Archived
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s
extraCommands runs after nixos-nat-post is deleted but before it is re-created, so -A nixos-nat-post silently fails every time. POSTROUTING is a built-in chain that always exists; target it directly instead. The -C idempotency check prevents duplicate rules on firewall reloads. Drop networking.nat.enable -- it was only needed for the sub-chain that turned out to be the wrong target. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>