ECS-Public-Infra/Create-Templates
Watch
2
0
Fork
You've already forked Create-Templates
 0
Code Issues 6 Pull requests 2 Projects Releases 20 Packages 2 Wiki Activity Actions

fix: refresh rebuild, IPv6/DNS policy, ifupdown2 + dhcp-wait boot fix, Ubuntu 24.04/26.04 — LXC 1.6.3→1.6.7 / qemu 0.2.3→0.2.9 #19

Merged
hclaude merged 12 commits from fix/refresh-security-suites-163 into master 2026-10-25 18:21:12 +00:00
Conversation 0 Commits 12 Files changed 15 +1242 -131
hclaude commented 2026-09-17 22:07:59 +00:00
Owner
Copy link

Summary

Package-refresh rebuild of both tracks — LXC 1.6.3 / qemu 0.2.3 (1.6.2 / 0.2.2 were built 2026-07-08; 58–202 packages per artifact had newer versions). The rebuild exposed four pre-existing recipe bugs; a plain rebuild would not have produced good images. Refs ECS-Infrastructure/stalwart-deploy#46.

Tag Track Bug Fix
SUITES-1 VM mmdebstrap got only the bare release suite → images built without -updates/-security and shipped a one-line sources.list; deployed VMs never received security updates via apt (Ubuntu 0.2.2 = April-2024 GA kernel/openssl/openssh) extra <suite>-updates / <suite>-security MIRROR args (DEB13_SECURITY_MIRROR for Debian)
GRUB-1 VM Ubuntu qcow2 unbootable in 0.2.1 + 0.2.2: guestfish PASS 2 aborted at mount -t sysfs (EBUSY under noble's mount), so grub-install never ran — and the image was published anyway failure-tolerant mounts (-command), fatal assert on grub.cfg + core.img, main() returns failed-target count (was always exit 0)
CYCLE-1 VM ecs-firstboot.service After=cloud-final + Before=nullmailer = ordering cycle; systemd skipped both nullmailer.service and ecs-firstboot.service on every Debian/Ubuntu VM boot order after cloud-init's network (hostname) stage; cloud-final runcmd still re-runs the idempotent finaliser
REFRESH-1 LXC no chroot phase ever upgraded the debootstrap base set → release-pocket versions regardless of build date (Ubuntu: 48 GA-era pkgs incl. apt, dpkg, libgnutls30, libpam*, zlib1g) apt-get dist-upgrade after each phase's first apt-get update

Also: CLAUDE.md stale-fact corrections (separate commit, targeted edits only).

Verification (Hclaude01 build host)

  • All 7 artifacts: 0 outdated packages vs release+updates+security indices (was 58–202).
  • LXC: zstd -t OK; package-name set unchanged by the dist-upgrade (versions only — Devuan still pure OpenRC); no ssh host keys, no leftover build-time apt sandbox conf, VCS="git", ecs-firstboot installed, nullmailer placeholders intact.
  • VM: all three qcow2 boot to a login prompt under TCG (kernels 6.12.107 / 6.8.0-139), GRUB_CFG_OK + CORE_IMG_OK, no ordering cycle, nullmailer.service started, three suites in the shipped sources.list, zfs 2.4.4 module built (Devuan/Debian), qemu-img check clean.
  • Baseline: the published Ubuntu 0.2.2 qcow2 hangs at "Booting from Hard Disk..." — /boot/grub/ has no grub.cfg / core.img.

Not yet run: test-devuan-template.sh (needs pct on a PVE node) and a PVE boot with a real NoCloud drive.

Follow-ups (not in this PR)

  • Publish lxc-templates/1.6.3 + qemu-images/0.2.3 (then prune 1.6.2 / 0.2.2 files from latest/); decide what to do with the unbootable Ubuntu qcow2 in qemu-images/0.2.2/.
  • Already-deployed 0.2.x VMs still lack -updates/-security sources, and on Debian/Ubuntu nullmailer is not starting — fix by hand or re-provision.
  • networking.service shows FAILED on VMs: /etc/network/interfaces hardcodes auto eth0 but NICs get predictable names (no net.ifnames=0). Design call, left alone.
  • stalwart-deploy config.env _TPL_VERSION → 1.6.3 once published.

Scope since opened

The branch kept going after 1.6.3 / 0.2.3; every version below is built, verified, published to the generic registry and has a Release. latest/ of both packages points at 1.6.7 / 0.2.9. Refs ECS-Infrastructure/stalwart-deploy#46 throughout.

LXC qemu Commit What
1.6.4 0.2.4 23d2f0c, a17c915 SLAAC-1 / DNS-1 / NET-1 / NET-2: IPv6 SLAAC (EUI-64) + DNS from RA everywhere; resolvconf as arbiter (rdnssd → PVE → DHCP → Quad9); ecs-resolvconf-pve (LXC); no eth0/lo stanzas in VM interfaces; ORDER-1: Devuan VM cloud-init-local in sysinit before networking
— 0.2.5 5672d07 GETTY-1: Devuan VM VGA gettys tty1/tty2
1.6.5 0.2.6 36e5765 NET-3: ifupdown2 + isc-dhcp-client on Devuan/Debian (PVE parity), native OpenRC networking for ifupdown2; UBUNTU-26.04: Ubuntu target → 26.04 Resolute (ubuntu-2604-ecs01)
— 0.2.7 a8faac8 CI-ECS-1: 99_ECS_stuff.cfg (ssh_deletekeys: false); PLIK-1: plik client in VM images
1.6.6 0.2.8 fdf7360, d9a17cf DHCP-1: 1.6.5/0.2.6 regression — inet dhcp + inet6 auto (PVE ip=dhcp,ip6=auto) hung the boot forever in dhclient -6 (ifupdown2 squashes stanzas, dhcp-wait default yes); fixed with policy.d/ecs.json dhcp-wait: no. SLAAC-2: ecs-slaac hook works under ifupdown2's once-per-interface call. TEST-1: smoke-test fixes. DHCP-2 known/not fixed: inet dhcp first ⇒ later inet6 static address not applied
1.6.7 0.2.9 0edf3fa, 0c20c59 Ubuntu 24.04 Noble target back alongside 26.04 (ubuntu-2404-ecs01, shared build_ubuntu_ecs01); SHUTDOWN-1 on the Devuan VM (openrc-shutdown wrappers); publisher release notes with links + per-file forgejo-curl, SHA256SUMS replaced on every publish

Verification per version is in the commit messages and the Version history header of src/build-devuan-template.sh (the single changelog, VM entries as 0.2.x). 1.6.6/0.2.8 were reproduced and verified in a namespace boot rig on the build host with the failing container's exact interfaces plus TCG boots of all qcow2s with a dhcp4+slaac NoCloud seed.

Follow-ups above: publishing is done (through 1.6.7 / 0.2.9, latest/ pruned). The stalwart-deploy _TPL_VERSION item is dropped — consumers pin their own version (see CLAUDE.md). Still open on #46: residual background dhclient -6 -nw on inet dhcp+inet6 auto, DHCP-2.

🤖 Generated with Claude Code

https://claude.ai/code/session_013U8XziS5kY5uAzvg2q376f
https://claude.ai/code/session_018ZfNrBbAL6NqdfR43ZL3AS

