Diagnostic NFS mesh réseau tailscale

Récapitulatif du diagnostic — montage NFS /srv/chirpy

Constat : l’unité systemd srv-chirpy.mount a échoué au démarrage. Le journal indique :

mount.nfs4: Network is unreachable for [fd7a:115c:a1e0::2]:/sharenfs/rnmkcy/chirpy

Le montage utilise NFSv4 sur IPv6, avec le serveur Tailscale fd7a:115c:a1e0::2.

Cause la plus probable : une course au démarrage. La tentative de montage a eu lieu vers 03:04:34, alors que tailscaled commençait tout juste à démarrer à la même seconde. La route Tailscale n’était vraisemblablement pas encore disponible au moment du montage.

Vérifications après démarrage : la route vers le serveur passe maintenant par tailscale0, et tailscale ping reçoit une réponse. Le tunnel et la connectivité IPv6 fonctionnent donc actuellement.

Dépendance observée : le montage attend network-online.target, mais aucune dépendance directe à tailscaled.service n’apparaît. network-online.target ne garantit pas que le tunnel Tailscale est prêt.

Les messages concernant le TPM et tailscale0 absent au tout début du démarrage ne sont pas, à eux seuls, la cause de l’échec NFS. Conclusion : les éléments pointent vers un montage lancé trop tôt, plutôt que vers un problème persistant d’IPv6 ou d’export NFS. La correction à envisager est de faire attendre le montage jusqu’à ce que Tailscale soit prêt.

