. container-test-run-certificates> server # [2843357.318936] server systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> server # [2843357.319724] server systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> server # [2843357.320380] server systemd[1]: Reached target Preparation for Network. container-test-run-certificates> server # [2843357.320591] server systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> server # [2843357.321378] server systemd[1]: Starting Network Management... container-test-run-certificates> server # [2843357.321960] server systemd[1]: Starting Update is Completed... container-test-run-certificates> server # [2843357.327963] server systemd[1]: Finished Update is Completed. container-test-run-certificates> server # [2843357.337350] server systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [2843357.229635] client systemd-journald[72]: Journal started container-test-run-certificates> client # [2843357.229673] client systemd-journald[72]: Runtime Journal (/run/log/journal/c8d658aabc954019af72b3cb46161eaa) is 8M, max 3.7G, 3.7G free. container-test-run-certificates> client # [2843357.236167] client systemd[1]: Finished Apply Kernel Variables. container-test-run-certificates> client # [2843357.243087] client systemd[1]: Finished Create Static Device Nodes in /dev gracefully. container-test-run-certificates> client # [2843357.250881] client systemd[1]: Starting Flush Journal to Persistent Storage... container-test-run-certificates> client # [2843357.271172] client systemd[1]: Starting Network Name Resolution... container-test-run-certificates> client # [2843357.271603] client systemd[1]: Starting Create Static Device Nodes in /dev... container-test-run-certificates> client # [2843357.274900] client systemd-journald[72]: Time spent on flushing to /var/log/journal/c8d658aabc954019af72b3cb46161eaa is 1.101ms for 7 entries. container-test-run-certificates> client # [2843357.274900] client systemd-journald[72]: System Journal (/var/log/journal/c8d658aabc954019af72b3cb46161eaa) is 8M, max 4G, 3.9G free. container-test-run-certificates> client # [2843357.289654] client systemd[1]: Finished Flush Journal to Persistent Storage. container-test-run-certificates> client # [2843357.289821] client systemd[1]: Finished Create Static Device Nodes in /dev. container-test-run-certificates> client # [2843357.290451] client systemd[1]: Reached target Preparation for Local File Systems. container-test-run-certificates> client # [2843357.290492] client systemd[1]: Reached target Local File Systems. container-test-run-certificates> client # [2843357.290883] client systemd[1]: Listening on Boot Loader Control Service Socket. container-test-run-certificates> client # [2843357.290912] client systemd[1]: Update Boot Loader Random Seed skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [2843357.291218] client systemd[1]: Starting Save Transient machine-id to Disk... container-test-run-certificates> client # [2843357.291484] client systemd[1]: Starting Create System Files and Directories... container-test-run-certificates> client # [2843357.291497] client systemd[1]: Rule-based Manager for Device Events and Files skipped, unmet condition check ConditionPathIsReadWrite=/sys container-test-run-certificates> client # [2843357.300591] client systemd-tmpfiles[154]: Cannot set file attributes for '/var/empty', value=0x00000010, mask=0x00000010, ignoring: Operation not permitted container-test-run-certificates> client # [2843357.300735] client systemd-tmpfiles[154]: fchmod() of /var/log/journal failed: Operation not permitted container-test-run-certificates> client # [2843357.300834] client systemd-tmpfiles[154]: fchmod() of /var/log/journal/c8d658aabc954019af72b3cb46161eaa failed: Operation not permitted container-test-run-certificates> client # [2843357.300979] client systemd-tmpfiles[154]: fchmod() of /run/log/journal failed: Operation not permitted container-test-run-certificates> client # [2843357.304088] client systemd[1]: Finished Create System Files and Directories. container-test-run-certificates> client # [2843357.304672] client systemd[1]: Starting Rebuild Journal Catalog... container-test-run-certificates> client # [2843357.304985] client systemd[1]: Starting Record System Boot/Shutdown in UTMP... container-test-run-certificates> client # [2843357.316293] client systemd[1]: Finished Firewall. container-test-run-certificates> client # [2843357.316479] client systemd[1]: Reached target Preparation for Network. container-test-run-certificates> client # [2843357.316677] client systemd[1]: Listening on Network Management Resolve Hook Socket. container-test-run-certificates> client # [2843357.317130] client systemd[1]: Starting Network Management... container-test-run-certificates> client # [2843357.318755] client systemd[1]: Finished Record System Boot/Shutdown in UTMP. container-test-run-certificates> client # [2843357.318860] client systemd[1]: Finished Rebuild Journal Catalog. container-test-run-certificates> client # [2843357.319916] client systemd[1]: Starting Update is Completed... container-test-run-certificates> client # [2843357.325507] client systemd[1]: Finished Update is Completed. container-test-run-certificates> client # [2843357.337884] client systemd[1]: Finished Save Transient machine-id to Disk. container-test-run-certificates> client # [2843357.799272] client systemd-networkd[181]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [2843357.799339] client systemd-networkd[181]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> client # [2843357.807020] client systemd-networkd[181]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [2843357.807166] client systemd-networkd[181]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> client # [2843357.807234] client systemd-networkd[181]: lo: Link UP container-test-run-certificates> client # [2843357.807237] client systemd-networkd[181]: lo: Gained carrier