## Summary Package-refresh rebuild of both tracks — **LXC 1.6.3 / qemu 0.2.3** (1.6.2 / 0.2.2 were built 2026-07-08; 58–202 packages per artifact had newer versions). The rebuild exposed four pre-existing recipe bugs; a plain rebuild would not have produced good images. Refs ECS-Infrastructure/stalwart-deploy#46. | Tag | Track | Bug | Fix | |---|---|---|---| | **SUITES-1** | VM | mmdebstrap got only the bare release suite → images built without `-updates`/`-security` **and shipped a one-line `sources.list`**; deployed VMs never received security updates via apt (Ubuntu 0.2.2 = April-2024 GA kernel/openssl/openssh) | extra `<suite>-updates` / `<suite>-security` MIRROR args (`DEB13_SECURITY_MIRROR` for Debian) | | **GRUB-1** | VM | **Ubuntu qcow2 unbootable in 0.2.1 + 0.2.2**: guestfish PASS 2 aborted at `mount -t sysfs` (EBUSY under noble's mount), so `grub-install` never ran — and the image was published anyway | failure-tolerant mounts (`-command`), fatal assert on `grub.cfg` + `core.img`, `main()` returns failed-target count (was always exit 0) | | **CYCLE-1** | VM | `ecs-firstboot.service` `After=cloud-final` + `Before=nullmailer` = ordering cycle; systemd skipped **both `nullmailer.service` and `ecs-firstboot.service` on every Debian/Ubuntu VM boot** | order after cloud-init's network (hostname) stage; cloud-final `runcmd` still re-runs the idempotent finaliser | | **REFRESH-1** | LXC | no chroot phase ever upgraded the debootstrap base set → release-pocket versions regardless of build date (Ubuntu: 48 GA-era pkgs incl. apt, dpkg, libgnutls30, libpam*, zlib1g) | `apt-get dist-upgrade` after each phase's first `apt-get update` | Also: `CLAUDE.md` stale-fact corrections (separate commit, targeted edits only). ## Verification (Hclaude01 build host) - All 7 artifacts: **0 outdated packages** vs release+updates+security indices (was 58–202). - LXC: `zstd -t` OK; package-**name** set unchanged by the dist-upgrade (versions only — Devuan still pure OpenRC); no ssh host keys, no leftover build-time apt sandbox conf, `VCS="git"`, `ecs-firstboot` installed, nullmailer placeholders intact. - VM: all three qcow2 **boot to a login prompt** under TCG (kernels 6.12.107 / 6.8.0-139), `GRUB_CFG_OK` + `CORE_IMG_OK`, no ordering cycle, `nullmailer.service` started, three suites in the shipped `sources.list`, zfs 2.4.4 module built (Devuan/Debian), `qemu-img check` clean. - Baseline: the **published** Ubuntu 0.2.2 qcow2 hangs at "Booting from Hard Disk..." — `/boot/grub/` has no `grub.cfg` / `core.img`. **Not yet run:** `test-devuan-template.sh` (needs `pct` on a PVE node) and a PVE boot with a real NoCloud drive. ## Follow-ups (not in this PR) - Publish `lxc-templates/1.6.3` + `qemu-images/0.2.3` (then prune 1.6.2 / 0.2.2 files from `latest/`); decide what to do with the unbootable Ubuntu qcow2 in `qemu-images/0.2.2/`. - Already-deployed 0.2.x VMs still lack `-updates`/`-security` sources, and on Debian/Ubuntu nullmailer is not starting — fix by hand or re-provision. - `networking.service` shows FAILED on VMs: `/etc/network/interfaces` hardcodes `auto eth0` but NICs get predictable names (no `net.ifnames=0`). Design call, left alone. - `stalwart-deploy` `config.env` `_TPL_VERSION` → 1.6.3 once published. ## Scope since opened