- Extract imds-server derivation into common/imds-server.nix so both
ec2-image.nix and common/ec2.nix share the same definition.
- Update common/ec2.nix (makeEc2Test) to use the IMDSv2 server
instead of micro_httpd, and add token/instance-id to the metadata
directory so the full IMDSv2 flow works.
- Simplify ec2-image.nix to import from the shared definition.
- Preflight validation now validates against the endpoint that issued
the token (IMDS_BASE_URL) instead of re-scanning all endpoints. The
previous behavior could silently switch to a different endpoint and
wasted time retrying unreachable ones.
- Add local keyword to endpoint variables in get_imds_token and
preflight_imds_token to avoid polluting global scope.
micro_httpd returns 501 for PUT requests, so IMDSv2 token acquisition
was never actually tested. Replace it with a minimal Python IMDS server
that handles the full IMDSv2 flow: PUT for token, token validation on
GET requests, and file serving from a metadata directory.
This means the test now validates that:
- The fetcher correctly obtains an IMDSv2 token via PUT
- The token is passed on subsequent metadata GET requests
- Requests without a valid token are rejected (401)
Tests that the EC2 metadata fetcher falls back to the IPv6 IMDS
endpoint (fd00:ec2::254) when the IPv4 endpoint is unreachable.
Works around QEMU guestfwd being IPv4-only by running socat +
micro_httpd inside the guest on the IPv6 address, then blocking
IPv4 IMDS with iptables and re-running the fetcher.
Updates the EC2 IMDS metadata fetcher script to support IPv6 endpoints. If you start an instance in an IPv6 subnet, if the EC2 instance gets an IPv6 address before the IPv4 address (extremely common), systemd will trigger the IMDS fetcher script and fail to fetch your NixOS configuration, leaving you with a useless unconfigured EC2 instance. This at least allows the NixOS configuration to be fetched and applied.
The package has last been touched upstream in 2020, and it's not
compatible with sphinx 9.1. It is no longer consumed in nixpkgs by
anything, allowing it to be dropped.
Refactor try_decompress to use a decompress_cmd variable, making it
straightforward to add new compression formats. Add bzip2 support
and a corresponding NixOS test.
Verify that fetch-ec2-metadata correctly decompresses gzip-compressed
EC2 user data. Adds a test helper for reuse by subsequent compression
format tests.
- Declare `ftype` as local to avoid leaking into caller scope
- Skip decompression attempt on empty files
- Clean up temp file on decompression failure
Philip Taron