Enable networkd by default #264967

lheckemann · 2023-11-02T07:58:49Z

Description of changes

Continuation of #202488

Things done

Ma27 · 2023-11-02T14:35:50Z

So I just copied over the todolist from the previous PR and updated the checkboxes accordingly. If someone else thinks something's missing there, feel free to add it.

Ma27 · 2023-11-02T14:46:12Z

re "Talk about useDHCP and anyInterface some more -- do the defaults make sense?": the change that was made in the previous PR is now in master since #258345. Apparently this is what upstream suggests and there's no way with systemd 254 to avoid a timeout of wait-online if no RequiredForOnline ifs are up.

The behavior may not be much of an issue with #258680 being merged (network-online.target doesn't depend on multi-user.target anymore with it), so the system should boot up properly even with no ifs available.

mohe2015 · 2023-11-03T08:55:44Z

nixos/modules/services/networking/nsd.nix

@@ -924,6 +924,8 @@ in
      description = "NSD authoritative only domain name service";

      after = [ "network.target" ];
+      # Ensure that knot can bind port 53 before systemd-resolved's stub resolver attempts to.


Suggested change

# Ensure that knot can bind port 53 before systemd-resolved's stub resolver attempts to.

# Ensure that nsd can bind port 53 before systemd-resolved's stub resolver attempts to.

mohe2015 · 2023-11-03T08:56:12Z

nixos/modules/services/networking/tinydns.nix

@@ -42,6 +42,9 @@ with lib;
      description = "djbdns tinydns server";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
+      # Ensure that pdns-recursor can bind port 53 before systemd-resolved's stub resolver attempts to.


Suggested change

# Ensure that pdns-recursor can bind port 53 before systemd-resolved's stub resolver attempts to.

# Ensure that tinydns can bind port 53 before systemd-resolved's stub resolver attempts to.

DanielSidhion · 2023-11-03T14:06:42Z

I'm just jumping in so forgive me if there are already plans to deal with this, but from my experience, having both systemd-networkd and dhcpcd enabled by default causes issues with (at least) DHCP and IPv6, leading to the system being unable to set an IPv6 address on the relevant interface.
I had to disable dhcpcd after enabling systemd-networkd for my system to properly deal with DHCP and IPv6. Are there any plans to disable dhcpcd by default now, or is there any other way to solve this issue?

Ma27 · 2023-11-03T15:06:16Z

That should be solved by this PR: networking.dhcpcd.enable = mkDefeault false; is set if networking.useNetworkd = true; which will be true by default with this PR.

I assume you have systemd.network.enable = true;, but not networking.useNetworkd = true;?
(If not this is something to look into)

adamcstephens · 2023-11-03T15:13:53Z

I think that case should be covered now the warning added in #256598

DanielSidhion · 2023-11-03T15:31:58Z

networking.useNetworkd = true; indeed covers this. It's something that I missed and led to the same observations described in #256598, so this should be completely covered now!

SuperSandro2000 · 2023-11-05T15:59:41Z

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -18,6 +18,10 @@
      into a satisfying solution regarding this problem.
    - Updating with `nixos-rebuild boot` and rebooting is recommended, since in some rare cases the `nixos-rebuild switch` into the new generation on a live system might fail due to missing mount units.

+
+- NixOS now uses [systemd-networkd](#opt-systemd.network.enable) as its default networking backend. With networkd, many network configurations which previously required use of [](#opt-networking.localCommands) can be expressed declaratively. Networkd's connection management is also significantly more reliable than the scripted networking implementation previously in use by default. If you wish to continue using scripted networking, set [](#opt-networking.useNetworkd) to `false`.
+- This also means that systemd-resolved is enabled by default. Its stub resolver will bind to port 53 if it is not occupied, which may result in other DNS servers failing to start.


I really would love to use resolved but the more I use it the buggier it gets. For example DNSSEC=yes is incredible unreliable and you can no longer connect to DB ICE WiFi. Also the feature that when a handful of DNS packets are dropped of 10'000s it disables your only resolver for 30s is pretty dumb. There are numerous issues about it in the systemd repo which are not fixed for years. (Can't link right now because of mobile)

DNSSEC validation was disabled in 4f461f7.

Its stub resolver will bind to port 53 if it is not occupied, which may result in other DNS servers failing to start.

