[novalkun]

Requires = "nordvpnd.socket" sat in serviceConfig, so it ended up in [Service], where systemd ignores it (Unknown key 'Requires' in section [Service], ignoring). Without a dependency on or ordering against its socket, and with wantedBy = [ "default.target" ], activation could start nordvpnd before nordvpnd.socket. The socket then refused to start (Socket service nordvpnd.service already active, refusing) and nixos-rebuild switch failed. This moves it to requires/after at the unit level.

Reproducer: systemctl stop nordvpnd.socket nordvpnd.service && systemctl start nordvpnd.service leaves the socket inactive before this change and active after it.

This touches the same module as #576413.

AI disclosure: the change, commit message and this description were drafted with Claude Code (Opus 5.5); I reviewed them and tested as below.

Things done

• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.
• Follows the automation/AI policy.
• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • aarch64-darwin
• Tested, as applicable:
  • Basic functionality of all binary files, usually in ./result/bin/.
  • Ran nixpkgs-review on this PR. See nixpkgs-review usage.
  • Package tests at passthru.tests.
  • NixOS tests in nixos/tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
  • Also tested on my machine: switch-to-configuration test to a system with this change, the reproducer above, and reverting.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.

[novalkun]

@different-error could you take a look? This also explains the nordvpnd.socket failures after switching. Side note: the bot couldn’t request your review since you’re not in nixpkgs maintainer yet

[different-error]

I think you can remove most of the description in your commit message. The commit's title contains sufficient information.

Remove:

`Requires = "nordvpnd.socket"` was set in serviceConfig, so it ended up in
the [Service] section, where systemd ignores it ("Unknown key 'Requires' in
section [Service], ignoring"). The service then had no dependency on or
ordering against its socket, and since it is also wanted by default.target,
switch-to-configuration could start nordvpnd before nordvpnd.socket. The
socket then refused to start ("Socket service nordvpnd.service already
active, refusing"), failing the activation.

Move it to the unit level as requires/after.

[novalkun]

I think you can remove most of the description in your commit message. The commit's title contains sufficient information.

Remove:

`Requires = "nordvpnd.socket"` was set in serviceConfig, so it ended up in
the [Service] section, where systemd ignores it ("Unknown key 'Requires' in
section [Service], ignoring"). The service then had no dependency on or
ordering against its socket, and since it is also wanted by default.target,
switch-to-configuration could start nordvpnd before nordvpnd.socket. The
socket then refused to start ("Socket service nordvpnd.service already
active, refusing"), failing the activation.

Move it to the unit level as requires/after.

Done, thanks.

[different-error]

Assisted-by: Claude Code (Claude Opus 5.5)

This appears as the more common pattern. Please replace.

[different-error]

• Verified correct coupling between nordvpnd and nordvpnd.socket: stopping/starting the former enforces the same for the latter.
• Verified connection over all three protocols via cli and gui.

Ty.

[novalkun]

• Verified correct coupling between nordvpnd and nordvpnd.socket: stopping/starting the former enforces the same for the latter.

  • Verified connection over all three protocols via cli and gui.

Ty.

thanks. can it be approved?

[different-error]

LGTM