Running vars check using Nix-based executor...
Executing shared generators...
Executing shared generator: dirk-ca
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout /output/ca-key -out /output/ca-cert -days 3650 -nodes -subj /CN=dirk-ca
-----
✓ Generated shared file: dirk-ca/ca-cert
✓ Generated shared file: dirk-ca/ca-key
✓ Shared Generator dirk-ca completed
✓ Shared generators completed
Processing machine: admin
Generator execution order: dirk-client-admin -> state-version -> wireguard-keys
Executing generator: dirk-client-admin
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout /output/key -out server.csr -nodes -subj /CN=admin.wg.test.clan -addext subjectAltName=DNS:admin.wg.test.clan
-----
+ openssl x509 -req -in server.csr -CA /input/dirk-ca/ca-cert -CAkey /input/dirk-ca/ca-key -CAcreateserial -out /output/cert -copy_extensions copyall -days 3650
Certificate request self-signature ok
subject=CN=admin.wg.test.clan
✓ Generated file: dirk-client-admin/cert
✓ Generated file: dirk-client-admin/key
✓ Generator dirk-client-admin completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine admin completed
Processing machine: ecl-alpha
Generator execution order: ecl-beacon-p2p-key -> ecl-jwt-secret -> ecl-nodekey -> state-version -> wireguard-keys
Executing generator: ecl-beacon-p2p-key
+ set -euo pipefail
+ PATH=/nix/store/2c873xsx8fnwsax6gm2hhiyhy0gln2xh-python3-3.13.13-env/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ python3 - /output
✓ Generated file: ecl-beacon-p2p-key/peer-id
✓ Generated file: ecl-beacon-p2p-key/privkey
✓ Generator ecl-beacon-p2p-key completed
Executing generator: ecl-jwt-secret
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl rand -hex 32
✓ Generated file: ecl-jwt-secret/jwt-secret
✓ Generator ecl-jwt-secret completed
Executing generator: ecl-nodekey
+ set -euo pipefail
+ PATH=/nix/store/f9796zybvcrn0wkq4jasp293bhnswi03-go-ethereum-1.17.3/bin:/nix/store/kgxafhycw2kybbqih759ykc2043qyi5j-gnused-4.9/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ devp2p key generate /output/enode.key
+ devp2p key to-enode --ip 0.0.0.0 /output/enode.key
+ sed -E 's|^enode://([0-9a-f]+)@.*|\1|'
+ tr -d '\n'
✓ Generated file: ecl-nodekey/enode.key
✓ Generated file: ecl-nodekey/enode.pub
✓ Generator ecl-nodekey completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine ecl-alpha completed
Processing machine: ecl-bravo
Generator execution order: ecl-beacon-p2p-key -> ecl-jwt-secret -> ecl-nodekey -> state-version -> wireguard-keys
Executing generator: ecl-beacon-p2p-key
+ set -euo pipefail
+ PATH=/nix/store/2c873xsx8fnwsax6gm2hhiyhy0gln2xh-python3-3.13.13-env/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ python3 - /output
✓ Generated file: ecl-beacon-p2p-key/peer-id
✓ Generated file: ecl-beacon-p2p-key/privkey
✓ Generator ecl-beacon-p2p-key completed
Executing generator: ecl-jwt-secret
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl rand -hex 32
✓ Generated file: ecl-jwt-secret/jwt-secret
✓ Generator ecl-jwt-secret completed
Executing generator: ecl-nodekey
+ set -euo pipefail
+ PATH=/nix/store/f9796zybvcrn0wkq4jasp293bhnswi03-go-ethereum-1.17.3/bin:/nix/store/kgxafhycw2kybbqih759ykc2043qyi5j-gnused-4.9/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ devp2p key generate /output/enode.key
+ devp2p key to-enode --ip 0.0.0.0 /output/enode.key
+ sed -E 's|^enode://([0-9a-f]+)@.*|\1|'
+ tr -d '\n'
✓ Generated file: ecl-nodekey/enode.key
✓ Generated file: ecl-nodekey/enode.pub
✓ Generator ecl-nodekey completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine ecl-bravo completed
Processing machine: ecl-charlie
Generator execution order: ecl-beacon-p2p-key -> ecl-jwt-secret -> ecl-nodekey -> state-version -> wireguard-keys
Executing generator: ecl-beacon-p2p-key
+ set -euo pipefail
+ PATH=/nix/store/2c873xsx8fnwsax6gm2hhiyhy0gln2xh-python3-3.13.13-env/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ python3 - /output
