Change:
The tinc nixos service currently has : I have found that in rare cases this can lead to the error on startup In particular, the systemd service created by can fail; it runs : I suspect that this is because it races with the tinc , which itself creates the tun device, so if tinc creates the interface first and starts sending data on it, the service can't do its / setting on the running device. Note I'm using tinc 1.1 pre here (). As per the (just before section ), tinc is OK with the user creating the interface first (with ). However, I think the problem here is that our nixos service's systemd configuration doesn't ensure it runs after that script has finished. Also, it is not clear to me why was used in the first place. As the manual says: if tinc quit, although this is normally not required. It can be useful to set up a tun/tap interface owned by a non-root user, so tinc can be started without needing any root privileges at all. The typical motivation here is to have tinc run without root priviliges. But our nixos service seem to need that. It and uses to drop privileges to that user after it has created the VPN tun network device as root. So I don't think the is needed, and it seems I can run it all fine without that entry (so far; the error only happens on some of my nixops deploys). could you let me know why you it in the ? CC the tinc service commiters
You can probably just drop from the tinc service.
For me, this still happens on NixOS 18.03 and tinc 1.0.
backport:
Upon a reboot of 18.09 machines tinc no longer links at startup here, so this is breakage entering 18.09 :/ unless it's the bump to 1.1pre17, but the failure mode makes me think it's a bug in the updated nixos module. I'm getting and the route to the interface not being set. Currently investigating further.
we also notice this yesterday. One needs to use in as shown here Sorry for breaking configuration I did not notice that because networkd is doing this automatically. In the long run this is the better approach because currently it is very racy and delays the boot significantly. It would be great if we can add this to the release notes as well.
OK so I think this is due to using to configure the tinc address: tinc creates the interface long after has failed. As a consequence, somehow the device never gets up (as shown by ) and tinc fails to actually exchange data, even though tinc shows as correctly linked everywhere. I suggest reverting this change on 18.09 and documenting as a backwards-compatibility-breaking change for 19.03 that using tinc with static addresses set via now requires a manual setting for the and parameters. I can confirm that adding these two parameters to my local configuration fixes tinc here.
I reverted back to the old behavior:
I need a release note entry or a better fix for 19.03.
Do you have an idea of what to put as release note entry? AFAIU it's the last thing that prevents this issue from being closed, and ideally it'd be made before a 19.03 cutoff, but I'm not sure what exactly can be written. Maybe something along the lines of “The tinc module now waits until tinc starts up to create its interface, you may need to set virtual and virtualType if you relied on it being available at boot”?
Thank you for your contributions. This has been automatically marked as stale because it has had no activity for 180 days. If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity. Here are suggestions that might help resolve this more quickly: for maintainers and people that previously touched the related code and @ mention them in a comment. on the . on the on .
It's too late for release notes now... This is part of nixos for quite a while

Discussion:
} )); <del> networking.interfaces = flip mapAttrs' cfg.networks (network: data: nameValuePair ("tinc.${network}") ({ virtual = true; virtualType = "${data.interfaceType}"; }) ); </del> systemd.services = flip mapAttrs' cfg.networks (network: data: nameValuePair ("tinc.${network}") ({