container-test-run-certificates> client # [2843357.807358] client systemd-networkd[181]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> client # [2843357.807581] client systemd[1]: Started Network Management. container-test-run-certificates> client # [2843357.807625] client systemd-networkd[181]: eth1: Link UP container-test-run-certificates> client # [2843357.807738] client systemd-networkd[181]: eth1: Gained carrier container-test-run-certificates> client # [2843357.818160] client systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> client # [2843357.829303] client systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> server # [2843357.797222] server systemd-networkd[187]: Failed to increase receive buffer size for general netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [2843357.797296] server systemd-networkd[187]: Failed to increase receive buffer size for nftables netlink socket, ignoring: Operation not permitted container-test-run-certificates> server # [2843357.804774] server systemd-networkd[187]: /etc/systemd/network/99-ethernet-default-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [2843357.804916] server systemd-networkd[187]: /etc/systemd/network/99-wireless-client-dhcp.network: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add Name=* in the [Match] section. container-test-run-certificates> server # [2843357.804986] server systemd-networkd[187]: lo: Link UP container-test-run-certificates> server # [2843357.804988] server systemd-networkd[187]: lo: Gained carrier container-test-run-certificates> server # [2843357.805139] server systemd-networkd[187]: eth1: Configuring with /etc/systemd/network/40-eth1.network. container-test-run-certificates> server # [2843357.805370] server systemd[1]: Started Network Management. container-test-run-certificates> server # [2843357.805410] server systemd-networkd[187]: eth1: Link UP container-test-run-certificates> server # [2843357.805527] server systemd-networkd[187]: eth1: Gained carrier container-test-run-certificates> server # [2843357.806056] server systemd[1]: Starting Enable Persistent Storage in systemd-networkd... container-test-run-certificates> server # [2843357.829304] server systemd[1]: Finished Enable Persistent Storage in systemd-networkd. container-test-run-certificates> client # [2843358.160439] client systemd-resolved[110]: Positive Trust Anchors: container-test-run-certificates> client # [2843358.160446] client systemd-resolved[110]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> client # [2843358.160449] client systemd-resolved[110]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> client # [2843358.160465] client systemd-resolved[110]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> client # [2843358.170659] client systemd-resolved[110]: Using system hostname 'client'. container-test-run-certificates> client # [2843358.171459] client systemd[1]: Started Network Name Resolution. container-test-run-certificates> client # [2843358.171499] client systemd[1]: Reached target Network. container-test-run-certificates> client # [2843358.171531] client systemd[1]: Reached target System Initialization. container-test-run-certificates> client # [2843358.171558] client systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> client # [2843358.171575] client systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> client # [2843358.171584] client systemd[1]: Reached target Timer Units. container-test-run-certificates> client # [2843358.171656] client systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> client # [2843358.171721] client systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> client # [2843358.171806] client systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> client # [2843358.171818] client systemd[1]: Reached target Socket Units. container-test-run-certificates> client # [2843358.171837] client systemd[1]: Reached target Basic System. container-test-run-certificates> client # [2843358.172457] client systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> client # [2843358.172844] client systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> client # [2843358.173415] client systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> client # [2843358.210134] client systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> client # [2843358.230482] client systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> client # [2843358.325105] client nsncd[192]: Oct 07 05:06:12.748 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> client # [2843358.325137] client systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> client # [2843358.325177] client systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> client # [2843358.325210] client systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> client # [2843358.325953] client systemd[1]: Starting User Login Management... container-test-run-certificates> client # [2843358.326339] client systemd[1]: Starting Permit User Sessions... container-test-run-certificates> client # [2843358.331978] client systemd[1]: Finished Permit User Sessions. container-test-run-certificates> client # [2843358.332485] client systemd[1]: Started Console Getty. container-test-run-certificates> client # [2843358.332505] client systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> client # [2843358.332515] client systemd[1]: Reached target Login Prompts. container-test-run-certificates> client # [2843358.423041] client dbus-broker-launch[193]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> client # [2843358.423507] client dbus-broker-launch[193]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> client # [2843358.423507] client dbus-broker-launch[193]: Invalid user-name in /nix/store/nnivh8i0fvyhb4r4rj6a70snas6kdx1y-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [2843358.169628] server systemd-resolved[108]: Positive Trust Anchors: container-test-run-certificates> server # [2843358.169633] server systemd-resolved[108]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d container-test-run-certificates> server # [2843358.169637] server systemd-resolved[108]: . IN DS 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 container-test-run-certificates> server # [2843358.169653] server systemd-resolved[108]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 170.0.0.192.in-addr.arpa 171.0.0.192.