The branch kept going after 1.6.3 / 0.2.3; every version below is built, verified, published to the generic registry and has a Release. `latest/` of both packages points at 1.6.7 / 0.2.9. Refs ECS-Infrastructure/stalwart-deploy#46 throughout. | LXC | qemu | Commit | What | |---|---|---|---| | 1.6.4 | 0.2.4 | 23d2f0c, a17c915 | **SLAAC-1 / DNS-1 / NET-1 / NET-2**: IPv6 SLAAC (EUI-64) + DNS from RA everywhere; resolvconf as arbiter (rdnssd → PVE → DHCP → Quad9); `ecs-resolvconf-pve` (LXC); no eth0/lo stanzas in VM `interfaces`; **ORDER-1**: Devuan VM cloud-init-local in sysinit before networking | | — | 0.2.5 | 5672d07 | **GETTY-1**: Devuan VM VGA gettys tty1/tty2 | | 1.6.5 | 0.2.6 | 36e5765 | **NET-3**: ifupdown2 + isc-dhcp-client on Devuan/Debian (PVE parity), native OpenRC `networking` for ifupdown2; **UBUNTU-26.04**: Ubuntu target → 26.04 Resolute (`ubuntu-2604-ecs01`) | | — | 0.2.7 | a8faac8 | **CI-ECS-1**: `99_ECS_stuff.cfg` (`ssh_deletekeys: false`); **PLIK-1**: plik client in VM images | | 1.6.6 | 0.2.8 | fdf7360, d9a17cf | **DHCP-1**: 1.6.5/0.2.6 regression — `inet dhcp` + `inet6 auto` (PVE `ip=dhcp,ip6=auto`) hung the boot forever in `dhclient -6` (ifupdown2 squashes stanzas, `dhcp-wait` default yes); fixed with `policy.d/ecs.json` `dhcp-wait: no`. **SLAAC-2**: `ecs-slaac` hook works under ifupdown2's once-per-interface call. **TEST-1**: smoke-test fixes. **DHCP-2** known/not fixed: `inet dhcp` first ⇒ later `inet6 static` address not applied | | 1.6.7 | 0.2.9 | 0edf3fa, 0c20c59 | Ubuntu **24.04 Noble** target back alongside 26.04 (`ubuntu-2404-ecs01`, shared `build_ubuntu_ecs01`); **SHUTDOWN-1** on the Devuan VM (openrc-shutdown wrappers); publisher release notes with links + per-file `forgejo-curl`, SHA256SUMS replaced on every publish | Verification per version is in the commit messages and the `Version history` header of `src/build-devuan-template.sh` (the single changelog, VM entries as `0.2.x`). 1.6.6/0.2.8 were reproduced and verified in a namespace boot rig on the build host with the failing container's exact `interfaces` plus TCG boots of all qcow2s with a dhcp4+slaac NoCloud seed. Follow-ups above: publishing is done (through 1.6.7 / 0.2.9, `latest/` pruned). The `stalwart-deploy` `_TPL_VERSION` item is dropped — consumers pin their own version (see `CLAUDE.md`). Still open on #46: residual background `dhclient -6 -nw` on `inet dhcp`+`inet6 auto`, DHCP-2. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_013U8XziS5kY5uAzvg2q376f https://claude.ai/code/session_018ZfNrBbAL6NqdfR43ZL3AS 
Targeted corrections only; structure and wording otherwise unchanged:
- repo is ECS-Public-Infra/Create-Templates (public), not ECS-Infrastructure
- VM track exists (build-cloud-image.sh), no longer just a proposal
- four LXC templates, not three; build-all runs ubuntu in parallel too and
  pre-installs ubuntu-keyring
- UBUNTU_MIRROR default is archive.ubuntu.com, not a guessed ECS host
- nullmailer relay creds are provision-time placeholders since 1.5.7
- two independent TEMPLATE_VERSION tracks (LXC 1.x / qemu 0.x, VM_<ver> tags);
  Refs: #N issues live on ECS-Infrastructure/stalwart-deploy
- ECS01_PACKAGES is duplicated across both builders + the test script
- layout: add ecs-firstboot and docs/qemu-vm-plan.md

