amazon-ec2-net-utils: init at 2.5.2

[commiterate]

Initialize amazon-ec2-net-utils at 2.5.2.

This includes udev rules which create systemd units and timers for refreshing systemd-networkd policies for Elastic Network Interfaces (ENIs) which can be hot-attached/detached.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[commiterate]

Need to update nixos/lib/systemd*.nix to add an installConfig attribute to systemd.services.<name>.

[commiterate]

@dasJ @ElvishJerricco Do either of you happen to know if just making the NixOS systemd libs add in a user-specified [Install] section is good enough, or is there something specific about how NixOS handles systemd units that may create complications?

For context, amazon-ec2-net-utils relies on systemd template units. When a network interface is hot-attached/detached, the udev rules will create/delete per-interface systemd service + timer units which update systemd-networkd policies and reload systemd-networkd.

https://github.com/amazonlinux/amazon-ec2-net-utils/blob/v2.5.1/udev/99-vpc-policy-routes.rules

[ElvishJerricco]

@commiterate [Install] does absolutely nothing on NixOS. That's why you'll see wantedBy defined in most services in nixos modules. We populate [Install] with the contents of the wantedBy option and its friends, but that's largely for illustrative purposes; we don't actually use the [Install] section. We've thought about changing that, but it hasn't been done yet.

[commiterate]

Good to know. Would packaging up the patched systemd units into $out and using systemd.packages = [ pkgs.amazon-ec2-net-utils ]; as suggested work around that?

[ElvishJerricco]

Even the [Install] sections of units from systemd.packages are ignored in NixOS. But, AFAICT, the [Install] sections of those upstream units are doing absolutely nothing anyway. The only thing that [Install] does is create Wants= dependencies and its friends by creating /etc/systemd/system/*.wants/* symlinks when systemctl enable is run. e.g. Having WantedBy=foo.service in the [Install] section of bar.service means that running systemctl enable bar.service will create /etc/systemd/system/foo.service.wants/bar.service -> ../bar.service.

Of course this isn't a thing on NixOS; we create those statically during system build via the systemd.$unittype.$name.wantedBy options and its friends. The Also= directive just means that when you run systemctl enable bar.service, it also does the enable operation for anything in Also=. Given that none of the units in the upstream amazon-ec2-net-utils source tree do anything like WantedBy= in their [Install] sections, that means it all does effectively nothing.

Now, I've just realized that what that udev rule does is marvelously stupid. It runs systemctl enable/disable --now on those units. This is really poorly done. First of all, as I've just discussed, the enable operation will have no effect for these units normally. But if it did, it wouldn't work on NixOS thanks to the immutable store and /etc/systemd/system/. But the --now flag causes the units to be started/stopped too. So really that udev rule should be using start and stop, not enable and disable.

Wow. Really badly done by the amazon folks. enable/disable is supposed to be an administrator's decision, not the vendor's.

You'll want to fix the rule to not be stupid, and then merely adding the upstream units to systemd.packages (with patched paths) will work.

[commiterate]

Yup, will need to get that fixed upstream.

Will swap this PR back to draft in the meanwhile as I figure out what to do. Doesn't make sense to merge this package until the systemd stuff it provides is usable.

[arianvp]

Instead of systemctl start/enable, they could use https://www.freedesktop.org/software/systemd/man/latest/systemd.device.html#SYSTEMD_WANTS= in the udev rule.

But i think this has the downside it will never stop the unit. Only start .

So they probably still want systemctl start

[commiterate]

I think removal works as long as you tag the remove udev rule as well.

systemd/systemd#7587 (comment)

[arianvp]

Actually I think systemctl enable --now might work fine if the service has no WantedBy in the install section (which is the case). It will just silently degrade to systemctl start and systemctl stop

I think we can use these udev rules as is without problems

[commiterate]

Opened an issue upstream requesting a swap to systemd device units.

amazonlinux/amazon-ec2-net-utils#112

[ElvishJerricco]

I think if I were you, I'd have the package copy those systemd units from the source tree into $out, patch up the paths to point to the nix store paths, and use systemd.packages = [ pkgs.amazon-ec2-net-utils ]; rather than duplicating the units in nix.

[commiterate]

Might want to add NixOS tests that check if the template units are available when this package is added to the systemd.packages NixOS option. I think there's some systemd-related helpers in the NixOS test utilities.

[ElvishJerricco]

Might want to add NixOS tests that check if the template units are available when this package is added to the systemd.packages NixOS option. I think there's some systemd-related helpers in the NixOS test utilities.

@commiterate That would be overkill. That's covered by the existing systemd test suite.