With kernel lockdown the tun kmod is not necessarily available in stage2,
but Lix dependes on it through pasta.
nix-daemon[682677]: remote pid 682659 is user build (trusted)
nix-daemon[682711]: Failed to open() /dev/net/tun: No such device
nix-daemon[682702]: Failed to set up tap device in namespace
After [1], nix-daemon will be socket-activated, and the service options need to
be set on the template unit. In the meantime, it does approximately nothing and
is harmless.
[1] https://gerrit.lix.systems/c/lix/+/4719
Over time, it is expected that the setups for Lix and Nix will diverge in some
ways. To prevent cluttering the modules too much, we will introduce a separate
Lix module. It begins its existence as a fork of the nix-daemon module, right
now without major changes, although this will change soon. It is also slightly
weird due to not having any option definitions on its own and instead
dispatching on the pname of `nix.package`, which is done for backwards
compatibility (particularly on 25.11), and will also change soon by the gradual
introduction of a separate `programs.lix` option subtree.
Martin Weinelt