Incus: Difference between revisions

(2 intermediate revisions by 2 users not shown)

Line 88:

];

</syntaxhighlight>

OR, the entire ~~intreface~~ can be trusted. <syntaxhighlight lang="nix">

OR, the entire interface can be trusted. <syntaxhighlight lang="nix">

networking.firewall.trustedInterfaces = [ "incusbr0" ];

</syntaxhighlight>

Prior to version [https://nixos.org/blog/announcements/2023/nixos-2311/ NixOS 23.11 "Tapir"] the default behavior of the NixOS nftables [[Firewall]] implementation was to flush the full ruleset at any change to the nftables rules. This behavior has since been changed; however, for back-portability, it still persists in configurations with a {{nixos:option|system.stateVersion}} value set prior to <code>"23.11"</code>. This often results in the Incus ruleset table (named "incus") being wiped, resulting in loss of connectivity across VMs and containers. To prevent this from occurring on affected NixOS instances, the new implementation has to be enabled manually.<syntaxhighlight lang="nix">

networking.nftables.flushRuleset = false;

</syntaxhighlight>

Line 119:

Line 122:

Container and VM images are built by Hydra as part of the [https://github.com/NixOS/nixpkgs/blob/master/nixos/release.nix NixOS release].

https://hydra.nixos.org/job/nixos/trunk-combined/nixos.~~lxdContainerImage~~.x86_64-linux

https://hydra.nixos.org/job/nixos/trunk-combined/nixos.incusContainerImage.x86_64-linux

https://hydra.nixos.org/job/nixos/trunk-combined/nixos.incusVirtualMachineImage.x86_64-linux

~~https://hydra.nixos.org/job/nixos/trunk-combined/nixos.lxdVirtualMachineImage.x86_64-linux~~

Line 156:

Line 160:

system = "x86_64-linux";

modules = [

"${inputs.nixpkgs}/nixos/modules/virtualisation/~~lxd~~-virtual-machine.nix"

"${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"

(

{ pkgs, ... }:

@@ Line 88: / Line 88: @@
 ];
 </syntaxhighlight>
-OR, the entire intreface can be trusted. <syntaxhighlight lang="nix">
+OR, the entire interface can be trusted. <syntaxhighlight lang="nix">
 networking.firewall.trustedInterfaces = [ "incusbr0" ];
+</syntaxhighlight>
+Prior to version [https://nixos.org/blog/announcements/2023/nixos-2311/ NixOS 23.11 "Tapir"] the default behavior of the NixOS nftables [[Firewall]] implementation was to flush the full ruleset at any change to the nftables rules. This behavior has since been changed; however, for back-portability, it still persists in configurations with a {{nixos:option|system.stateVersion}} value set prior to <code>"23.11"</code>. This often results in the Incus ruleset table (named "incus") being wiped, resulting in loss of connectivity across VMs and containers. To prevent this from occurring on affected NixOS instances, the new implementation has to be enabled manually.<syntaxhighlight lang="nix">
+networking.nftables.flushRuleset = false;
 </syntaxhighlight>
@@ Line 119: / Line 122: @@
 Container and VM images are built by Hydra as part of the [https://github.com/NixOS/nixpkgs/blob/master/nixos/release.nix NixOS release].
-https://hydra.nixos.org/job/nixos/trunk-combined/nixos.lxdContainerImage.x86_64-linux
+https://hydra.nixos.org/job/nixos/trunk-combined/nixos.incusContainerImage.x86_64-linux
+https://hydra.nixos.org/job/nixos/trunk-combined/nixos.incusVirtualMachineImage.x86_64-linux
-https://hydra.nixos.org/job/nixos/trunk-combined/nixos.lxdVirtualMachineImage.x86_64-linux
@@ Line 156: / Line 160: @@
      system = "x86_64-linux";
      modules = [
-       "${inputs.nixpkgs}/nixos/modules/virtualisation/lxd-virtual-machine.nix"
+       "${inputs.nixpkgs}/nixos/modules/virtualisation/incus-virtual-machine.nix"
        (
          { pkgs, ... }: