Nix failing to access GH through the API

Help
1

Yesterday nix flake update and nix build or basically any nix command worked. I have not updated anything in the meantime, and the same problem exists with other nix’ I still have in my store for whatever reason.

I get weird error messages when nix tries to access GH via the API:

$ nix flake update
warning: Git tree '/home/nmelzer/Projects/jj-nixos-config' is dirty
warning: unable to download 'https://api.github.com/repos/nix-community/emacs-overlay/commits/HEAD': SSL connect error (35) TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failure; retrying in 40 ms (attempt 1/5)

This output is exemplary and basically repeats for all the inputs I have on GH. Similar appears when I run any nix command which somehow involves a flake that resolves to github:.

curling the URLs works fine and only nix seems to be affected.

A websearch for the punchline of the error suggests, that there is a cipher mismatch between client and host, though I have no clue how to change that or what I should change it to.

This is on NixOS, my MacOS nix doesn’t have the problem.

1 Like
2

Can you run

host -v -N 3 -t AAAA api.github.com

There’s an issue with glibc using the search list for names with dots in them.

3 
$ host -v -N 3 -t AAAA api.github.com
Trying "api.github.com.tailfc70e8.ts.net"
Trying "api.github.com.fritz.box"
Trying "api.github.com.internal.nobbz.dev"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8905
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;api.github.com.internal.nobbz.dev. IN  AAAA

;; ANSWER SECTION:
api.github.com.internal.nobbz.dev. 300 IN AAAA  2606:4700:3035::6815:5e84
api.github.com.internal.nobbz.dev. 300 IN AAAA  2606:4700:3031::ac43:8850

Received 107 bytes from 100.100.100.100#53 in 29 ms
4

Ok, I’d suggest either removing the wildcard at internal.nobbz.dev or removing internal.nobbz.dev from your search list (which might be managed through tailscale).

Nix is trying to connect to api.github.com.internal.nobbz.dev.

1 Like
5

There is no entry for *.internal.nobbz.dev. in my zone file.

Though even weirder, after my fritz.box restarted I got reconnected on the 2.4GHz network, where nix works again. And as soon as I switch onto the 5GHz network, it breaks again.

So even thoguh I do not know what the problem is, I know what to debug tomorrow…

1 Like
6

My apologies, it appears to be a wildcard at *.nobbz.dev not *.internal.nobbz.dev and it appears to be for a cloudflare service.

7

What might be happening is that without IPv6 connectivity, the connection to api.github.com.internal.nobbz.dev fails and curl (which nix uses internally) falls back to the IPv4 address for api.github.com.