Some problems when using this on Dedipath VPS

[scientificworld]

Hi. I ordered a Dedipath OpenVZ VPS and use this repo to install NixOS, but I met some problems.

This is my configuration:

{
    networking.useNetworkd = true;

    systemd.network.networks.venet0 = {
        name = "venet0";
        address = [ "<VPS IPv4 address>/32" "<VPS IPv6 address>/64" ];
        networkConfig = {
            DHCP = "no";
            DefaultRouteOnDevice = "yes";
            ConfigureWithoutCarrier = "yes";
        };
    };

    services.openssh.enable = true;

    users.users.root.openssh.authorizedKeys.keyFiles = [
        "/root/.ssh/authorized_keys"
    ];
}

When I extracted the tarball, it displayed the following error message:

tar: sys: Cannot utime: Operation not permitted
tar: sys: Cannot change ownership to uid 0, gid 0: Operation not permitted
tar: sys: Cannot change mode to rwxr-xr-x: Operation not permitted
tar: Exiting with failure status due to previous errors

I ignored it and reboot, and it seemed that NixOS booted successfully.

But soon I found that it could not resolve any host, and the ipv6 address was unreachable.

How can I solve it, is there any problem in my configuation? I'm new to NixOS, so my question may be silly.

[zhaofengli]

Hi, could you see what resolvectl prints out? For IPv6, make sure the IP address is added in the SolusVM panel. It's under Network > IPv6 Subnets > Manage.

[scientificworld]

Hi, could you see what resolvectl prints out? For IPv6, make sure the IP address is added in the SolusVM panel. It's under Network > IPv6 Subnets > Manage.

This is the output of resolvectl:

Global
           Protocols: +LLMNR +mDNS -DNSOverTLS DNSSEC=allow-downgrade/supported
    resolv.conf mode: stub
Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 8.8.8.8#dns.google 1.0.0.1#cloudflare-dns.com
                      8.8.4.4#dns.google 2606:4700:4700::1111#cloudflare-dns.com
                      2001:4860:4860::8888#dns.google 2606:4700:4700::1001#cloudflare-dns.com
                      2001:4860:4860::8844#dns.google

Link 2 (venet0)
Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=allow-downgrade/supported

This is the content of /etc/resolv.conf:

# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search .

I've tried to change the nameserver in /etc/resolv.conf to something like 1.1.1.1, but it took no effect.

And I see that the IPv6 address has been added in the panel.

P.S. If you really need I can order another VPS for you to test :D

[zhaofengli]

Hmm, that seems weird. I assume that you're able to ping 1.1.1.1 without problem, right? Is there anything in journalctl -u systemd-resolved?

[scientificworld]

Yep, I can ping 1.1.1.1, 1.0.0.1, 8.8.8.8, 8.8.4.4 successfully, but none of them works.

And this is the latest log in journalctl -u systemd-resolved, seems no error:

Dec 16 06:11:22 nixos systemd[1]: Starting Network Name Resolution...
Dec 16 06:11:23 nixos systemd-resolved[278]: Positive Trust Anchors:
Dec 16 06:11:23 nixos systemd-resolved[278]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
Dec 16 06:11:23 nixos systemd-resolved[278]: Negative trust anchors: home.arpa 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa 20.172.in-addr.arpa 21.172.in-addr.arpa 22.172.in-addr.arpa 23.172.in-addr.arpa 24.172.in-addr.arpa 25.172.in-addr.arpa 26.172.in-addr.arpa 27.172.in-addr.arpa 28.172.in-addr.arpa 29.172.in-addr.arpa 30.172.in-addr.arpa 31.172.in-addr.arpa 168.192.in-addr.arpa d.f.ip6.arpa corp home internal intranet lan local private test
Dec 16 06:11:23 nixos systemd-resolved[278]: Using system hostname 'nixos'.
Dec 16 06:11:25 nixos systemd[1]: Started Network Name Resolution.

There were some systemd-resolved: Failed to start query: Invalid argument error logs a few days ago, but I think that's because of my misconfiguration of resolvectl that time.

[scientificworld]

Bought an EthernetServers VPS but met the same problem. I build the tarball on LiveCD (the virtualization software is QEMU), does it matter?

[scientificworld]

After changed systemd-networkd to dnsmasq, domain resolve problem no longer appears.

But IPv6 is still unusable..

[ghost]

I'm running into the exact same error. How did you use dnsmasq instead of systemd-network @scientificworld ?

services.dnsmasq.enable = true; didn't do the trick for me.

[scientificworld]

I'm running into the exact same error. How did you use dnsmasq instead of systemd-network @scientificworld ?

services.dnsmasq.enable = true; didn't do the trick for me.

Try to add services.resolved.enable = false;?

[attrr]

systemd.network#DefaultRouteOnDevice= says

Takes a boolean. If set to true, sets up the IPv4 default route bound to the interface.

and

If you'd like to create an IPv6 default route bound to the interface, please use the following: [Route] Gateway=:: Table=1234

So I think if you want IPv6 default route bound to the interface, you need to do something like this:

routes = [
  { routeConfig.Gateway = "::"; }
];

[ghost]

@scientificworld That did it! Thanks

Had to add

services.resolved.enable = false;

networking.resolvconf = {
  enable = true;
  extraConfig = "name_servers='1.1.1.1'";
};

(nameserver can be any valid nameserver e.g from https://servers.opennic.org/)