Reverts #481473, fixes#509254
Turns out this breaks scripted networking with systemd stage 1. Even
if we assumed that systemd stage 1 wasn't now the default, I still
think that makes this worthy of a revert, in the absence of a fix. But
now that systemd stage 1 is the default, this is also a channel
blocker.
The problem is that wantedBy = [ "foo.device" ]; doesn't work as
hoped. If the device appears in stage 1, then the systemd device unit
becomes active in stage 1 without pulling in any dependency for
configuring it (because that only exists in stage 2). When we
transition to stage 2, systemd maintains its information about unit
state between stages and remembers that the device units were already
active. They do not become reactivated, and consequently their new
stage 2 dependencies do not get pulled in.
The fix is probably to do this with SYSTEMD_WANTS= in udev rules,
rather than with wantedBy. The udev rules will re-fire during stage 2,
though I'm not 100% clear on exactly which events that includes
(e.g. if we'll get new add events or if we need to look for a
different ACTION or anything like that). This is going to require some
experimentation and testing that I don't have time for today.
Given that this is addressing a channel blocker, I think this revert
should be merged if a fix can't be merged instead before the next
unstable-small eval. In either case, staging-nixos should be merged to
master right after.
This change solves some big design flaws in the scripted networking
backend.
1. When the module was reworked in 072c1dcc4a to use the new systemd
targets, network-setup.service was used to:
a. order the services and link network.target to the boot sequence
b. perform some perform final network configuration, specifically
setting the default gateways and nameservers (/etc/resolv.conf).
Later (ec00b4bb11) however, network-setup.service was made
optional: if resolvconf is not used and a default gateway is not set,
the service is not be defined (because it would result in an empty
script). Doing so, however, has the unintended effect of unlinking
network.target from multi-uset.target, meaning no network
configuration at all is performed.
Note: this can be easily seen by adding `networking.resolvconf.enable
= false` to the nixosTests.networking.scripted.static test.
2. The network-addresses-*.service are linked to network.target, which,
in turn, is linked to multi-uset.target. This means that if a
hardware interface is not found, the boot will hang until this
service times out (issue #154737).
To solve issue 1. this change removes network-target entirely while
- moving the default gateway setup into the relative
network-addresses-*.service unit;
- moving the nameservers setup into networking.localCommands;
(incidentally, this also fixes issue #445496)
- directly linking network.target to multi-user.target.
To solve issue 2. this removes the Wants=network.target dependency of
network-addresses-*.service and solely relies on the underlying
interface unit (*-netdev.service for virtual, *.device for physical) to
start the service.
Note: for NixOS containers, the dependency is kept, because the .device
unit are not available in this case.
Finally, if an interface is the default gateway, network-online.target
is added as an extra dependency, so the target is not reached until the
interface has been plugged in and configured.
null will not set owner, allowing any user to access the virtual
device. Previously, this behavior can be achieved by using
systemd.network.netdevs.* options direcly and leaving
systemd.network.netdevs.<name>.tapConfig.User unset. With this patch,
this behavior can be achieved using the generic
networking.interfaces.* options by setting
networking.interfaces.<name>.virtualOwner to null.
If needed, we can change the default value from "root" to null in the
future to be consistent with systemd-networkd's default behavior.
We need to do the virtio link setup prior to `network.target`, since
systemd-networkd orders itself before `network.target`. So in order for
the bond to properly enslave the two virtio links, they should be
configured as a part of `network-pre.target`.
After final improvements to the official formatter implementation,
this commit now performs the first treewide reformat of Nix files using it.
This is part of the implementation of RFC 166.
Only "inactive" files are reformatted, meaning only files that
aren't being touched by any PR with activity in the past 2 months.
This is to avoid conflicts for PRs that might soon be merged.
Later we can do a full treewide reformat to get the rest,
which should not cause as many conflicts.
A CI check has already been running for some time to ensure that new and
already-formatted files are formatted, so the files being reformatted here
should also stay formatted.
This commit was automatically created and can be verified using
nix-build https://github.com/infinisil/treewide-nixpkgs-reformat-script/archive/a08b3a4d199c6124ac5b36a889d9099b4383463f.tar.gz \
--argstr baseRev b32a094368
result/bin/apply-formatting $NIXPKGS_PATH
First, `stop network-addresses-X` should clean up the addresses without deleting the interfaces. And only `stop tap0-netdev` should fully delete the interfaces.
Signed-off-by: Egor Savkin <es@m-labs.hk>
I guess my time has come as well...
With this commit, I'm not just dropping my maintainer entry, but I'm also
resigning from my duties as a board observer and NixCon project lead.
I also terminated my Summer of Nix contract today.
I'll also stop hosting the local NixOS meetup.
The only "project" I'll finish under the NixOS Foundation umbrella is
Google Summer of Code because the mentees aren't even remotely
responsible for why I'm leaving, and it would be unfair to leave them
hanging.
I'm grateful for all the things I was able to learn, for all the experiences
I could gather, and for all the friends I made along the way.
NixOS is what makes computers bearable for me, so I'll go and work on
some fork (*something something* you always meet twice in life).
this commit also does a tiny bit more, namely:
- removing unnecessary ping's to the hosts own ip
- and simplifying a few pieces of code like changing `{ inherit (pkgs) lib pkgs; };` to `{ inherit lib pkgs; };`
Pol Dellaiera