From 7346179cb740b7452cc4cae541f865092bcaf848 Mon Sep 17 00:00:00 2001 From: Marcel Date: Sat, 29 Nov 2025 12:37:16 +0100 Subject: [PATCH 1/5] Revert "nixos/ifstate: remove netns so ifstate can identify interface" This reverts commit eade8e0bcd55db5568e3e547f57168ad1526fd93. --- nixos/tests/ifstate/initrd-wireguard.nix | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/nixos/tests/ifstate/initrd-wireguard.nix b/nixos/tests/ifstate/initrd-wireguard.nix index 6eb90c49a829..7fe99a5a2646 100644 --- a/nixos/tests/ifstate/initrd-wireguard.nix +++ b/nixos/tests/ifstate/initrd-wireguard.nix @@ -10,19 +10,20 @@ let { enable = true; settings = { - interfaces = { - eth1 = { - addresses = [ "2001:0db8:a::${builtins.toString id}/64" ]; - link = { - state = "up"; - kind = "physical"; - }; + namespaces.outside.interfaces.eth1 = { + addresses = [ "2001:0db8:a::${builtins.toString id}/64" ]; + link = { + state = "up"; + kind = "physical"; }; + }; + interfaces = { wg0 = { addresses = [ "2001:0db8:b::${builtins.toString id}/64" ]; link = { state = "up"; kind = "wireguard"; + bind_netns = "outside"; }; wireguard = { private_key = "!include ${pkgs.writeText "wg_priv.key" wgPriv}"; From 63a32d9b42b7da5a709783fd97eed6123ff5de1c Mon Sep 17 00:00:00 2001 From: Marcel Date: Sat, 29 Nov 2025 11:57:06 +0100 Subject: [PATCH 2/5] nixos/ifstate: update descriptions --- nixos/modules/services/networking/ifstate.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/networking/ifstate.nix b/nixos/modules/services/networking/ifstate.nix index 5bd748504f09..5403e355d933 100644 --- a/nixos/modules/services/networking/ifstate.nix +++ b/nixos/modules/services/networking/ifstate.nix @@ -106,7 +106,7 @@ in settings = lib.mkOption { inherit (settingsFormat) type; default = { }; - description = "Content of IfState's configuration file. See for details."; + description = "Content of IfState's configuration file. See for details."; }; }; @@ -131,14 +131,14 @@ in settings = lib.mkOption { inherit (settingsFormat) type; default = { }; - description = "Content of IfState's initrd configuration file. See for details."; + description = "Content of IfState's initrd configuration file. See for details."; }; cleanupSettings = lib.mkOption { inherit (settingsFormat) type; # required by json schema default.interfaces = { }; - description = "Content of IfState's initrd cleanup configuration file. See for details. This configuration gets applied before systemd switches to stage two. The goas is to deconfigurate the whole network in order to prevent access to services, before the firewall is configured. The stage two IfState configuration will start after the firewall is configured."; + description = "Content of IfState's initrd cleanup configuration file. See for details. This configuration gets applied before systemd switches to stage two. The goal is to deconfigurate the whole network in order to prevent access to services, before the firewall is configured. The stage two IfState configuration will start after the firewall is configured."; }; }; }; From c321cd57715b754cf8a7d55e1603d1838f718c09 Mon Sep 17 00:00:00 2001 From: Marcel Date: Sat, 29 Nov 2025 11:57:36 +0100 Subject: [PATCH 3/5] nixos/ifstate: configure kernel params also for initrd-only installations --- nixos/modules/services/networking/ifstate.nix | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/nixos/modules/services/networking/ifstate.nix b/nixos/modules/services/networking/ifstate.nix index 