It should be fine though?

% sudo netstat -lpn | grep systemd-resolv tcp 0 0 0.0.0.0:5355 0.0.0.0:* LISTEN 1650/systemd-resolv tcp 0 0 127.0.0.54:53 0.0.0.0:* LISTEN 1650/systemd-resolv tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 1650/systemd-resolv tcp6 0 0 :::5355 :::* LISTEN 1650/systemd-resolv udp 0 0 0.0.0.0:5353 0.0.0.0:* 1650/systemd-resolv udp 0 0 0.0.0.0:5355 0.0.0.0:* 1650/systemd-resolv udp 0 0 127.0.0.54:53 0.0.0.0:* 1650/systemd-resolv udp 0 0 127.0.0.53:53 0.0.0.0:* 1650/systemd-resolv udp6 0 0 :::5353 :::* 1650/systemd-resolv udp6 0 0 :::5355 :::* 1650/systemd-resolv unix 2 [ ACC ] STREAM LISTENING 13475 1650/systemd-resolv /run/systemd/resolve/io.systemd.Resolve unix 2 [ ACC ] STREAM LISTENING 13476 1650/systemd-resolv /run/systemd/resolve/io.systemd.Resolve.Monitor

It should be fine though?

What do you mean?
This doesn't show any other DNS servers running so you don't seem to be affected?

It doesn't listen on [::1]:53/127.0.0.1:53/[::]:53/0.0.0.0:53

Huh, I've been pretty sure that this will also break (i.e. 0.0.0.0 vs any other IP). Anyways, will check that soonish.

You are right, binding to 0.0.0.0 is not allowed when binding to the same port any other address

The next release of systemd is supposedly majorly improving this. Looking forward to that.

SuperSandro2000 · 2023-11-05T16:01:20Z

nixos/tests/knot.nix

@@ -57,6 +57,7 @@ in {
          { address = "fd00::1"; prefixLength = 64; }
        ];
      };
+


If we only touch whitespace we might as well drop those to keep the PR smaller.

The example is outdated, as NixOS's networking options have supported static IPv6 configuration for a long time now. With networkd being enabled by default, networking.localCommands loses further relevance and should only be used in extremely niche use cases -- and certainly not encouraged for use cases as common as setting IPv6 addresses.

Since networkd is now enabled by default, we no longer need to enable it explicitly.

Before this patch, `192.168.1.1` was assigned to `eth1` of `client` and DHCP was turned off (`null` is the default for `networking.interfaces.<name>.useDHCP` which means that `DHCP=no` is set if an IP is configured statically). Because of that, the static 10.0.0.10 was never assigned. The VLAN 1 (with `eth1` in it) never gets another IP assigned statically now to make sure `systemd-networkd-wait-online` doesn't succeed before 10.0.0.10 was configured via DHCP. DHCP is turned off globally (as it was before) because this means that `--any` is not set for `systemd-networkd-wait-online` and as a result it's explicitly waited for `eth1` to be ready before checking its IPs (otherwise that would happen too early because `eth0` reaches `routable`/`configured` quicker).

By default, `systemd-resolved(8)` doesn't permit querying for single-label hostnames (i.e. root zones), so the test for a custom root server requires `ResolveUnicastSingleLabel` in resolved to work. Also, run a stub listener on `::1` for the IPv6 testcases.

Underscores in hostnames are invalid and rejected by `systemd-resolved`.

SuperSandro2000 · 2024-06-16T01:03:10Z

nixos/modules/services/networking/nsd.nix

@@ -941,6 +941,8 @@ in
      description = "NSD authoritative only domain name service";

      after = [ "network.target" ];
+      # Ensure that knot can bind port 53 before systemd-resolved's stub resolver attempts to.


