| 16 Jun 2026 |
 hexa | ja, mir auch | 11:21:19 |
 emily (hat jemand chromium gesagt?) | services.prometheus macht das auch fwiw | 11:22:09 |
| hexa | whataboutism | 11:22:27 |
| emily (hat jemand chromium gesagt?) | pfff | 11:23:05 |
 Grimmauld (any/all) | https://github.com/LordGrimmauld/capsudo/blob/53654283e8360674d06a4f01d9ca2eba927de96e/flake.nix#L166-L208
@emily (hat jemand chromium gesagt?) @networkException einer von euch beiden war doch so socket-begeistert. Was mache ich falsch?
man systemd.exec:
The socket option is valid in socket-activated services only, and requires the relevant socket unit file (see systemd.socket(5) for details) to have Accept=yes set, or to specify a single socket only. If this option is set, standard input will be connected to the socket the service was activated from, which is primarily useful for compatibility with daemons designed for use with the traditional inetd(8) socket activation daemon ($LISTEN_FDS (and related) environment variables are not passed when socket value is configured).
man 8 capsudod:
OPERATION
When started with -S, capsudod creates a UNIX domain socket at the specified path and accepts client connections.
When started without -S, capsudod assumes it has been launched by another daemon and serves a single client connection on file descriptor 0. In this mode, capsudod does not create or listen on a socket.
This supports inetd-style and wrapper-based deployment, where an authentication or policy daemon performs access checks and then execs capsudod with the already-connected client socket.
Problem:
[admin@nixos:~]$ capsudo -S /run/capsudo/id
uid=0(root) gid=0(root) groups=0(root)
[admin@nixos:~]$ systemctl status capsudo-id@0-3-1224_1225-1000.service
× capsudo-id@0-3-1224_1225-1000.service - PID 1224/UID 1000
Loaded: loaded (/etc/systemd/system/capsudo-id@.service; static)
Active: failed (Result: exit-code) since Tue 2026-06-16 11:29:29 UTC; 31s ago
Duration: 5ms
Invocation: 95cbc49b21394cbf816f4ebf10251d76
TriggeredBy: ● capsudo-id.socket
Process: 1225 ExecStart=/nix/store/zwrp4y0g6z5apxv38dcilr95b9jav06g-capsudo/bin/capsudod -E -f /nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin/id (code=exited, status=1/FAILURE)
Main PID: 1225 (code=exited, status=1/FAILURE)
IP: 0B in, 0B out
IO: 0B read, 0B written
Mem peak: 2M
CPU: 6ms
Jun 16 11:29:29 nixos systemd[1]: Starting PID 1224/UID 1000...
Jun 16 11:29:29 nixos systemd[1]: Started PID 1224/UID 1000.
Jun 16 11:29:29 nixos systemd[1]: capsudo-id@0-3-1224_1225-1000.service: Main process exited, code=exited, status=1/FAILURE
Jun 16 11:29:29 nixos systemd[1]: capsudo-id@0-3-1224_1225-1000.service: Failed with result 'exit-code'.
[admin@nixos:~]$
Ganz offensichtlich tut der service etwas, aber systemd sieht exit(1) und ich bin verwirrt. Was mache ich falsch? Socket von systemd nach capsudo tut, command tut, und exit ist dann kaputt. | 11:42:13 |
| Grimmauld (any/all) | https://github.com/LordGrimmauld/capsudo/blob/53654283e8360674d06a4f01d9ca2eba927de96e/flake.nix#L166-L208
@emily (hat jemand chromium gesagt?) @networkException eine von euch beiden war doch so socket-begeistert. Was mache ich falsch?
man systemd.exec:
The socket option is valid in socket-activated services only, and requires the relevant socket unit file (see systemd.socket(5) for details) to have Accept=yes set, or to specify a single socket only. If this option is set, standard input will be connected to the socket the service was activated from, which is primarily useful for compatibility with daemons designed for use with the traditional inetd(8) socket activation daemon ($LISTEN_FDS (and related) environment variables are not passed when socket value is configured).
man 8 capsudod:
OPERATION
When started with -S, capsudod creates a UNIX domain socket at the specified path and accepts client connections.
When started without -S, capsudod assumes it has been launched by another daemon and serves a single client connection on file descriptor 0. In this mode, capsudod does not create or listen on a socket.
This supports inetd-style and wrapper-based deployment, where an authentication or policy daemon performs access checks and then execs capsudod with the already-connected client socket.
Problem:
[admin@nixos:~]$ capsudo -S /run/capsudo/id
uid=0(root) gid=0(root) groups=0(root)
[admin@nixos:~]$ systemctl status capsudo-id@0-3-1224_1225-1000.service
× capsudo-id@0-3-1224_1225-1000.service - PID 1224/UID 1000
Loaded: loaded (/etc/systemd/system/capsudo-id@.service; static)
Active: failed (Result: exit-code) since Tue 2026-06-16 11:29:29 UTC; 31s ago
Duration: 5ms
Invocation: 95cbc49b21394cbf816f4ebf10251d76
TriggeredBy: ● capsudo-id.socket
Process: 1225 ExecStart=/nix/store/zwrp4y0g6z5apxv38dcilr95b9jav06g-capsudo/bin/capsudod -E -f /nix/store/9ypz3flqsrl5xl495mm8h645gadjsxi1-coreutils-9.11/bin/id (code=exited, status=1/FAILURE)
Main PID: 1225 (code=exited, status=1/FAILURE)
IP: 0B in, 0B out
IO: 0B read, 0B written
Mem peak: 2M
CPU: 6ms
Jun 16 11:29:29 nixos systemd[1]: Starting PID 1224/UID 1000...
