ipv6

coreos/cirrus.yaml

@@ -16,6 +16,27 @@ storage:
       user: { id: 65532 }
       group: { id: 65532 }
   files:
+    - path: /etc/hostname
+      mode: 0644
+      contents:
+        inline: cirrus.traberph.de
+    # netcup: IPv4 via DHCP, IPv6 static (no router advertisements, gateway is always fe80::1)
+    - path: /etc/NetworkManager/system-connections/ens3.nmconnection
+      mode: 0600
+      contents:
+        inline: |
+          [connection]
+          id=ens3
+          type=ethernet
+          interface-name=ens3
+
+          [ipv4]
+          method=auto
+
+          [ipv6]
+          method=manual
+          address1=2a03:4000:2:83c::1/64
+          gateway=fe80::1
     # Edge SSH host key (connectors pin its public half). Kept only locally in coreos/.secrets/
     # (gitignored), so back it up outside this folder. Build: butane --files-dir coreos ...
     - path: /var/lib/sish/keys/ssh_host_ed25519_key
@@ -118,6 +139,9 @@ storage:
           AddCapability=CAP_NET_BIND_SERVICE
           NoNewPrivileges=true
           ReadOnly=true
+          # sish creates a temp file per forward. The automatic read-only /tmp tmpfs copies the
+          # image's /tmp (root, 755), so uid 65532 can't write there: give it a plain sticky /tmp.
+          Tmpfs=/tmp:rw,nosuid,nodev,noexec,size=16m,mode=1777,notmpcopyup
           Volume=/etc/sish:/config:ro,Z
           Volume=/var/lib/sish/keys:/keys:ro,Z
           Volume=/var/lib/sish/pubkeys:/pubkeys:ro,Z