!tCyGickeVqkHsYjWnh:nixos.org

NixOS Networking

900 Members
Declaratively manage your switching, routing, wireless, tunneling and more.270 Servers

Load older messages


SenderMessageTime
5 Apr 2026
@bubylou:matrix.orgbubylou *

You can use the [Match] section in NixOS. For example a LAN config I have is setup like this. I could use regex instead of specifying the whole interface name such as enp*.

systemd.network = {
    networks."10-lan" = {
      matchConfig.Name = "enp1s0";
01:22:26
@bubylou:matrix.orgbubylou *

You can use the [Match] section in NixOS. For example a LAN config I have is setup like this. I could use regex instead of specifying the whole interface name such as matchConfig.Name = "enp*";.

systemd.network = {
    networks."10-lan" = {
      matchConfig.Name = "enp1s0";
01:23:38
@bubylou:matrix.orgbubylou *

You can use the [Match] section in NixOS. For example a LAN config I have is setup like this.

systemd.network = {
    networks."10-lan" = {
      matchConfig.Name = "enp*";
01:24:05
@m1cr0man:m1cr0man.comm1cr0man Ugh, I have spent way too long debugging why ipv6 scope IDs were not present when resolving nspawn containers from the host. It looks like nss-mymachines is broken? I would need someone else to try getent -s hosts:mymachines hosts example 02:38:37
@hexa:lossy.networkhexaempty02:44:02
@hexa:lossy.networkhexaon the one machine I have with a nixos container02:44:08
@hexa:lossy.networkhexaif that's what you were looking for02:44:16
@m1cr0man:m1cr0man.comm1cr0manYep. Damn. And is that set up with a .nspawn file? 02:46:41
@hexa:lossy.networkhexaor maybe that's only for nspawn?02:46:46
@hexa:lossy.networkhexahm02:46:49
@hexa:lossy.networkhexawhatever the current generation of nixos containers is02:47:04
@m1cr0man:m1cr0man.comm1cr0manWell if it comes up in "machinectl" and it has a ve-$container interface on the host, it should give you something based on my understanding 02:47:49
@hexa:lossy.networkhexait does come up in machinectl02:48:01
@hexa:lossy.networkhexa getent hosts <container> works fwiw 02:49:48
@m1cr0man:m1cr0man.comm1cr0manDoes your container have more than just link local ips? 02:50:14
@m1cr0man:m1cr0man.comm1cr0man
In reply to @hexa:lossy.network
getent hosts <container> works fwiw
Works for me too but on ipv6 returns no scope ID for link local addresses
02:50:43
@m1cr0man:m1cr0man.comm1cr0manI believe it is using llmnr-ipv6 instead in this case. I was able to validate that with `resolvectl query -p llmnr-ipv6 example`02:51:56
@hexa:lossy.networkhexanvm, no interface in the host namespace02:52:26
@hexa:lossy.networkhexait has a bunch of ULA ip addresses02:52:41
@hexa:lossy.networkhexaeh … 5am02:53:05
@hexa:lossy.networkhexa💤02:53:08
@m1cr0man:m1cr0man.comm1cr0manYeah, early here too. Ttyl if you are around but thanks for the quick checks02:53:58
@m1cr0man:m1cr0man.comm1cr0manJust for sanity: the docs on mymachines demonstrate clearly that an ipv6 ping should return a scope ID https://www.freedesktop.org/software/systemd/man/latest/nss-mymachines.html03:00:55
@m1cr0man:m1cr0man.comm1cr0man A couple of straces later, I've found that libnss_mymachines.so.2 isn't in the standard library path. Adding it via LD_LIBRARY_PATH makes getent ahosts work as expected. Uh, this is where my nixos knowledge is not great - what's the right way to make this library available for the whole system? It's always dynamically loaded based on nsswitch.conf, so I can't compile it in to the necessary binaries. 10:35:05
@m1cr0man:m1cr0man.comm1cr0man

Another person has walked this path before 😅 systemd/lib is in nscd.service's LD_LIBRARY_PATH, and nscd.conf has an interesting note:

# Note that we can not use `enable-cache no` As this will actually cause nscd
# to just reject the nss requests it receives, which then causes glibc to
# fallback to trying to handle the request by itself. Which won't work as glibc
# is not aware of the path in which the nss modules live.  As a workaround, we
# have `enable-cache yes` with an explicit ttl of 0
10:40:43
@m1cr0man:m1cr0man.comm1cr0manBut this still doesn't explain why ping is not getting the result from mymachines. Perhaps nscd doesn't have permission to send the dbus message to systemd to get the container addresses?10:45:36
@m1cr0man:m1cr0man.comm1cr0manIt does have perms, stracing nscd proves the same output. But somewhere between nscd getting a response from mymachines/getaddrinfo and responding to the requesting client, the scope_id is lost11:59:44
@m1cr0man:m1cr0man.comm1cr0man * It does have perms, stracing nscd proves the same output. But somewhere between nscd getting a response from mymachines and responding to the requesting client, the scope_id is lost 12:01:38
@m1cr0man:m1cr0man.comm1cr0mannsncd/nscd just doesn't support scope IDs, and that's the end of the story. nss-mymachines is working fine, but with the way nixos is configured you would have to make sure libsystemd is in the LD_LIBRARY_PATH for all processes that need to do lookups. I can achieve that in my case, but it's awkward. Would be much nicer if systemd-resolved or some other tool could be a better replacement here17:50:29
@ma27:nicht-so.sexyma27that's kinda why I query the machines via some mechanism and nsupdate this into an authoritative dns server fwiw.17:55:37

Show newer messages


Back to Room ListRoom Version: 6