| 9 Jul 2025 |
 hexa (clat on linux when) | can only be systemd doing this | 00:52:45 |
 Zhaofeng Li | this is beyond cursed | 00:54:40 |
| Zhaofeng Li | how about we patch kea to skip the permission check if NIXPKGS_HACK_ASSUME_THAT_THE_SOCKET_DIR_IS_PROTECTED_BY_SYSTEMD is set | 00:55:22 |
| hexa (clat on linux when) | but it isn't protected, it is 0755 😄 | 00:56:04 |
| hexa (clat on linux when) | * but it isn't protected, it is fucking 0755 😄 | 00:56:09 |
| Zhaofeng Li | /var/run/private is protected, right? | 00:57:42 |
| hexa (clat on linux when) | uhhh yeah | 00:58:46 |
| hexa (clat on linux when) | I think so | 00:58:54 |
| hexa (clat on linux when) | Zhaofeng Li: Restart = "on-failure" 🫣 | 01:14:38 |
| Zhaofeng Li | do we need to disable the start limit as well? | 01:15:32 |
| Zhaofeng Li | * do we need to disable the restart limit as well? | 01:16:32 |
| hexa (clat on linux when) | both services only failed once, so I don't think we do 😄 | 01:16:43 |
| Zhaofeng Li | * do we need to disable the restart limit as well? also Restart = "on-failure" should be the default? | 01:16:48 |
| hexa (clat on linux when) | yeah, they fail just the first time round | 01:17:28 |
| * hexa (clat on linux when) screams | 01:17:32 |
| Zhaofeng Li | * do we need to disable the restart limit as well? also Restart = "on-failure" should be the default? no, it isn't aaaa | 01:18:27 |
| Zhaofeng Li | theoretically there is still a chance that systemd will keep fighting against itself forever 🤓 | 01:19:59 |
|  alina arielle amelie🏳️⚧️🐾 changed their profile picture. | 21:01:32 |
| alina arielle amelie🏳️⚧️🐾 changed their display name from alina to alina arielle amelie🏳️⚧️🐾. | 21:02:18 |
| 10 Jul 2025 |
|  maciel310 joined the room. | 02:58:34 |
| maciel310 | Hey all, hoping someone might be able to help with an issue I'm hitting configuring VLANs. Use case is pretty simple, the only connection should be over the vlan, no untagged traffic or IP assigned. Following the docs (https://nixos.wiki/wiki/Systemd-networkd#VLAN) I came up with this systemd-networkd config, but pinging even local addresses returns unreachable. Any thoughts, or ideas on how to debug?
systemd.network = {
enable = true;
netdevs = {
"20-vlan30" = {
netdevConfig = {
Kind = "vlan";
Name = "vlan30";
};
vlanConfig.Id = 30;
};
};
networks = {
"30-enp0s20f0u1u2" = {
matchConfig.Name = "enp0s20f0u1u2";
vlan = [ "vlan30" ];
networkConfig.LinkLocalAddressing = "no";
linkConfig.RequiredForOnline = "carrier";
};
"40-vlan30" = {
matchConfig.Name = "vlan30";
address = [ "192.168.30.7/24" ];
routes = [
{ Gateway = "192.168.30.1"; }
];
linkConfig.RequiredForOnline = "routable";
};
};
};
| 04:43:33 |
| maciel310 | And here's the output of a couple commands to show the state, LMK if there are any other commands that would be helpful
$ networkctl
IDX LINK TYPE OPERATIONAL SETUP
1 lo loopback carrier unmanaged
2 enp0s20f0u1u2 ether carrier configured
3 vlan30 vlan routable configured
3 links listed.
$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: enp0s20f0u1u2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 1c:bf:ce:a7:84:b8 brd ff:ff:ff:ff:ff:ff
altname enx1cbfcea784b8
3: vlan30@enp0s20f0u1u2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 1c:bf:ce:a7:84:b8 brd ff:ff:ff:ff:ff:ff
inet 192.168.30.7/24 brd 192.168.30.255 scope global vlan30
valid_lft forever preferred_lft forever
inet6 fe80::1ebf:ceff:fea7:84b8/64 scope link proto kernel_ll
valid_lft forever preferred_lft forever
| 05:42:58 |
| hexa (clat on linux when) | looks good from here | 12:10:14 |
| hexa (clat on linux when) | I'd expect the issue will be on the switchport or the other endpoint | 12:10:36 |
| hexa (clat on linux when) | different question … what is the least awful way to make sure a consumer of a module I'm providing uses a DNSSEC validating resolver? | 14:21:04 |
| hexa (clat on linux when) | given that the resolver can be on the local machine (preferable) or not this seems a bit difficult to assert on 🤪 | 14:22:50 |
 emily | seems like not really something you can detect before runtime | 14:23:05 |
 Sandro 🐧 | within reason probably not at all | 14:23:10 |
| hexa (clat on linux when) | so I'm wondering what the right approximation would be | 14:23:11 |
| Sandro 🐧 | You could check if kresd is used with dnssec checks on | 14:23:24 |