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013U8XziS5kY5uAzvg2q376f
Package-refresh rebuild of both tracks (1.6.2 / 0.2.2 were built 2026-07-08;
58-202 packages per artifact had newer versions). The rebuild exposed four
pre-existing recipe bugs, fixed here:

SUITES-1 (VM): mmdebstrap was given only the bare release suite, so images
were built without -updates/-security AND shipped a one-line sources.list —
deployed VMs never received security updates via apt (Ubuntu 0.2.2 carried
the April-2024 GA kernel/openssl/openssh). Pass <suite>-updates and
<suite>-security as extra MIRROR args (Debian security via
DEB13_SECURITY_MIRROR=security.debian.org, matching the LXC builder).

GRUB-1 (VM): the Ubuntu qcow2 was unbootable in 0.2.1 and 0.2.2. guestfish
PASS 2 aborted at `mount -t sysfs none /sys` (EBUSY under noble's mount(8);
libguestfs already bind-mounts /sys per command), so grub-install and
update-grub never ran, yet the image was published. The three mounts are now
failure-tolerant (`-command`), a missing grub.cfg/core.img is fatal, and
main() returns the number of failed targets instead of always exiting 0.

CYCLE-1 (VM): ecs-firstboot.service was After=cloud-final.service +
Before=nullmailer.service. cloud-final is After=multi-user.target, so this
was an ordering cycle that systemd broke by skipping BOTH nullmailer.service
and ecs-firstboot.service on every Debian/Ubuntu VM boot. Order after
cloud-init's network (hostname) stage instead; the cloud-final runcmd still
re-runs the idempotent finaliser.

REFRESH-1 (LXC): no chroot phase ever upgraded the debootstrap base set, so
it shipped at release-pocket versions regardless of build date (Ubuntu: 48
GA-era packages incl. apt, dpkg, libgnutls30, libpam*, zlib1g). Each phase
now runs `apt-get dist-upgrade` after its first `apt-get update`.

Verified on the Hclaude01 build host: all 7 artifacts at 0 outdated packages
vs release+updates+security indices; LXC package-name set unchanged by the
dist-upgrade; all three qcow2 boot to a login prompt under TCG with GRUB
installed, no ordering cycle, nullmailer started, and the three suites in
the shipped sources.list. Not yet run: test-devuan-template.sh (needs pct on
a PVE node) and a PVE boot with a real NoCloud drive.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013U8XziS5kY5uAzvg2q376f
- CLAUDE.md / README.md: replace the "cross-repo coupling / coordination
  constant" wording. This repo is consumer-agnostic — which template version
  stalwart-deploy (or anything else) deploys is that repo's business; nothing
  here needs syncing on a bump. The only contract is the dateless artifact name.
- CLAUDE.md layout: add ecs-slaac-hook, ecs-ipv6-slaac.sysctl,
  ecs-resolvconf-pve, hvisage-authorized_keys, hvisage-zshrc.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013U8XziS5kY5uAzvg2q376f
Policy: every image always does IPv6 SLAAC with an EUI-64 address and takes
DNS from the RA (RDNSS); IPv4 is mostly static, DHCPv4 the exception; a static
IPv6 address is additional, never instead of SLAAC.

SLAAC-1 (all LXC templates + VM images)
- sysctl.d/60-ecs-ipv6-slaac.conf: accept_ra/autoconf on, addr_gen_mode=0,
  use_tempaddr=0.
- dhcpcd.conf `ipv4only`: on every DHCPv4 instance dhcpcd took over IPv6 and
  replaced the kernel's EUI-64 SLAAC with RFC 7217 addresses (link-local too).
- if-up.d/ecs-slaac (src/ecs-slaac-hook): ifupdown's "inet6 static" disables
  RA/autoconf by default, so a static IPv6 address silently killed SLAAC. The
  hook re-enables them, keeps the static address as outbound source (default
  route prefsrc, RA route demoted to metric 2048), and solicits an RA on every
  ifup (rdisc6) — rdnssd only learns RDNSS from RAs it sees after it started.

DNS-1 (ECS01 templates + VM images)
- rdnssd + ndisc6 everywhere; resolvconf as arbiter on Debian/Devuan with
  order 000.rdnssd -> PVE nameservers (lo.pve / lo.inet) -> DHCP -> Quad9 tail.
  RDNSS previously reached resolv.conf only by accident (dhcpcd) and
  PVE/cloud-init `dns-nameservers` were silently ignored (no resolvconf).
- rdnssd ordered before networking (OpenRC boot runlevel; systemd drop-in with
  DefaultDependencies=no — stock defaults closed a cycle through basic.target).
- LXC: src/ecs-resolvconf-pve imports the plain /etc/resolv.conf PVE writes at
  every container start (rename-over kills the symlink) as record lo.pve and
  restores the symlink.
- resolvconf is debconf-preseeded (no linkify) so it never touches resolv.conf
  in the build chroot; symlink created after the last chroot apt.
- Ubuntu noble ships no resolvconf/openresolv: rdnssd built-in merge only.

NET-1/NET-2 (VM): no eth0/lo stanzas in /etc/network/interfaces (ifupdown
merged them with cloud-init's: DHCP client on static VMs; empty lo.inet record
wiped PVE's DNS). Standalone: net.ifnames=0; default "DHCPv4 + inet6 auto"
shipped AS cloud-init's eni output file so it can never coexist with a real
config; hvisage user (sudo NOPASSWD, keys, zsh) baked in; cloud-init's fallback
netcfg patched to dhcp6=False (ifupdown's inet6 dhcp only accepts ISC dhclient
-> "No DHCPv6 client software found!" failed networking.service since 0.1.0).