Jun 16 11:29:29 nixos systemd[1]: Started PID 1224/UID 1000.
Jun 16 11:29:29 nixos systemd[1]: capsudo-id@0-3-1224_1225-1000.service: Main process exited, code=exited, status=1/FAILURE
Jun 16 11:29:29 nixos systemd[1]: capsudo-id@0-3-1224_1225-1000.service: Failed with result 'exit-code'.
[admin@nixos:~]$
Ganz offensichtlich tut der service etwas, aber systemd sieht exit(1) und ich bin verwirrt. Was mache ich falsch? Socket von systemd nach capsudo tut, command tut, und exit ist dann kaputt. | 11:42:52 |
| emily (hat jemand chromium gesagt?) | auf einen kurzen blick glaube ich, dass file descriptor 0 nicht dein socket fd ist. aber @networkexception:nwex.de steckt da mehr drinnen. die kann da mit etwas glück gleich drüber schauen | 11:50:56 |
| Grimmauld (any/all) | StandardInput=
Controls where file descriptor 0 (STDIN) of the executed processes is connected to. Takes one of null, tty, tty-force, tty-fail, data, file:path, socket or fd:name.
Ich lese die manpage schon so, dass fd0 mein socket ist. Sonst würde ja auch der output von id nicht ankommen | 11:52:30 |
| Grimmauld (any/all) | StandardInput=
Controls where file descriptor 0 (STDIN) of the executed processes is connected to. Takes one of null, tty, tty-force, tty-fail, data, file:path, socket or fd:name.
Ich lese die systemd manpage schon so, dass fd0 mein socket ist. Sonst würde ja auch der output von id nicht ankommen | 11:52:39 |
| Grimmauld (any/all) | Okay, scheint es ist waitpid call der failed | 13:21:59 |
| Grimmauld (any/all) | bin am debuggen, ggf. exited der child process bevor parent waitpid aufruft? Nicht ganz sicher | 13:22:31 |
| Grimmauld (any/all) | (void) signal(SIGCHLD, SIG_IGN); macht scheinbar waitpid kaputt | 13:31:28 |
 φ(void) | void | 13:31:49 |
| Grimmauld (any/all) | also gar kein socket problem | 13:31:52 |
| Grimmauld (any/all) | sorry | 13:31:57 |
| φ(void) | x3 | 13:32:00 |
|  @jo:asra.gr left the room. | 20:25:56 |
 maralorn | 
Download image.png | 21:52:11 |
| maralorn | Huh, update auf 26.05 hat schonmal einen positiven Effekt: | 21:52:12 |
| 17 Jun 2026 |
| maralorn | Und mein Element fühlt sich viel mehr snappy an? | 00:55:08 |
| 18 Jun 2026 |
|  annaaurora 🦊🦴 changed their display name from Rain (レイン) to Rain (レイン), Luka (ルカ). | 13:03:59 |
| 8 Aug 2025 |
|  0x4A6F joined the room. | 07:07:21 |
| 11 Aug 2025 |
| hexa | moin | 13:28:57 |
| hexa | wer ist denn heute alles von außerhalb von darmstadt inbound und würde gerne was zu abend essen? | 13:29:10 |
| hexa | https://md.darmstadt.ccc.de/nixda-202505 | 17:24:14 |
| hexa changed the room topic to "Nächstes Treffen: 06.08.2025.(<https://md.darmstadt.ccc.de/nixda-202505>) | Dekoratives Systemmanagement. How dare you … wenn Nix hilft | Use `/roomnick` for silly sentiments. | https://nix-cheatsheet.pixie.homes" from "Nächstes Treffen: 06.08.2025.(https://md.darmstadt.ccc.de/nixda-202505) | Dekoratives Systemmanagement. How dare you … wenn Nix hilft | Use `/roomnick` for silly sentiments. | https://nix-cheatsheet.pixie.homes". | 17:24:28 |
|  zitrone joined the room. | 17:32:27 |
 mic92 (ja wirklich) |
hexa Unattended Kernel-Upgrades mit Full-Disk Encryption
magst du config danach sharen? wäre interessiert, wie du das machst.
insbesondere, weil mein letzter stand war, dass systemd-pcrenroll in der default-konfiguration wohl nicht das ist, was man will. | 17:47:26 |
| emily (hat jemand chromium gesagt?) | https://jade.fyi/blog/flakes-arent-real/ | 18:08:09 |
| hexa | https://github.com/nix-community/nixos-images#using-the-kexec-installer | 18:14:07 |