✓ Generated file: ecl-beacon-p2p-key/peer-id
✓ Generated file: ecl-beacon-p2p-key/privkey
✓ Generator ecl-beacon-p2p-key completed
Executing generator: ecl-jwt-secret
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl rand -hex 32
✓ Generated file: ecl-jwt-secret/jwt-secret
✓ Generator ecl-jwt-secret completed
Executing generator: ecl-nodekey
+ set -euo pipefail
+ PATH=/nix/store/f9796zybvcrn0wkq4jasp293bhnswi03-go-ethereum-1.17.3/bin:/nix/store/kgxafhycw2kybbqih759ykc2043qyi5j-gnused-4.9/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ devp2p key generate /output/enode.key
+ devp2p key to-enode --ip 0.0.0.0 /output/enode.key
+ sed -E 's|^enode://([0-9a-f]+)@.*|\1|'
+ tr -d '\n'
✓ Generated file: ecl-nodekey/enode.key
✓ Generated file: ecl-nodekey/enode.pub
✓ Generator ecl-nodekey completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine ecl-charlie completed
Processing machine: monitor-alpha
Generator execution order: state-version -> wireguard-keys
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine monitor-alpha completed
Processing machine: monitor-bravo
Generator execution order: state-version -> wireguard-keys
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine monitor-bravo completed
Processing machine: signer-alpha
Generator execution order: dirk-server-cert -> dirk-server-unlocker -> state-version -> wireguard-keys
Executing generator: dirk-server-cert
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout /output/key -out server.csr -nodes -subj /CN=signer-alpha.wg.test.clan -addext subjectAltName=DNS:signer-alpha.wg.test.clan
-----
+ openssl x509 -req -in server.csr -CA /input/dirk-ca/ca-cert -CAkey /input/dirk-ca/ca-key -CAcreateserial -out /output/cert -copy_extensions copyall -days 3650
Certificate request self-signature ok
subject=CN=signer-alpha.wg.test.clan
✓ Generated file: dirk-server-cert/cert
✓ Generated file: dirk-server-cert/key
✓ Generator dirk-server-cert completed
Executing generator: dirk-server-unlocker
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl rand -hex 32
+ openssl rand -hex 32
✓ Generated file: dirk-server-unlocker/account-passphrase
✓ Generated file: dirk-server-unlocker/wallet-passphrase
✓ Generator dirk-server-unlocker completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ tr -d '\n'
+ wg pubkey
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine signer-alpha completed
Processing machine: signer-bravo
Generator execution order: dirk-server-cert -> dirk-server-unlocker -> state-version -> wireguard-keys
Executing generator: dirk-server-cert
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout /output/key -out server.csr -nodes -subj /CN=signer-bravo.wg.test.clan -addext subjectAltName=DNS:signer-bravo.wg.test.clan
-----
+ openssl x509 -req -in server.csr -CA /input/dirk-ca/ca-cert -CAkey /input/dirk-ca/ca-key -CAcreateserial -out /output/cert -copy_extensions copyall -days 3650
Certificate request self-signature ok
subject=CN=signer-bravo.wg.test.clan
✓ Generated file: dirk-server-cert/cert
✓ Generated file: dirk-server-cert/key
✓ Generator dirk-server-cert completed
Executing generator: dirk-server-unlocker
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl rand -hex 32
+ openssl rand -hex 32
✓ Generated file: dirk-server-unlocker/account-passphrase
✓ Generated file: dirk-server-unlocker/wallet-passphrase
✓ Generator dirk-server-unlocker completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine signer-bravo completed
Processing machine: signer-charlie
Generator execution order: dirk-server-cert -> dirk-server-unlocker -> state-version -> wireguard-keys
Executing generator: dirk-server-cert
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout /output/key -out server.csr -nodes -subj /CN=signer-charlie.wg.test.clan -addext subjectAltName=DNS:signer-charlie.wg.test.clan
-----
+ openssl x509 -req -in server.csr -CA /input/dirk-ca/ca-cert -CAkey /input/dirk-ca/ca-key -CAcreateserial -out /output/cert -copy_extensions copyall -days 3650