HOME-1: ecs-firstboot defaults HOME=/root — services and cloud-init runcmd run
without it, `git config --global` died, the unit FAILED and etckeeper was not
initialised at first boot on any instance with a real hostname.
VSOCK-1 (VM): mask systemd-ssh-generator (AF_VSOCK log spam on Debian 13).

hvisage keys + .zshrc moved to src/ payload files shared by both builders.
test-devuan-template.sh: sections K2 (SLAAC-1), S (HOME-1), T (DNS-1).

Verified (Hclaude01, TCG, PVE-style NoCloud seeds) on the Debian VM image:
static4, static4+static6, static4+ip6=auto, dhcp4, no network-config, no
datasource — EUI-64 SLAAC in all, static source preferred, no DHCP client on
static VMs, resolv.conf = RDNSS, PVE, DHCP, Quad9; networking/ecs-firstboot/
rdnssd/resolvconf/nullmailer active; importer logic exercised in-VM. LXC:
artifact inspection only — NOT yet run in a PVE container.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013U8XziS5kY5uAzvg2q376f
On Devuan, ifupdown's LSB script (Default-Start: S, /etc/rcS.d/S13networking)
runs in OpenRC's sysinit runlevel — before the boot and default runlevels even
start. cloud-init-local sat in "default", so PVE's network-config was rendered
after networking had already configured eth0: a static IPv4/IPv6 assignment
was not applied on first boot. Through 0.2.3 the template's DHCP stanza masked
it. The shim's "before net" never matched either: the script provides
"networking"/"ifupdown", not "net".

The builder now patches the installed shim (before net networking ifupdown;
after localmount mountall.sh mountall-bootclean.sh eudev udev) and moves it to
the sysinit runlevel, with fatal asserts. Should go upstream as patch 0005 of
the cloud-init Devuan series.

Verified (TCG, PVE-style NoCloud seeds): static4, static4+static6,
static4+ip6=auto, dhcp4, no network-config, no datasource — config applied on
first boot, no DHCP client on static VMs, static source preferred, resolv.conf
= RDNSS, PVE, DHCP, Quad9. Version-history entry extended (comment only).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013U8XziS5kY5uAzvg2q376f
The Devuan VM image only enabled agetty.ttyS0. On a VGA/noVNC console the
boot ended after the last service ("Sharing ZFS filesystems .") with no login
prompt, which looked like a hang after cloud-init finished. OpenRC does not
spawn gettys implicitly, so agetty.tty1 and agetty.tty2 are now linked and
added to the default runlevel. systemd images (Debian/Ubuntu) already get
getty@tty1 and are unaffected.

Verified by mounting the 0.2.5 image: agetty.tty1/tty2/ttyS0 present in
/etc/runlevels/default. Not yet boot-tested on PVE.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nk48c3g9RXVCa6WuWGswPM
NET-3: Devuan and Debian 13 ECS01 containers and VM images replace
ifupdown + dhcpcd-base with ifupdown2 + isc-dhcp-client + ethtool (PVE-host
parity, macvlan/address-virtual). ifupdown2 ships no OpenRC script, so Devuan
gets a native /etc/init.d/networking (src/ecs-networking-openrc) running
ifupdown2's start-networking. Ubuntu keeps ifupdown + dhcpcd (no ifupdown2
package in noble or resolute).

UBUNTU-26.04: Ubuntu target moves 24.04 Noble -> 26.04 LTS Resolute; target
renamed ubuntu-2604-ecs01 (aliases ubuntu/ubuntu26/ubuntu2604).

Boot-tested under TCG: all three VM images reach login with DHCPv4 + SLAAC.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
CI-ECS-1: /etc/cloud/cloud.cfg.d/99_ECS_stuff.cfg is the single home for ECS
cloud-init settings. First entry ssh_deletekeys: false, so SSH host keys are
generated once at first boot and not regenerated whenever the PVE cloud-init
instance-id changes.