skim@vm9471:~$ sudo journalctl -b -u tailscaled --since "2026-10-17 17:46:50" --until "2026-10-17 17:47:20" --no-pager
ip -6 route get fd7a:115c:a1e0::2
tailscale ping fd7a:115c:a1e0::2
oct. 17 17:47:05 vm9471 systemd[1]: Starting tailscaled.service - Tailscale node agent...
oct. 17 17:47:05 vm9471 tailscaled[728]: TPM: error opening: stat /dev/tpmrm0: no such file or directory
oct. 17 17:47:05 vm9471 tailscaled[728]: Program starting: v1.104.1-t7f4efe814-g8da26756c, Go 1.27.1: []string{"/usr/sbin/tailscaled", "--state=/var/lib/tailscale/tailscaled.state", "--socket=/run/tailscale/tailscaled.sock", "--port=41641"}
oct. 17 17:47:05 vm9471 tailscaled[728]: LogID: 08e617776981c7d42a7dd35cfb41d42be6757fd1280e3498c158347ee43483fa
oct. 17 17:47:05 vm9471 tailscaled[728]: logpolicy: using $STATE_DIRECTORY, "/var/lib/tailscale"
oct. 17 17:47:05 vm9471 tailscaled[728]: dns: [resolved-ping=yes rc=resolved resolved=nss nm=no resolv-conf-mode=stub ret=systemd-resolved]
oct. 17 17:47:05 vm9471 tailscaled[728]: dns: using "systemd-resolved" mode
oct. 17 17:47:05 vm9471 tailscaled[728]: creating dns cleanup: route ip+net: no such network interface
oct. 17 17:47:05 vm9471 tailscaled[728]: router: enumerating tailscale0 addresses for cleanup failed: failed to look up link "tailscale0": Link not found
oct. 17 17:47:05 vm9471 systemd[1]: Started tailscaled.service - Tailscale node agent.
oct. 17 17:47:05 vm9471 tailscaled[728]: wgengine.NewUserspaceEngine(tun "tailscale0") ...
oct. 17 17:47:05 vm9471 tailscaled[728]: dns: [resolved-ping=yes rc=resolved resolved=nss nm=no resolv-conf-mode=stub ret=systemd-resolved]
oct. 17 17:47:05 vm9471 tailscaled[728]: dns: using "systemd-resolved" mode
oct. 17 17:47:05 vm9471 tailscaled[728]: dns: using *dns.resolvedManager
oct. 17 17:47:05 vm9471 tailscaled[728]: link state: interfaces.State{defaultRoute=eth0 ifs={eth0:[2a14:7c0:1002:19a8::/38 llu6]} v4=false v6=true}
oct. 17 17:47:05 vm9471 tailscaled[728]: magicsock: disco key = d:5111279e856386fd
oct. 17 17:47:05 vm9471 tailscaled[728]: Creating WireGuard device...
oct. 17 17:47:05 vm9471 tailscaled[728]: Bringing WireGuard device up...
oct. 17 17:47:05 vm9471 tailscaled[728]: Bringing router up...
oct. 17 17:47:05 vm9471 tailscaled[728]: router: using firewall mode pref
oct. 17 17:47:05 vm9471 tailscaled[728]: external route: up
oct. 17 17:47:05 vm9471 tailscaled[728]: router: portUpdate(port=41641, network=udp6)
oct. 17 17:47:05 vm9471 tailscaled[728]: router: default choosing iptables
oct. 17 17:47:05 vm9471 tailscaled[728]: router: netfilter running in iptables mode v6 = true, v6filter = true, v6nat = true
oct. 17 17:47:05 vm9471 tailscaled[728]: Clearing router settings...
oct. 17 17:47:05 vm9471 tailscaled[728]: Starting network monitor...
oct. 17 17:47:05 vm9471 tailscaled[728]: Engine created.
oct. 17 17:47:05 vm9471 tailscaled[728]: router: portUpdate(port=41641, network=udp4)
oct. 17 17:47:05 vm9471 tailscaled[728]: pm: using backend prefs for "profile-0166": Prefs{ra=false dns=true want=true routes=[] statefulFiltering=false nf=on url="https://headscale.xoyize.xyz" update=check Persist{o=, n=[PonWl] u="tagged-devices" ak=-}}
oct. 17 17:47:05 vm9471 tailscaled[728]: envknob: PORT="41641"
oct. 17 17:47:05 vm9471 tailscaled[728]: logpolicy: using $STATE_DIRECTORY, "/var/lib/tailscale"
oct. 17 17:47:05 vm9471 tailscaled[728]: linkChange: in state NoState; PAC or proxyConfig changed; updating routes
oct. 17 17:47:05 vm9471 tailscaled[728]: got LocalBackend in 121ms
oct. 17 17:47:05 vm9471 tailscaled[728]: Start
oct. 17 17:47:05 vm9471 tailscaled[728]: ipnext: active extensions: captiveportal, acme, portlist, posture, clientupdate, conn25, connreject, favorites, relayserver, routecheck, serviceclientprefs, taildrop
oct. 17 17:47:05 vm9471 tailscaled[728]: load netmap from cache: netmap cache is not available
oct. 17 17:47:05 vm9471 tailscaled[728]: Backend: logs: be:08e617776981c7d42a7dd35cfb41d42be6757fd1280e3498c158347ee43483fa fe:
oct. 17 17:47:05 vm9471 tailscaled[728]: control: client.Login(0)
oct. 17 17:47:05 vm9471 tailscaled[728]: control: doLogin(regen=false, hasUrl=false)
oct. 17 17:47:05 vm9471 tailscaled[728]: health(warnable=warming-up): error: Tailscale is starting. Please wait.
oct. 17 17:47:10 vm9471 tailscaled[728]: health(warnable=warming-up): ok
oct. 17 17:47:11 vm9471 tailscaled[728]: control: control server key from https://headscale.xoyize.xyz: ts2021=[QKCem], legacy=
oct. 17 17:47:11 vm9471 tailscaled[728]: control: RegisterReq: onode= node=[PonWl] fup=false nks=false
oct. 17 17:47:11 vm9471 tailscaled[728]: control: RegisterReq: got response; nodeKeyExpired=false, machineAuthorized=true; authURL=false
oct. 17 17:47:12 vm9471 tailscaled[728]: magicsock: new contact: control-netmap usec=7034162 cached=false
oct. 17 17:47:12 vm9471 tailscaled[728]: active login: tagged-devices
oct. 17 17:47:12 vm9471 tailscaled[728]: netmap: suggested exit node: no preferred DERP, try again later
oct. 17 17:47:12 vm9471 tailscaled[728]: Switching ipn state NoState -> Starting (WantRunning=true, nm=true)
oct. 17 17:47:12 vm9471 tailscaled[728]: magicsock: SetPrivateKey called (init)
oct. 17 17:47:12 vm9471 tailscaled[728]: wgengine: Reconfig: configuring router
oct. 17 17:47:12 vm9471 tailscaled[728]: magicsock: home DERP changing from derp-0 [0ms] to derp-999 [19ms] (forced=false)
oct. 17 17:47:12 vm9471 tailscaled[728]: magicsock: home is now derp-999 (xoyize)
oct. 17 17:47:12 vm9471 tailscaled[728]: magicsock: endpoints changed: [2a14:7c0:1002:19a8::]:41641 (stun)
oct. 17 17:47:12 vm9471 tailscaled[728]: magicsock: adding connection to derp-999 for home-keep-alive
oct. 17 17:47:12 vm9471 tailscaled[728]: magicsock: 1 active derp conns: derp-999=cr0s,wr0s
oct. 17 17:47:12 vm9471 tailscaled[728]: derphttp.Client.Connect: connecting to derp-999 (xoyize)
oct. 17 17:47:12 vm9471 tailscaled[728]: magicsock: derp-999 connected; connGen=1
oct. 17 17:47:13 vm9471 tailscaled[728]: router: enabling connmark-based rp_filter workaround
oct. 17 17:47:13 vm9471 tailscaled[728]: wgengine: Reconfig: user dialer
oct. 17 17:47:13 vm9471 tailscaled[728]: tsdial: bart table size: 6
oct. 17 17:47:13 vm9471 tailscaled[728]: wgengine: Reconfig: configuring DNS
oct. 17 17:47:13 vm9471 tailscaled[728]: dns: Set: {DefaultResolvers:[] Routes:{tailscale.xoyize.xyz.:[]}+66arpa SearchDomains:[tailscale.xoyize.xyz.] Hosts:0}
oct. 17 17:47:13 vm9471 tailscaled[728]: dns: Resolvercfg: {Routes:{}+1arpa Hosts:0 LocalDomains:[tailscale.xoyize.xyz.]+65arpa}
oct. 17 17:47:13 vm9471 tailscaled[728]: dns: OScfg: {Nameservers:[100.100.100.100 fd7a:115c:a1e0::53] SearchDomains:[tailscale.xoyize.xyz.] MatchDomains:[tailscale.xoyize.xyz.]+66arpa}
oct. 17 17:47:13 vm9471 tailscaled[728]: peerapi: serving on http://100.64.0.5:41053
oct. 17 17:47:13 vm9471 tailscaled[728]: peerapi: serving on http://[fd7a:115c:a1e0::5]:44445
oct. 17 17:47:13 vm9471 tailscaled[728]: magicsock: last netcheck reported send error. Rebinding.
oct. 17 17:47:13 vm9471 tailscaled[728]: Switching ipn state Starting -> Running (WantRunning=true, nm=true)
oct. 17 17:47:13 vm9471 tailscaled[728]: updating netmap in disk cache
oct. 17 17:47:13 vm9471 tailscaled[728]: Rebind; defIf="eth0", ips=[2a14:7c0:1002:19a8::/38 fe80::be24:11ff:fe15:8eed/64]
oct. 17 17:47:13 vm9471 tailscaled[728]: magicsock: 1 active derp conns: derp-999=cr121ms,wr121ms
oct. 17 17:47:13 vm9471 tailscaled[728]: control: NetInfo: NetInfo{varies= ipv6=true ipv6os=true udp=true icmpv4=false derp=#999 portmap= link="" firewallmode="ipt-default"}
oct. 17 17:47:13 vm9471 tailscaled[728]: router: portUpdate(port=41641, network=udp6)
oct. 17 17:47:13 vm9471 tailscaled[728]: router: portUpdate(port=41641, network=udp4)
oct. 17 17:47:13 vm9471 tailscaled[728]: post-rebind ping of DERP region 999 okay
fd7a:115c:a1e0::2 from :: dev tailscale0 table 52 src fd7a:115c:a1e0::5 metric 1024 pref medium
pong from cwwk (100.64.0.2) via [2a01:e0a:95a:e2f0:aab8:e0ff:fe04:ec45]:41641 in 23ms

