From 2ed1be538e3b18b8c924cbe0b1900ba104b4a66f Mon Sep 17 00:00:00 2001 From: lassulus Date: Fri, 15 May 2026 17:55:13 +0200 Subject: [PATCH] nixos/tinc: chown the network state directory itself The preStart chowned `hosts/` and `invitations/` to `tinc-` but left `/etc/tinc//` itself owned by root (or a stale UID after a `tinc-` UID reassignment). Fine while tinc 1.0 only read config there, but tinc 1.1+ and tincr write a per-peer address bootstrap cache into the network directory, so the daemon needs to write it. When it can't, the save fails (tincr logs "Permission denied", tinc 1.1pre18 swallows it), the cache stays empty and reconnects fall back to DNS instead of the last-known IP. Chown the network directory alongside hosts/ and invitations/. Use a single `install -d` so existing directories with a stale owner get fixed too, which plain `mkdir -p` would skip. Assisted-by: Claude Code (claude-opus-4-7) --- nixos/modules/services/networking/tinc.nix | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix index e082214b5eca..22398f2ff5b0 100644 --- a/nixos/modules/services/networking/tinc.nix +++ b/nixos/modules/services/networking/tinc.nix @@ -421,10 +421,7 @@ in ExecStart = "${data.package}/bin/tincd -D -U tinc-${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}"; }; preStart = '' - mkdir -p /etc/tinc/${network}/hosts - chown tinc-${network} /etc/tinc/${network}/hosts - mkdir -p /etc/tinc/${network}/invitations - chown tinc-${network} /etc/tinc/${network}/invitations + install -d -o tinc-${network} /etc/tinc/${network} /etc/tinc/${network}/hosts /etc/tinc/${network}/invitations # Determine how we should generate our keys if type tinc >/dev/null 2>&1; then