Certificate request self-signature ok
subject=CN=signer-charlie.wg.test.clan
✓ Generated file: dirk-server-cert/cert
✓ Generated file: dirk-server-cert/key
✓ Generator dirk-server-cert completed
Executing generator: dirk-server-unlocker
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl rand -hex 32
+ openssl rand -hex 32
✓ Generated file: dirk-server-unlocker/account-passphrase
✓ Generated file: dirk-server-unlocker/wallet-passphrase
✓ Generator dirk-server-unlocker completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine signer-charlie completed
Processing machine: validator-alpha
Generator execution order: dirk-client-validator-alpha -> state-version -> wireguard-keys
Executing generator: dirk-client-validator-alpha
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout /output/key -out server.csr -nodes -subj /CN=validator-alpha.wg.test.clan -addext subjectAltName=DNS:validator-alpha.wg.test.clan
-----
+ openssl x509 -req -in server.csr -CA /input/dirk-ca/ca-cert -CAkey /input/dirk-ca/ca-key -CAcreateserial -out /output/cert -copy_extensions copyall -days 3650
Certificate request self-signature ok
subject=CN=validator-alpha.wg.test.clan
✓ Generated file: dirk-client-validator-alpha/cert
✓ Generated file: dirk-client-validator-alpha/key
✓ Generator dirk-client-validator-alpha completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine validator-alpha completed
Processing machine: validator-bravo
Generator execution order: dirk-client-validator-bravo -> state-version -> wireguard-keys
Executing generator: dirk-client-validator-bravo
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout /output/key -out server.csr -nodes -subj /CN=validator-bravo.wg.test.clan -addext subjectAltName=DNS:validator-bravo.wg.test.clan
-----
+ openssl x509 -req -in server.csr -CA /input/dirk-ca/ca-cert -CAkey /input/dirk-ca/ca-key -CAcreateserial -out /output/cert -copy_extensions copyall -days 3650
Certificate request self-signature ok
subject=CN=validator-bravo.wg.test.clan
✓ Generated file: dirk-client-validator-bravo/cert
✓ Generated file: dirk-client-validator-bravo/key
✓ Generator dirk-client-validator-bravo completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine validator-bravo completed
Processing machine: validator-charlie
Generator execution order: dirk-client-validator-charlie -> state-version -> wireguard-keys
Executing generator: dirk-client-validator-charlie
+ set -euo pipefail
+ PATH=/nix/store/zyrxhd7nwmkcs11m144jagxcmddw2i41-openssl-3.6.2-bin/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout /output/key -out server.csr -nodes -subj /CN=validator-charlie.wg.test.clan -addext subjectAltName=DNS:validator-charlie.wg.test.clan
-----
+ openssl x509 -req -in server.csr -CA /input/dirk-ca/ca-cert -CAkey /input/dirk-ca/ca-key -CAcreateserial -out /output/cert -copy_extensions copyall -days 3650
Certificate request self-signature ok
subject=CN=validator-charlie.wg.test.clan
✓ Generated file: dirk-client-validator-charlie/cert
✓ Generated file: dirk-client-validator-charlie/key
✓ Generator dirk-client-validator-charlie completed
Executing generator: state-version
+ set -euo pipefail
+ PATH=/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ echo -n 26.11
✓ Generated file: state-version/version
✓ Generator state-version completed
Executing generator: wireguard-keys
+ set -euo pipefail
+ PATH=/nix/store/wwq6srj4ws7ri493a3lwzil7xk9q1jlm-wireguard-tools-1.0.20260223/bin:/nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin
+ [[ ! -d /etc ]]
+ mkdir -p /etc
+ cat
++ id -g
+ cat
++ id -u
++ id -g
+ cat
+ wg genkey
Warning: writing to world accessible file.
Consider setting the umask to 077 and trying again.
+ wg pubkey
+ tr -d '\n'
✓ Generated file: wireguard-keys/privatekey
✓ Generated file: wireguard-keys/publickey
✓ Generator wireguard-keys completed
✓ Machine validator-charlie completed
✓ All vars checks completed successfully