Les journaux montrent la cause : à 17:47:05, systemd démarre tailscaled et lance presque aussitôt le montage NFS. Tailscale n’a pas encore rejoint son réseau : il ne passe à l’état Running qu’à 17:47:13. La route et le ping fonctionnent ensuite. La dépendance à tailscaled.service ne suffit donc pas : systemd considère le service démarré avant que le pair soit joignable.

Il faut faire attendre le montage jusqu’à ce qu’un ping Tailscale vers le serveur réussisse. Créez une petite unité qui attend ce ping :

        
      
sudo tee /etc/systemd/system/tailscale-peer-ready.service >/dev/null <<'EOF'
[Unit]
Description=Wait for the NFS server to be reachable over Tailscale
Requires=tailscaled.service
After=tailscaled.service network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
TimeoutStartSec=90
ExecStart=/bin/sh -c 'until /usr/bin/tailscale ping --c=1 --timeout=2s fd7a:115c:a1e0::2 >/dev/null 2>&1; do sleep 2; done'
EOF

Dans /etc/fstab, insérez la dépendance tailscale-peer-ready.service

[fd7a:115c:a1e0::2]:/sharenfs/rnmkcy/chirpy /srv/chirpy nfs4 _netdev,defaults,vers=4,x-systemd.requires=tailscale-peer-ready.service 0 0

tailscale ping vérifie la joignabilité du pair dans le réseau Tailscale ; tailscale wait ne suffirait pas ici, car il attend seulement l’interface et les adresses locales de Tailscale.

