Strict end-to-end testing against a real Incus 7 host with IPv6
pass-through enabled surfaced several issues, all fixed here:
- setup: default profile must carry root+eth0 devices even when Incus
was already initialized (preseed may leave it empty); profile devices
are now ensured on every install (scripts/10-incus.sh).
- IPv6 bridge route: Incus 7.0 does not auto-create the bridge's prefix
route when the external interface already has one, which broke the
per-container /112 routes ("no route to host"). SetupIPv6Bridge now
adds it explicitly, plus a fixed fe80::1 link-local gateway that the
dnsmasq RA advertises to containers (ipv6_filtering only permits NDP
to that address).
- RHEL IPv6: the helper now fully staticizes IPv6 — learn the gateway
from RA, disable RA processing (accept_ra=0), drop SLAAC/dynamic
addresses (they fall outside the routed /112 and get filtered), pin
the deterministic /128 + a static default route with a preferred
source, and wait for DAD so the route add cannot fail on a tentative
source. The unit retries (Restart=on-failure) until converged.
- provisioning race: wait for systemd to be ready inside the container
before hostnamectl/systemctl (4/10 adds failed with "Failed to
connect to system scope bus"); same wait in the IPv6 script.
- traefik permissions: the unprivileged panel could not write
/etc/traefik/dynamic (parent dir is root:traefik 750). vps and
traefik users are now cross-linked into each other's groups and the
dynamic dir is owned by vps (scripts/30-traefik.sh, ensureVPSUser).
- ndppd.conf: pre-created and chowned to vps so the panel can render it
(reinstall failed with "permission denied").
- sudoers: allow `ip -6 addr add/del` for the bridge gateway setup.
Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