PLIK-1: VM images now ship the plik client and /etc/plik/plikrc, as the LXC
ECS01 bundle already did. Downloaded with curl --noproxy "*" (the build's
https_proxy is the apt-cacher, which answers 403 to CONNECT).

Boot-tested under TCG: all three images reach login, DHCPv4 + SLAAC up, host
keys generated at first boot.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nk48c3g9RXVCa6WuWGswPM
DHCP-1: ifupdown2 3.0.0 squashes every stanza of an interface into one
object (addr_method = first stanza, families = all), so PVE's
"iface eth0 inet dhcp" + "iface eth0 inet6 auto" (ip=dhcp,ip6=auto) starts
dhclient AND dhclient -6 and waits for both to daemonize (dhcp-wait=yes).
ISC dhclient -6 never daemonizes without a DHCPv6 server, so `ifup -a`
never returned, the networking service never finished and nothing after it
started (cron, ecs-firstboot, nullmailer, ssh). Seen on CT "pega" with
1.6.5; Debian 13 (oneshot networking.service, no start timeout) and the
Devuan/Debian VM images had the same hole. Ship
src/ecs-ifupdown2-policy.json as /etc/network/ifupdown2/policy.d/ecs.json
(dhcp-wait: no -> dhclient -nw) on every ifupdown2 image, both builders.

SLAAC-2: the ecs-slaac if-up.d hook assumed ifupdown's per-family calls;
ifupdown2 calls it once per interface with ADDRFAM=inet,inet6 and IPv4
IF_* only, so the "static preferred" branch never ran on 1.6.5. The hook
now also detects a static v6 address on the live interface and the non-RA
default route, waits for DAD, and serves both ifupdown and ifupdown2.

DHCP-2 (known, not fixed): with "inet dhcp" first, ifupdown2 does not
apply a following "inet6 static" address — use a static ip= when a static
v6 is wanted.

TEST-1: test-devuan-template.sh no longer demands isc-dhcp-client absent
on ifupdown2 images, checks the DHCP-1 policy, skips the dhcpcd check where
dhcpcd is absent, and skips plain files in /sys/class/net
(bonding_masters).

Verified: namespace-boot rig on the build host with pega's exact
interfaces — Devuan 1.6.6 sshd listening in ~45 s, Debian 1.6.6
networking.service finished in 3 s; qcow2 0.2.8 Devuan + Debian boot under
TCG with a dhcp4+slaac NoCloud seed, ifup returns, dhclient -6 -nw parked.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ZfNrBbAL6NqdfR43ZL3AS
publish-to-forgejo.sh ends a release-notes excerpt at the next comment line
that begins with X.Y.Z; the 1.6.6 entry's second line began with
"1.6.5 / 0.2.6", so the v1.6.6 release notes carried one line of Changes.
Comment-only change; artifacts are unaffected.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ZfNrBbAL6NqdfR43ZL3AS
Second Ubuntu LTS target ubuntu-2404-ecs01 (aliases ubuntu24/ubuntu2404).
build_ubuntu_ecs01 is shared; select_ubuntu picks version/suite/rootfs.
VM builder gains ubuntu2404 target; build-all runs a 4th pipeline.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nk48c3g9RXVCa6WuWGswPM
Devuan VM ran openrc-init but kept sysvinit-utils shutdown/reboot, which need
/run/initctl ("could not determine runlevel"). Divert to openrc-shutdown
wrappers as the LXC builder has since 1.5.2.

publish-to-forgejo.sh: release notes link each artifact + the package page and
list per-file forgejo-curl commands; existing releases get their notes updated;
the versioned SHA256SUMS is replaced on every publish.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nk48c3g9RXVCa6WuWGswPM
hclaude changed title from fix: refresh rebuild + VM security suites, Ubuntu GRUB, systemd cycle (LXC 1.6.3 / qemu 0.2.3) to fix: refresh rebuild, IPv6/DNS policy, ifupdown2 + dhcp-wait boot fix, Ubuntu 24.04/26.04 — LXC 1.6.3→1.6.7 / qemu 0.2.3→0.2.9 2026-10-25 18:20:56 +00:00
hclaude merged commit 8d860f9d8d into master 2026-10-25 18:21:12 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ECS-Public-Infra/Create-Templates!19
No description provided.