Rechargez et contrôlez les unités générées :

        
sudo systemctl daemon-reload
systemctl show srv-chirpy.mount -p After -p Requires

Réponse

Requires=system.slice -.mount tailscale-peer-ready.service
After=network-online.target network.target tailscale-peer-ready.service system.slice -.mount remote-fs-pre.target systemd-journald.socket

Au prochain démarrage, srv-chirpy.mount attendra que le serveur réponde, avec un délai maximal de 90 secondes. Si vous préférez que le démarrage continue même si le pair reste indisponible, ajoutez nofail aux options de montage ; autrement, l’échec de cette dépendance pourra faire échouer le montage et ralentir le démarrage jusqu’au délai imparti.

Pour voir combien de temps l’attente a duré au dernier démarrage :

        
systemctl show tailscale-peer-ready.service \
  -p ExecMainStartTimestamp -p ExecMainExitTimestamp -p ExecMainDuration

Réponse

ExecMainStartTimestamp=Sat 2026-10-17 17:57:10 CEST
ExecMainExitTimestamp=Sat 2026-10-17 17:57:18 CEST

Pour examiner les horodatages avec le montage :

        
      
sudo journalctl -b \
  -u tailscale-peer-ready.service \
  -u srv-chirpy.mount \
  -o short-iso-precise --no-pager

Réponse

2026-10-17T17:57:10.695544+02:00 vm9471 systemd[1]: Starting tailscale-peer-ready.service - Wait for the NFS server to be reachable over Tailscale...
2026-10-17T17:57:18.934140+02:00 vm9471 systemd[1]: Finished tailscale-peer-ready.service - Wait for the NFS server to be reachable over Tailscale.
2026-10-17T17:57:18.938769+02:00 vm9471 systemd[1]: Mounting srv-chirpy.mount - /srv/chirpy...
2026-10-17T17:57:19.886326+02:00 vm9471 systemd[1]: Mounted srv-chirpy.mount - /srv/chirpy.

Le montage devrait commencer juste après la fin de tailscale-peer-ready.service.

Pour consulter le démarrage précédent plutôt que celui en cours, remplacez -b par -b -1.

2026-10-17T17:47:05.622203+02:00 vm9471 systemd[1]: Mounting srv-chirpy.mount - /srv/chirpy...
2026-10-17T17:47:06.023622+02:00 vm9471 mount[794]: mount.nfs4: Network is unreachable for [fd7a:115c:a1e0::2]:/sharenfs/rnmkcy/chirpy on /srv/chirpy
2026-10-17T17:47:06.025586+02:00 vm9471 systemd[1]: srv-chirpy.mount: Mount process exited, code=exited, status=32/n/a
2026-10-17T17:47:06.026144+02:00 vm9471 systemd[1]: srv-chirpy.mount: Failed with result 'exit-code'.
2026-10-17T17:47:06.026746+02:00 vm9471 systemd[1]: Failed to mount srv-chirpy.mount - /srv/chirpy.

OPTION

systemd peut lancer une autre unité quand srv-chirpy.mount passe en échec, avec la directive OnFailure=. Il ne produit pas à lui seul une notification push ou un courriel : il faut lui faire appeler un outil de notification ou de supervision.

Pour déclencher une alerte locale dans le journal à chaque échec, créez un drop-in pour le montage :

        
      
sudo mkdir -p /etc/systemd/system/srv-chirpy.mount.d
sudo tee /etc/systemd/system/srv-chirpy.mount.d/alerte.conf >/dev/null <<'EOF'
[Unit]
OnFailure=srv-chirpy-alert.service
EOF

Puis créez l’unité appelée en cas d’échec :

        
      
sudo tee /etc/systemd/system/srv-chirpy-alert.service >/dev/null <<'EOF'
[Unit]
Description=Signaler l'échec du montage /srv/chirpy

[Service]
Type=oneshot
ExecStart=/usr/bin/logger -p daemon.crit "ÉCHEC systemd : srv-chirpy.mount (/srv/chirpy)"
EOF

Rechargez systemd :

sudo systemctl daemon-reload

En cas d’échec, recherchez ensuite l’alerte avec :

journalctl -b -p crit

Pour recevoir une alerte à distance — par courriel, ntfy, etc. — remplacez logger par la commande correspondante. Il faudra que l’envoi soit déjà configuré et testé. Avec un seul montage, cette solution directe convient ; pour surveiller plusieurs machines ou services, un outil de supervision centralisé sera plus pratique.

Diagnostic NFS mesh réseau tailscale

Tags tendance