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa ipv4only.arpa resolver.arpa corp home internal intranet lan local private test container-test-run-certificates> server # [2843358.179937] server systemd-resolved[108]: Using system hostname 'server'. container-test-run-certificates> server # [2843358.180833] server systemd[1]: Started Network Name Resolution. container-test-run-certificates> server # [2843358.180890] server systemd[1]: Reached target Network. container-test-run-certificates> server # [2843358.180918] server systemd[1]: Reached target Network is Online. container-test-run-certificates> server # [2843358.180940] server systemd[1]: Reached target System Initialization. container-test-run-certificates> server # [2843358.181089] server systemd[1]: Started Renew ACME Certificate for test.foo. container-test-run-certificates> server # [2843358.181110] server systemd[1]: Discard unused filesystem blocks once a week skipped, unmet condition check ConditionVirtualization=!container container-test-run-certificates> server # [2843358.181123] server systemd[1]: Started Daily Cleanup of Temporary Directories. container-test-run-certificates> server # [2843358.181133] server systemd[1]: Reached target Timer Units. container-test-run-certificates> server # [2843358.181207] server systemd[1]: Listening on D-Bus System Message Bus Socket. container-test-run-certificates> server # [2843358.181263] server systemd[1]: Listening on Nix Daemon Socket. container-test-run-certificates> server # [2843358.181331] server systemd[1]: Listening on Virtual Machine and Container Registration Service Socket. container-test-run-certificates> server # [2843358.181340] server systemd[1]: Reached target Socket Units. container-test-run-certificates> server # [2843358.181358] server systemd[1]: Reached target Basic System. container-test-run-certificates> server # [2843358.201567] server systemd[1]: Starting Set up the ACME certificate renewal infrastructure... container-test-run-certificates> server # [2843358.202017] server systemd[1]: Starting Import lastlog data into lastlog2 database... container-test-run-certificates> server # [2843358.202039] server systemd[1]: nginx-config-reload.service skipped, unmet condition check ConditionPathExists=/var/lib/acme/test.foo/fullchain.pem container-test-run-certificates> server # [2843358.202489] server systemd[1]: Starting Name Service Cache Daemon (nsncd)... container-test-run-certificates> server # [2843358.203194] server systemd[1]: Starting D-Bus System Message Bus... container-test-run-certificates> server # [2843358.211804] server systemd[1]: Finished Import lastlog data into lastlog2 database. container-test-run-certificates> server # [2843358.230593] server systemd[1]: etc-machine\x2did.mount: Deactivated successfully. container-test-run-certificates> server # [2843358.298599] server acme-setup-privileged[195]: + set -euo pipefail container-test-run-certificates> server # [2843358.298599] server acme-setup-privileged[195]: + cd /var/lib/acme container-test-run-certificates> server # [2843358.298599] server acme-setup-privileged[195]: + chmod -R u=rwX,g=,o= .lego/accounts container-test-run-certificates> server # [2843358.299457] server acme-setup-privileged[195]: + chown -R acme .lego/accounts container-test-run-certificates> server # [2843358.300292] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [2843358.300292] server acme-setup-privileged[195]: + '[' -d test.foo ']' container-test-run-certificates> server # [2843358.300341] server acme-setup-privileged[195]: + for fixpath in test.foo .lego/test.foo container-test-run-certificates> server # [2843358.300341] server acme-setup-privileged[195]: + '[' -d .lego/test.foo ']' container-test-run-certificates> server # [2843358.314530] server systemd[1]: Started Name Service Cache Daemon (nsncd). container-test-run-certificates> server # [2843358.314579] server nsncd[197]: Oct 07 05:06:12.737 INFO started, config: Config { ignored_request_types: {}, worker_count: 8, handoff_timeout: 10s }, path: "/var/run/nscd/socket" container-test-run-certificates> server # [2843358.314565] server systemd[1]: Reached target Host and Network Name Lookups. container-test-run-certificates> server # [2843358.314596] server systemd[1]: Reached target User and Group Name Lookups. container-test-run-certificates> server # [2843358.316141] server systemd[1]: Starting User Login Management... container-test-run-certificates> server # [2843358.316530] server systemd[1]: Starting Permit User Sessions... container-test-run-certificates> server # [2843358.322126] server systemd[1]: Finished Permit User Sessions. container-test-run-certificates> server # [2843358.322541] server systemd[1]: Started Console Getty. container-test-run-certificates> server # [2843358.322559] server systemd[1]: Getty on tty1 skipped, unmet condition check ConditionPathExists=/dev/tty0 container-test-run-certificates> server # [2843358.322568] server systemd[1]: Reached target Login Prompts. container-test-run-certificates> server # [2843358.425079] server dbus-broker-launch[198]: Looking up NSS user entry for 'systemd-timesync'... container-test-run-certificates> server # [2843358.425451] server dbus-broker-launch[198]: NSS returned no entry for 'systemd-timesync' container-test-run-certificates> server # [2843358.425451] server dbus-broker-launch[198]: Invalid user-name in /nix/store/z0d64q8chnmjqdlbzb043chi9x35wxn5-system-path/share/dbus-1/system.d/org.freedesktop.timesync1.conf +16: user="systemd-timesync" container-test-run-certificates> server # [2843358.425670] server systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> server # [2843358.429072] server dbus-broker-launch[198]: Ready container-test-run-certificates> client # [2843358.423803] client systemd[1]: Started D-Bus System Message Bus. container-test-run-certificates> client # [2843358.427411] client dbus-broker-launch[193]: Ready container-test-run-certificates> server # [2843358.864769] server systemd-logind[222]: New seat seat0. container-test-run-certificates> server # [2843358.864899] server systemd[1]: Started User Login Management. container-test-run-certificates> server # [2843358.865693] server systemd[1]: Starting linger-users.service... container-test-run-certificates> server # [2843358.894088] server systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> server # [2843358.894165] server systemd[1]: Finished linger-users.service. container-test-run-certificates> server # [2843358.921133] server acme-setup-start[211]: + set -euo pipefail container-test-run-certificates> server # [2843358.921133] server acme-setup-start[211]: + test -e ca/key.pem container-test-run-certificates> server # [2843358.921397] server acme-setup-start[211]: + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains selfsigned.local container-test-run-certificates> server # [2843358.928446] server systemd[1]: Finished Set up the ACME certificate renewal infrastructure. container-test-run-certificates> server # [2843358.929306] server systemd[1]: Starting Ensure certificate for test.foo... container-test-run-certificates> client # [2843358.868737] client systemd-logind[208]: New seat seat0. container-test-run-certificates> client # [2843358.868840] client systemd[1]: Started User Login Management. container-test-run-certificates> client # [2843358.889195] client systemd[1]: Starting linger-users.service... container-test-run-certificates> client # [2843358.895641] client systemd[1]: linger-users.service: Deactivated successfully. container-test-run-certificates> client # [2843358.895720] client systemd[1]: Finished linger-users.service. container-test-run-certificates> client # [2843358.896010] client systemd[1]: Reached target Multi-User System. container-test-run-certificates> client # [2843358.896101] client systemd[1]: Startup finished in 1.906s. container-test-run-certificates> client # [2843359.040093] client systemd-networkd[181]: eth1: Gained IPv6LL container-test-run-certificates> server # [2843359.232113] server systemd-networkd[187]: eth1: Gained IPv6LL container-test-run-certificates> server # [2843359.547260] server acme-test.foo-start[248]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [2843359.548831] server acme-test.foo-start[248]: + '[' -e out/acme-success ']' container-test-run-certificates> server # [2843359.548872] server acme-test.foo-start[248]: + minica --ca-cert=ca/cert.pem --ca-key=ca/key.pem --domains=test.foo --ip-addresses= container-test-run-certificates> server # [2843359.553485] server acme-test.foo-start[258]: + cd test.foo container-test-run-certificates> server # [2843359.553707] server acme-test.foo-start[258]: + cp -vp cert.pem ../out/cert.pem container-test-run-certificates> server # [2843359.554623] server acme-test.foo-start[259]: 'cert.pem' -> '../out/cert.pem' container-test-run-certificates> server # [2843359.554768] server acme-test.foo-start[258]: + cp -vp key.pem ../out/key.pem container-test-run-certificates> server # [2843359.555494] server acme-test.foo-start[258]: 'key.pem' -> '../out/key.pem' container-test-run-certificates> server # [2843359.555628] server acme-test.foo-start[248]: + cat out/cert.pem ca/cert.pem container-test-run-certificates> server # [2843359.556437] server acme-test.foo-start[248]: + cp ca/cert.pem out/chain.pem container-test-run-certificates> server # [2843359.557236] server acme-test.foo-start[248]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [2843359.558042] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [2843359.558056] server acme-test.foo-start[248]: + '[' -d out ']' container-test-run-certificates> server # [2843359.558056] server acme-test.foo-start[248]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [2843359.558847] server acme-test.foo-start[248]: + chown -R acme:nginx out container-test-run-certificates> server # [2843359.560123] server acme-test.foo-start[248]: + for fixpath in out certificates container-test-run-certificates> server # [2843359.560135] server acme-test.foo-start[248]: + '[' -d certificates ']' container-test-run-certificates> server # [2843359.561938] server systemd[1]: Finished Ensure certificate for test.foo. container-test-run-certificates> server # [2843359.562674] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server # [2843360.185306] server nginx-pre-start[270]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [2843360.185500] server nginx-pre-start[270]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [2843360.188482] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> server # [2843360.188682] server systemd[1]: Reached target Multi-User System. container-test-run-certificates> server # [2843360.189251] server systemd[1]: Starting Order (and renew) ACME certificate for test.foo... container-test-run-certificates> server # [2843360.807417] server acme-order-renew-test.foo-start[273]: Waiting to acquire lock in /run/acme/ container-test-run-certificates> server # [2843360.809179] server acme-order-renew-test.foo-start[273]: + set -euo pipefail container-test-run-certificates> server # [2843360.809227] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [2843360.809257] server acme-order-renew-test.foo-start[273]: + /nix/store/gjqnd9dw8svgcfhb6lvqrjy5hd6gxfqm-flock-0.4.0/bin/flock 11 container-test-run-certificates> server # [2843360.810019] server acme-order-renew-test.foo-start[285]: ++ find accounts -path '*/keys/*.key' -print -quit