lass.pds.lassul.us / superconfig
This repository has no description
0
Fork 1

Configure Feed

Select the types of activity you want to include in your feed.

configs.riot: leave ve-riot unmanaged by networkd

Since d9ed167 networkd installed the route to the container itself.
networkd adds it as soon as ve-riot gets carrier, before the container
start script runs `ip route add 10.233.1.2 dev ve-riot`, so the script
fails with "RTNETLINK answers: File exists" and container@riot ends up
in a restart loop. Before the reboot riot had never restarted since
d9ed167, so nobody noticed.

The script's route and address come from nixpkgs' nixos-containers
module and can't be turned off without patching nixpkgs (localAddress
also sets the container side), so the networkd route has to go. Now
ve-riot is Unmanaged=yes instead, and the start script owns its
address and route. Checked against systemd 261:

- An unmanaged link gets no configuration from networkd, so nothing is
in place before the script's `ip route add` and it succeeds on every
start.
- networkd only drops foreign routes for the link it is configuring
(link_drop_unmanaged_config, CONFIGURING state). When link_drop_routes
marks foreign routes it skips routes on other interfaces, "Otherwise,
routes assigned to unmanaged interfaces will be dropped". So a networkd
restart or reload no longer touches the script's route. That was the
bug d9ed167 fixed.

KeepConfiguration=static could not keep the script's route anyway: it
only protects foreign routes with protocol static, and `ip route add`
uses protocol boot. LinkLocalAddressing=no and KeepConfiguration=static
mean nothing on an unmanaged link, so they are gone, along with the
commented-out IPForward/IPMasquerade lines. Forwarding and NAT stay in
nftables and the sysctl. No other .network file on neoprism matches
ve-riot (99-ethernet-default-dhcp needs Kind=!*), but Unmanaged=yes
also keeps a later catch-all file from taking over ve-riot.

author
Hermes committer
lassulus date (Oct 16, 2026, 1:52 PM CEST) commit 3106c53d parent e5ad42d5
+5 -13
+5 -13
configs/riot.nix
··· 48 48 }; 49 49 systemd.services."container@riot".restartIfChanged = lib.mkForce false; 50 50 51 + # The container start script sets up the address and route on ve-riot. 52 + # Unmanaged keeps networkd from adding its own config there (which makes 53 + # the script's `ip route add` fail) and from dropping the script's config 54 + # as foreign, also if a later catch-all .network file matches ve-riot. 51 55 systemd.network.networks."50-ve-riot" = { 52 56 matchConfig.Name = "ve-riot"; 53 - 54 - networkConfig = { 55 - # weirdly we have to use POSTROUTING MASQUERADE here 56 - # and set ip_forward manually 57 - # IPForward = "yes"; 58 - # IPMasquerade = "both"; 59 - LinkLocalAddressing = "no"; 60 - KeepConfiguration = "static"; 61 - }; 62 - # The container start script adds this route, but networkd drops it as 63 - # foreign the next time it reconfigures ve-riot (e.g. when networkd 64 - # restarts), and container@riot is never restarted to re-add it. 65 - routes = [ { Destination = "${config.containers.riot.localAddress}/32"; } ]; 57 + linkConfig.Unmanaged = true; 66 58 }; 67 59 68 60 boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;