This should be nsd, not knot

lheckemann requested a review from mweinelt as a code owner November 2, 2023 07:58

github-actions bot added 6.topic: nixos 8.has: documentation 8.has: changelog 8.has: module (update) labels Nov 2, 2023

lheckemann mentioned this pull request Nov 2, 2023

Enable networkd by default #202488

Closed

40 tasks

ofborg bot added the 2.status: merge conflict label Nov 2, 2023

Ma27 force-pushed the networkd-default branch from 562c9de to 77d3257 Compare November 2, 2023 10:17

ofborg bot added 10.rebuild-darwin: 1-10 10.rebuild-linux: 1-10 and removed 2.status: merge conflict labels Nov 2, 2023

mohe2015 reviewed Nov 3, 2023

View reviewed changes

SuperSandro2000 reviewed Nov 5, 2023

View reviewed changes

gernotfeichter mentioned this pull request Jan 12, 2024

Clevis needs options for initrd #121636

Closed

ElvishJerricco mentioned this pull request Feb 8, 2024

nixos-generate-config: generate networkd profiles; networking: disable useDHCP by default #287105

Open

13 tasks

misuzu mentioned this pull request Mar 2, 2024

[Tracking Issue] Sunset scripted initrd and scripted networking #287308

Open

12 tasks

wegank added the 2.status: merge conflict label Mar 20, 2024

SebTM mentioned this pull request Apr 21, 2024

Switch to systemd-networkd #10001

Open

lheckemann added 6 commits June 14, 2024 19:10

nixos/networkd: enable by default

7412c1e

nixos/manual: add networkd default to release notes

a999c69

nixos/tests: remove explicit useNetworkd

405a14f

Since networkd is now enabled by default, we no longer need to enable it explicitly.

nixos/tests/powerdns: fix for networkd?

8e724e8

nixos/cloud-init: don't disable networkd

617152f

lheckemann and others added 10 commits June 14, 2024 20:28

containers: only use host resolv.conf if networkd is disabled

fa29e07

nixos/tests/ncdns: disable resolved

50559ed

fixup release-notes: link to existing option

5a75056

fix a bunch of resolved-related test failures

74200ac

fixup

a56ccab

wip

34e8f58

nixos/nsd: start before systemd-resolved.service to bind port 53

d81e816

nixos/tests/nsd: fix build

166f2ed

By default, `systemd-resolved(8)` doesn't permit querying for single-label hostnames (i.e. root zones), so the test for a custom root server requires `ResolveUnicastSingleLabel` in resolved to work. Also, run a stub listener on `::1` for the IPv6 testcases.

nixos/tests/xandikos: fix build

fce5407

Underscores in hostnames are invalid and rejected by `systemd-resolved`.

lheckemann force-pushed the networkd-default branch from bb495fb to fce5407 Compare June 14, 2024 19:53

SuperSandro2000 reviewed Jun 16, 2024

View reviewed changes

fpletz mentioned this pull request Jul 4, 2024

nixos/tests: add failing test for dnsmasq+resolved #259644

Closed

12 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable networkd by default #264967

Enable networkd by default #264967

lheckemann commented Nov 2, 2023 •

edited by Ma27

Loading

Ma27 commented Nov 2, 2023

Ma27 commented Nov 2, 2023

mohe2015 Nov 3, 2023

mohe2015 Nov 3, 2023

DanielSidhion commented Nov 3, 2023

Ma27 commented Nov 3, 2023

adamcstephens commented Nov 3, 2023

DanielSidhion commented Nov 3, 2023

SuperSandro2000 Nov 5, 2023

mweinelt Nov 6, 2023

misuzu Mar 2, 2024

Ma27 Mar 2, 2024

misuzu Mar 2, 2024

Ma27 Mar 3, 2024

misuzu Mar 3, 2024

SuperSandro2000 Apr 23, 2024

SuperSandro2000 Nov 5, 2023

SuperSandro2000 Jun 16, 2024

	# Ensure that knot can bind port 53 before systemd-resolved's stub resolver attempts to.
	# Ensure that nsd can bind port 53 before systemd-resolved's stub resolver attempts to.

	# Ensure that pdns-recursor can bind port 53 before systemd-resolved's stub resolver attempts to.
	# Ensure that tinydns can bind port 53 before systemd-resolved's stub resolver attempts to.

Enable networkd by default #264967

Are you sure you want to change the base?

Enable networkd by default #264967

Conversation

lheckemann commented Nov 2, 2023 • edited by Ma27 Loading

Description of changes

Things done

Ma27 commented Nov 2, 2023

Ma27 commented Nov 2, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DanielSidhion commented Nov 3, 2023

Ma27 commented Nov 3, 2023

adamcstephens commented Nov 3, 2023

DanielSidhion commented Nov 3, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lheckemann commented Nov 2, 2023 •

edited by Ma27

Loading