container-test-run-certificates> server # [2843360.811408] server acme-order-renew-test.foo-start[273]: + '[' -n '' ']' container-test-run-certificates> server # [2843360.811446] server acme-order-renew-test.foo-start[273]: + exec container-test-run-certificates> server # [2843360.811472] server acme-order-renew-test.foo-start[273]: + '[' -e certificates/test.foo.key ']' container-test-run-certificates> server # [2843360.811489] server acme-order-renew-test.foo-start[273]: + lego run --accept-tos --path . --email none@none.tld --http --http.webroot /var/lib/acme/acme-challenge --server https://ca.foo/acme/acme/directory --key-type ec256 -d test.foo --no-random-sleep --renew-force --ari-disable --force-cert-domains container-test-run-certificates> server # [2843360.821872] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.245184185Z INFO Private key saved. filepath=accounts/ca.foo/none@none.tld/none@none.tld.key container-test-run-certificates> server # [2843360.836832] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.260159823Z INFO Registering the account. email=none@none.tld container-test-run-certificates> server # [2843360.839706] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.263038966Z WARN !!!! HEADS UP !!!! container-test-run-certificates> server # [2843360.839706] server acme-order-renew-test.foo-start[286]: Your account credentials have been saved in your container-test-run-certificates> server # [2843360.839706] server acme-order-renew-test.foo-start[286]: configuration directory at "accounts". container-test-run-certificates> server # [2843360.839706] server acme-order-renew-test.foo-start[286]: You should make a secure backup of this folder now. This container-test-run-certificates> server # [2843360.839706] server acme-order-renew-test.foo-start[286]: configuration directory will also contain private keys container-test-run-certificates> server # [2843360.839706] server acme-order-renew-test.foo-start[286]: generated by lego and certificates obtained from the ACME container-test-run-certificates> server # [2843360.839706] server acme-order-renew-test.foo-start[286]: server. Making regular backups of this folder is ideal. container-test-run-certificates> server # [2843360.839788] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.263090824Z INFO Obtaining bundled SAN certificate. domains=test.foo container-test-run-certificates> server # [2843360.899640] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.322959322Z INFO Use solver. domain=test.foo type=http-01 container-test-run-certificates> server # [2843360.899640] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.322974971Z INFO http01: Trying to solve HTTP-01. domain=test.foo container-test-run-certificates> server # [2843360.901894] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.325224238Z INFO The server validated our request. domain=test.foo container-test-run-certificates> server # [2843360.901927] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.325262179Z INFO Validations succeeded; requesting certificates. domains=test.foo container-test-run-certificates> server # [2843360.905736] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.329068529Z INFO Server responded with a certificate. domains=test.foo container-test-run-certificates> server # [2843360.905760] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.329097313Z INFO Writing file. filepath=certificates/test.foo.crt container-test-run-certificates> server # [2843360.905805] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.329140675Z INFO Writing file. filepath=certificates/test.foo.issuer.crt container-test-run-certificates> server # [2843360.905823] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.329160512Z INFO Writing file. filepath=certificates/test.foo.key container-test-run-certificates> server # [2843360.905860] server acme-order-renew-test.foo-start[286]: 2026-10-07T05:06:15.329196220Z INFO Writing file. filepath=certificates/test.foo.json container-test-run-certificates> server # [2843360.908858] server acme-order-renew-test.foo-start[273]: + touch out/acme-success container-test-run-certificates> server # [2843360.909736] server acme-order-renew-test.foo-start[273]: + cmp -s certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [2843360.910331] server acme-order-renew-test.foo-start[273]: + touch out/renewed container-test-run-certificates> server # [2843360.911255] server acme-order-renew-test.foo-start[273]: + echo Installing new certificate container-test-run-certificates> server # [2843360.911255] server acme-order-renew-test.foo-start[273]: Installing new certificate container-test-run-certificates> server # [2843360.911282] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.crt out/fullchain.pem container-test-run-certificates> server # [2843360.911946] server acme-order-renew-test.foo-start[306]: 'certificates/test.foo.crt' -> 'out/fullchain.pem' container-test-run-certificates> server # [2843360.912080] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.key out/key.pem container-test-run-certificates> server # [2843360.912738] server acme-order-renew-test.foo-start[307]: 'certificates/test.foo.key' -> 'out/key.pem' container-test-run-certificates> server # [2843360.912854] server acme-order-renew-test.foo-start[273]: + cp -vp certificates/test.foo.issuer.crt out/chain.pem container-test-run-certificates> server # [2843360.913498] server acme-order-renew-test.foo-start[308]: 'certificates/test.foo.issuer.crt' -> 'out/chain.pem' container-test-run-certificates> server # [2843360.913628] server acme-order-renew-test.foo-start[273]: + ln -sf fullchain.pem out/cert.pem container-test-run-certificates> server # [2843360.914362] server acme-order-renew-test.foo-start[273]: + cat out/key.pem out/fullchain.pem container-test-run-certificates> server # [2843360.915212] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [2843360.915224] server acme-order-renew-test.foo-start[273]: + '[' -d out ']' container-test-run-certificates> server # [2843360.915224] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= out container-test-run-certificates> server # [2843360.915952] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx out container-test-run-certificates> server # [2843360.917400] server acme-order-renew-test.foo-start[273]: + for fixpath in out certificates container-test-run-certificates> server # [2843360.917411] server acme-order-renew-test.foo-start[273]: + '[' -d certificates ']' container-test-run-certificates> server # [2843360.917421] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=rX,o= certificates container-test-run-certificates> server # [2843360.918179] server acme-order-renew-test.foo-start[273]: + chown -R acme:nginx certificates container-test-run-certificates> server # [2843360.919265] server acme-order-renew-test.foo-start[273]: + chmod -R u=rwX,g=,o= accounts/. container-test-run-certificates> server # [2843361.025511] server systemd[1]: Reloading Nginx Web Server... container-test-run-certificates> server # [2843361.027877] server systemd[1]: acme-order-renew-test.foo.service: Deactivated successfully. container-test-run-certificates> server # [2843361.028018] server systemd[1]: Finished Order (and renew) ACME certificate for test.foo. container-test-run-certificates> ca # [2843360.836552] ca step-ca[207]: time="2026-10-07T05:06:15Z" level=info duration="35.827µs" duration-ns=35827 fields.time="2026-10-07T05:06:15Z" method=GET name=ca path=/acme/acme/directory protocol=HTTP/1.1 referer= remote-address="::1" request-id=56e70685-d965-4ecb-a20e-93f6fafc026b response="{\"newNonce\":\"https://ca.foo/acme/acme/new-nonce\",\"newAccount\":\"https://ca.foo/acme/acme/new-account\",\"newOrder\":\"https://ca.foo/acme/acme/new-order\",\"revokeCert\":\"https://ca.foo/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.foo/acme/acme/key-change\"}" size=252 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843360.838180] ca step-ca[207]: time="2026-10-07T05:06:15Z" level=info duration="633.303µs" duration-ns=633303 fields.time="2026-10-07T05:06:15Z" method=HEAD name=ca nonce=NTNiYVVFaWo4Y0ptd3R5N2dVREhtdFVaOGZ4MXI4Um4 path=/acme/acme/new-nonce protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=3b6542f2-4018-4d4a-8d8a-eeb87acbe543 size=0 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843360.839546] ca step-ca[207]: time="2026-10-07T05:06:15Z" level=info duration="604.499µs" duration-ns=604499 fields.time="2026-10-07T05:06:15Z" method=POST name=ca nonce=bmJYaVJuQ1NxT3Q2dmM5OXdoNk9pblVDU0JWQlVENEc path=/acme/acme/new-account protocol=HTTP/1.1 referer= remote-address="::1" request-id=59ceecad-b711-48df-bff7-697220f843c7 response="{\"contact\":[\"mailto:none@none.tld\"],\"status\":\"valid\",\"orders\":\"https://ca.foo/acme/acme/account/vmvPZ0z6Qwiglzoz0fDvDTsjVNqiarN8/orders\"}" size=138 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843360.841605] ca step-ca[207]: time="2026-10-07T05:06:15Z" level=info duration=1.261186ms duration-ns=1261186 fields.time="2026-10-07T05:06:15Z" method=POST name=ca nonce=d2h4aHlXRU40dDNZUnd1MkVGMGdrZ2t2Y01ZRHdFbWg path=/acme/acme/new-order protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=186cd6e9-b094-4db5-aa8d-77dbb66e2ec1 response="{\"id\":\"Npj0hlfWy5BQvasHTbD6DZJDaYIcDm7K\",\"status\":\"pending\",\"expires\":\"2026-10-08T05:06:15Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-07T05:05:15Z\",\"notAfter\":\"2027-01-05T05:06:15Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/3XFWSFxAgCIcAZx7f5JPzhejSBWqvOVH\"],\"finalize\":\"https://ca.foo/acme/acme/order/Npj0hlfWy5BQvasHTbD6DZJDaYIcDm7K/finalize\"}" size=384 status=201 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843360.899406] ca step-ca[207]: time="2026-10-07T05:06:15Z" level=info duration="548.053µs" duration-ns=548053 fields.time="2026-10-07T05:06:15Z" method=POST name=ca nonce=NUt0VDR2TUhOWmt6aTJhc0dOME9yanZwbDNXYTI2cGs path=/acme/acme/authz/3XFWSFxAgCIcAZx7f5JPzhejSBWqvOVH protocol=HTTP/1.1 referer= remote-address="::1" request-id=4b08e713-11ca-4e2f-ad96-06620c13c15b response="{\"identifier\":{\"type\":\"dns\",\"value\":\"test.foo\"},\"status\":\"pending\",\"challenges\":[{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"GQnBBdEq9QZeMFFSGufXDUV5Ru4iG7o9\",\"url\":\"https://ca.foo/acme/acme/challenge/3XFWSFxAgCIcAZx7f5JPzhejSBWqvOVH/hDp2f4u9yn6n08qNRSzACDT47jiONP4C\"},{\"type\":\"http-01\",\"status\":\"pending\",\"token\":\"GQnBBdEq9QZeMFFSGufXDUV5Ru4iG7o9\",\"url\":\"https://ca.foo/acme/acme/challenge/3XFWSFxAgCIcAZx7f5JPzhejSBWqvOVH/Jr7CoVmTAPhuGGvDF5Uwq5we9NCAW6Rx\"},{\"type\":\"tls-alpn-01\",\"status\":\"pending\",\"token\":\"GQnBBdEq9QZeMFFSGufXDUV5Ru4iG7o9\",\"url\":\"https://ca.foo/acme/acme/challenge/3XFWSFxAgCIcAZx7f5JPzhejSBWqvOVH/z0OJiBLwikhInCtnPhtd5CrEMpiCSDSN\"}],\"wildcard\":false,\"expires\":\"2026-10-08T05:06:15Z\"}" size=706 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843360.901724] ca step-ca[207]: time="2026-10-07T05:06:15Z" level=info duration=1.35908ms duration-ns=1359080 fields.time="2026-10-07T05:06:15Z" method=POST name=ca nonce=NVZoM2hVQ2dlYmJaZEZoUERTc2VkbzJqYVNScDU0ZDc path=/acme/acme/challenge/3XFWSFxAgCIcAZx7f5JPzhejSBWqvOVH/Jr7CoVmTAPhuGGvDF5Uwq5we9NCAW6Rx protocol=HTTP/1.1 referer= remote-address=127.0.0.1 request-id=758dbab4-fbee-4659-93b8-774080567d3b response="{\"type\":\"http-01\",\"status\":\"valid\",\"token\":\"GQnBBdEq9QZeMFFSGufXDUV5Ru4iG7o9\",\"validated\":\"2026-10-07T05:06:15Z\",\"url\":\"https://ca.foo/acme/acme/challenge/3XFWSFxAgCIcAZx7f5JPzhejSBWqvOVH/Jr7CoVmTAPhuGGvDF5Uwq5we9NCAW6Rx\"}" size=223 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843360.904471] ca step-ca[207]: time="2026-10-07T05:06:15Z" level=info duration=1.734066ms duration-ns=1734066 fields.time="2026-10-07T05:06:15Z" method=POST name=ca nonce=OE82VFpydlJ0NEl1OFpucEJjeEUwdXRkYWpHWEFtZ3E path=/acme/acme/order/Npj0hlfWy5BQvasHTbD6DZJDaYIcDm7K/finalize protocol=HTTP/1.1 referer= remote-address="::1" request-id=eda95950-6b86-4200-b07f-3664e362d6dc response="{\"id\":\"Npj0hlfWy5BQvasHTbD6DZJDaYIcDm7K\",\"status\":\"valid\",\"expires\":\"2026-10-08T05:06:15Z\",\"identifiers\":[{\"type\":\"dns\",\"value\":\"test.foo\"}],\"notBefore\":\"2026-10-07T05:05:15Z\",\"notAfter\":\"2027-01-05T05:06:15Z\",\"authorizations\":[\"https://ca.foo/acme/acme/authz/3XFWSFxAgCIcAZx7f5JPzhejSBWqvOVH\"],\"finalize\":\"https://ca.foo/acme/acme/order/Npj0hlfWy5BQvasHTbD6DZJDaYIcDm7K/finalize\",\"certificate\":\"https://ca.foo/acme/acme/certificate/zYnwuXvfr263VPojIrQe3zTY0QRblaaX\"}" size=468 status=200 user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= container-test-run-certificates> ca # [2843360.905623] ca step-ca[207]: time="2026-10-07T05:06:15Z" level=info certificate="MIIB1zCCAX6gAwIBAgIRALzkMCX2SPgbwDBzlxXWZKYwCgYIKoZIzj0EAwIwHzEdMBsGA1UEAxMUQ2xhbiBJbnRlcm1lZGlhdGUgQ0EwHhcNMjYxMDA3MDUwNTE1WhcNMjcwMTA1MDUwNjE1WjATMREwDwYDVQQDEwh0ZXN0LmZvbzBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDV4sLllDmi8ILT/dXXk6m5W7RTKW9FO9APFZ2f2MzDo9a9PVkjE6hF/w3pZLaoI+swwjNAzjt8MH8KBPWfLmBijgaYwgaMwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUWDn4R76JC2T0pycO4Fl5GuR/p+YwHwYDVR0jBBgwFoAUBTu+iFb6KPHLm1XzKo2FUZFQSeUwEwYDVR0RBAwwCoIIdGVzdC5mb28wHQYMKwYBBAGCpGTGKEABBA0wCwIBBgQEYWNtZQQAMAoGCCqGSM49BAMCA0cAMEQCID/cBVQGRpQAIQj1KXt1Zd7IkKpy7k4sQrR/fU1xYfYNAiB7ldn2zSCfJ8MWGjypZNpfqq4uLJzML+01vP12WfVxyw==" duration="370.297µs" duration-ns=370297 fields.time="2026-10-07T05:06:15Z" issuer="Clan Intermediate CA" method=POST name=ca nonce=T1NjMWFGUW1WRDBIYlVmbGFtM2lLbVlFR0tTa1B3bm8 path=/acme/acme/certificate/zYnwuXvfr263VPojIrQe3zTY0QRblaaX protocol=HTTP/1.1 provisioner=acme public-key="ECDSA P-256" referer= remote-address=127.0.0.1 request-id=efd3921c-4352-4c8c-904f-811eca9fe377 sans="map[dns:[test.foo]]" serial=251079683454634639847043198740908631206 size=1348 status=200 subject=test.foo user-agent="lego-cli/ xenolf-acme/5.6.0 (release; linux; amd64)" user-id= valid-from="2026-10-07T05:05:15Z" valid-to="2027-01-05T05:06:15Z" container-test-run-certificates> server # [2843361.653624] server nginx[324]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [2843361.653852] server nginx[324]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server: (finished: waiting for file '/var/lib/acme/test.foo/fullchain.pem', in 5.64 seconds) container-test-run-certificates> server: must succeed: systemctl restart nginx.service container-test-run-certificates> server # [2843362.266665] server systemd[1]: Reloaded Nginx Web Server. container-test-run-certificates> server # [2843362.266837] server systemd[1]: Startup finished in 5.276s. container-test-run-certificates> server # [2843362.381642] server systemd[1]: Stopping Nginx Web Server... container-test-run-certificates> server # [2843362.430680] server systemd[1]: nginx.service: Deactivated successfully. container-test-run-certificates> server # [2843362.430818] server systemd[1]: Stopped Nginx Web Server. container-test-run-certificates> server # [2843362.430846] server systemd[1]: nginx.service: Consumed 3.620s CPU time over 2.868s wall clock time. container-test-run-certificates> server # [2843362.432327] server systemd[1]: Starting Nginx Web Server... container-test-run-certificates> server: (finished: must succeed: systemctl restart nginx.service, in 0.69 seconds) container-test-run-certificates> client: waiting for success: curl -v https://test.foo container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * connect to 2001:db8:1::3 port 443 from 2001:db8:1::2 port 53056 failed: Connection refused container-test-run-certificates> * Trying 192.168.1.3:443... container-test-run-certificates> * connect to 192.168.1.3 port 443 from 192.168.1.2 port 51054 failed: Connection refused container-test-run-certificates> * Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> * closing connection #0 container-test-run-certificates> curl: (7) Failed to connect to test.foo:443 after 1 ms: Could not connect to server container-test-run-certificates> server # [2843363.059142] server nginx-pre-start[347]: nginx: the configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf syntax is ok container-test-run-certificates> server # [2843363.059379] server nginx-pre-start[347]: nginx: configuration file /nix/store/g96ijvr54rfczli3bgg6hx8vsxnlymwr-nginx.conf test is successful container-test-run-certificates> server # [2843363.061893] server systemd[1]: Started Nginx Web Server. container-test-run-certificates> * Host test.foo:443 was resolved. container-test-run-certificates> * IPv6: 2001:db8:1::3 container-test-run-certificates> * IPv4: 192.168.1.3 container-test-run-certificates> * Trying [2001:db8:1::3]:443... container-test-run-certificates> * ALPN: curl offers h2,http/1.1 container-test-run-certificates> } [5 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Client hello (1): container-test-run-certificates> } [1554 bytes data] container-test-run-certificates> * SSL Trust Anchors: container-test-run-certificates> * OpenSSL default paths (fallback) container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Server hello (2): container-test-run-certificates> { [1210 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS change cipher, Change cipher spec (1): container-test-run-certificates> { [1 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): container-test-run-certificates> { [19 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Certificate (11): container-test-run-certificates> { [931 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, CERT verify (15): container-test-run-certificates> { [78 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Finished (20): container-test-run-certificates> { [52 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): container-test-run-certificates> } [1 bytes data] container-test-run-certificates> * TLSv1.3 (OUT), TLS