5403e355d933..772fe831a860 100644 --- a/nixos/modules/services/networking/ifstate.nix +++ b/nixos/modules/services/networking/ifstate.nix @@ -144,6 +144,14 @@ in }; config = lib.mkMerge [ + (lib.mkIf (cfg.enable || initrdCfg.enable) { + # sane defaults to not let IfState work against the kernel + boot.extraModprobeConfig = '' + options bonding max_bonds=0 + options dummy numdummies=0 + options ifb numifbs=0 + ''; + }) (lib.mkIf cfg.enable { assertions = [ { @@ -158,13 +166,6 @@ in networking.useDHCP = lib.mkDefault false; - # sane defaults to not let IfState work against the kernel - boot.extraModprobeConfig = '' - options bonding max_bonds=0 - options dummy numdummies=0 - options ifb numifbs=0 - ''; - environment = { # ifstatecli command should be available to use user, there are other useful subcommands like check or show systemPackages = [ cfg.package ]; From 3a0b463b32c57fe7dd77630d20a9f11ff79bf839 Mon Sep 17 00:00:00 2001 From: Marcel Date: Sat, 29 Nov 2025 11:58:00 +0100 Subject: [PATCH 4/5] nixos/ifstate: cleanup initrd-wireguard test --- nixos/tests/ifstate/initrd-wireguard.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/nixos/tests/ifstate/initrd-wireguard.nix b/nixos/tests/ifstate/initrd-wireguard.nix index 7fe99a5a2646..9fe2fb1c3be1 100644 --- a/nixos/tests/ifstate/initrd-wireguard.nix +++ b/nixos/tests/ifstate/initrd-wireguard.nix @@ -73,9 +73,6 @@ in wgPeerId = 2; } // { - package = pkgs.ifstate.override { - withConfigValidation = false; - }; allowIfstateToDrasticlyIncreaseInitrdSize = true; }; }; From f73ef8f753d0a7ac71e20cb30cfe33522fa052fc Mon Sep 17 00:00:00 2001 From: Marcel Date: Sat, 29 Nov 2025 12:22:13 +0100 Subject: [PATCH 5/5] nixos/ifstate: load kernel modules required for networking --- nixos/tests/ifstate/initrd-partial-broken-config.nix | 4 ++++ nixos/tests/ifstate/initrd-wireguard.nix | 4 ++++ nixos/tests/ifstate/initrd.nix | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/nixos/tests/ifstate/initrd-partial-broken-config.nix b/nixos/tests/ifstate/initrd-partial-broken-config.nix index 2acd9226dde9..c29540ccd390 100644 --- a/nixos/tests/ifstate/initrd-partial-broken-config.nix +++ b/nixos/tests/ifstate/initrd-partial-broken-config.nix @@ -28,6 +28,9 @@ in }; boot.initrd = { + # otherwise the interfaces do not get created + kernelModules = [ "virtio_net" ]; + network = { enable = true; ifstate = lib.mkMerge [ @@ -46,6 +49,7 @@ in } ]; }; + systemd = { enable = true; network.enable = false; diff --git a/nixos/tests/ifstate/initrd-wireguard.nix b/nixos/tests/ifstate/initrd-wireguard.nix index 9fe2fb1c3be1..932e6bf5aece 100644 --- a/nixos/tests/ifstate/initrd-wireguard.nix +++ b/nixos/tests/ifstate/initrd-wireguard.nix @@ -62,6 +62,9 @@ in }; boot.initrd = { + # otherwise the interfaces do not get created + kernelModules = [ "virtio_net" ]; + network = { enable = true; ifstate = @@ -76,6 +79,7 @@ in allowIfstateToDrasticlyIncreaseInitrdSize = true; }; }; + systemd = { enable = true; network.enable = false; diff --git a/nixos/tests/ifstate/initrd.nix b/nixos/tests/ifstate/initrd.nix index 01ed9a513ccd..546f5c8114bd 100644 --- a/nixos/tests/ifstate/initrd.nix +++ b/nixos/tests/ifstate/initrd.nix @@ -26,12 +26,16 @@ in }; boot.initrd = { + # otherwise the interfaces do not get created + kernelModules = [ "virtio_net" ]; + network = { enable = true; ifstate = mkIfStateConfig 1 // { allowIfstateToDrasticlyIncreaseInitrdSize = true; }; }; + systemd = { enable = true; network.enable = false;