handshake, Finished (20): container-test-run-certificates> } [52 bytes data] container-test-run-certificates> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey container-test-run-certificates> * ALPN: server accepted h2 container-test-run-certificates> * Server certificate: container-test-run-certificates> * subject: CN=test.foo container-test-run-certificates> * start date: Oct 7 05:05:15 2026 GMT container-test-run-certificates> * expire date: Jan 5 05:06:15 2027 GMT container-test-run-certificates> * issuer: CN=Clan Intermediate CA container-test-run-certificates> * Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * Certificate level 2: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256 container-test-run-certificates> * subjectAltName: "test.foo" matches cert's "test.foo" container-test-run-certificates> * OpenSSL verify result: 0 container-test-run-certificates> * SSL certificate verified via OpenSSL. container-test-run-certificates> * Established connection to test.foo (2001:db8:1::3 port 443) from 2001:db8:1::2 port 57444 container-test-run-certificates> % Total % Received % Xferd Average Speed Time Time Time Current container-test-run-certificates> Dload Upload Total Spent Left Speed container-test-run-certificates> 0 0 0 0 0 0 0 0 0* using HTTP/2 container-test-run-certificates> * [HTTP/2] [1] OPENED stream for https://test.foo/ container-test-run-certificates> * [HTTP/2] [1] [:method: GET] container-test-run-certificates> * [HTTP/2] [1] [:scheme: https] container-test-run-certificates> * [HTTP/2] [1] [:authority: test.foo] container-test-run-certificates> * [HTTP/2] [1] [:path: /] container-test-run-certificates> * [HTTP/2] [1] [user-agent: curl/8.22.0] container-test-run-certificates> * [HTTP/2] [1] [accept: */*] container-test-run-certificates> } [5 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> * Request completely sent off container-test-run-certificates> { [5 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): container-test-run-certificates> { [265 bytes data] container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> container-test-run-certificates> { [5 bytes data] container-test-run-certificates> 100 20 100 20 0 0 1926 0 0 container-test-run-certificates> * Connection #0 to host test.foo:443 left intact container-test-run-certificates> client: (finished: waiting for success: curl -v https://test.foo, in 1.03 seconds) container-test-run-certificates> client: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2 container-test-run-certificates> Certificate: container-test-run-certificates> Data: container-test-run-certificates> Version: 3 (0x2) container-test-run-certificates> Serial Number: container-test-run-certificates> bc:e4:30:25:f6:48:f8:1b:c0:30:73:97:15:d6:64:a6 container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Issuer: CN=Clan Intermediate CA container-test-run-certificates> Validity container-test-run-certificates> Not Before: Oct 7 05:05:15 2026 GMT container-test-run-certificates> Not After : Jan 5 05:06:15 2027 GMT container-test-run-certificates> Subject: CN=test.foo container-test-run-certificates> Subject Public Key Info: container-test-run-certificates> Public Key Algorithm: id-ecPublicKey container-test-run-certificates> Public-Key: (256 bit) container-test-run-certificates> pub: container-test-run-certificates> 04:35:78:b0:b9:65:0e:68:bc:20:b4:ff:75:75:e4: container-test-run-certificates> ea:6e:56:ed:14:ca:5b:d1:4e:f4:03:c5:67:67:f6: container-test-run-certificates> 33:30:e8:f5:af:4f:56:48:c4:ea:11:7f:c3:7a:59: container-test-run-certificates> 2d:aa:08:fa:cc:30:8c:d0:33:8e:df:0c:1f:c2:81: container-test-run-certificates> 3d:67:cb:98:18 container-test-run-certificates> ASN1 OID: prime256v1 container-test-run-certificates> NIST CURVE: P-256 container-test-run-certificates> X509v3 extensions: container-test-run-certificates> X509v3 Key Usage: critical container-test-run-certificates> Digital Signature container-test-run-certificates> X509v3 Extended Key Usage: container-test-run-certificates> TLS Web Server Authentication, TLS Web Client Authentication container-test-run-certificates> X509v3 Subject Key Identifier: container-test-run-certificates> 58:39:F8:47:BE:89:0B:64:F4:A7:27:0E:E0:59:79:1A:E4:7F:A7:E6 container-test-run-certificates> X509v3 Authority Key Identifier: container-test-run-certificates> 05:3B:BE:88:56:FA:28:F1:CB:9B:55:F3:2A:8D:85:51:91:50:49:E5 container-test-run-certificates> X509v3 Subject Alternative Name: container-test-run-certificates> DNS:test.foo container-test-run-certificates> 1.3.6.1.4.1.37476.9000.64.1: container-test-run-certificates> 0......acme.. container-test-run-certificates> Signature Algorithm: ecdsa-with-SHA256 container-test-run-certificates> Signature Value: container-test-run-certificates> 30:44:02:20:3f:dc:05:54:06:46:94:00:21:08:f5:29:7b:75: container-test-run-certificates> 65:de:c8:90:aa:72:ee:4e:2c:42:b4:7f:7d:4d:71:61:f6:0d: container-test-run-certificates> 02:20:7b:95:d9:f6:cd:20:9f:27:c3:16:1a:3c:a9:64:da:5f: container-test-run-certificates> aa:ae:2e:2c:9c:cc:2f:ed:35:bc:fd:76:59:f5:71:cb container-test-run-certificates> client: (finished: must succeed: openssl s_client -connect test.foo:443 -servername test.foo /dev/null | openssl x509 -text -noout 1>&2, in 0.02 seconds) container-test-run-certificates> (finished: run the VM test script, in 14.20 seconds) container-test-run-certificates> test script finished in 14.25s container-test-run-certificates> cleanup container-test-run-certificates> kill NspawnMachine (pid 50) container-test-run-certificates> kill NspawnMachine (pid 448) container-test-run-certificates> Container ca terminated by signal KILL. container-test-run-certificates> kill NspawnMachine (pid 445) container-test-run-certificates> Container client terminated by signal KILL. container-test-run-certificates> Container server terminated by signal KILL. container-test-run-certificates> (finished: cleanup, in 0.29 seconds)