keaにどハマりした件

# systemctl status kea-dhcp4
● kea-dhcp4.service - Kea DHCPv4 Server
     Loaded: loaded (/usr/lib/systemd/system/kea-dhcp4.service; enabled; preset: disabled)
    Drop-In: /etc/systemd/system/kea-dhcp4.service.d
             └─10-tuning-slice.conf
     Active: active (running) since Tue 2026-04-28 08:07:54 JST; 1min 21s ago
 Invocation: 4e0223faa9ee4c8b9c2f210be5a2eab6
       Docs: man:kea-dhcp4(8)
   Main PID: 1400 (kea-dhcp4)
     Status: "Dispatching packets..."
         IO: 5.1M read, 8K written
      Tasks: 25 (limit: 815405)
     Memory: 8.3M (peak: 9M)
        CPU: 56ms
     CGroup: /net.slice/kea-dhcp4.service
             └─1400 /usr/sbin/kea-dhcp4 -c /etc/kea/kea-dhcp4.conf

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

2026-04-28 08:07:54.366 WARN [kea-dhcp4.dhcpsrv] DHCPSRV_OPEN_SOCKET_FAIL failed to open socket: the interface enp2s0 is not running

[Unit]
Wants=lan-addresses-ready.service sys-subsystem-net-devices-enp2s0.device
After=lan-addresses-ready.service sys-subsystem-net-devices-enp2s0.device

[Service]
Restart=on-failure
RestartSec=5s

[Unit]
Description=Wait until required LAN addresses (IPv4 + IPv6 GUA non-tentative) are present on enp2s0
Documentation=file:///usr/local/sbin/wait-lan-addresses-ready.sh
DefaultDependencies=no
Wants=network-online.target
After=network-online.target

Before=kea-dhcp4.service kea-dhcp6.service

[Service]
Type=oneshot
Environment=IFACE=enp2s0
Environment="REQUIRE_V4=192.168.1.3 192.168.1.4"
Environment="REQUIRE_V6=240f:10a:da26:1::4"
Environment=POLL_INTERVAL_SEC=1
Environment=MAX_WAIT_SEC=110
ExecStart=/usr/local/sbin/wait-lan-addresses-ready.sh
RemainAfterExit=yes

TimeoutStartSec=120
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target

set -eu

IFACE="${IFACE:-enp2s0}"
REQUIRE_V4="${REQUIRE_V4:-192.168.1.3 192.168.1.4}"
REQUIRE_V6="${REQUIRE_V6:-240f:10a:da26:1::4}"
POLL_INTERVAL_SEC="${POLL_INTERVAL_SEC:-1}"
MAX_WAIT_SEC="${MAX_WAIT_SEC:-110}"

if ! command -v ip >/dev/null 2>&1; then
    echo "wait-lan-addresses-ready: 'ip' (iproute2) is required" >&2
    exit 2
fi

# v4_present <addr>
#   exit 0 if <addr>/<prefix> is currently assigned to $IFACE.
v4_present() {
    _addr=$1
    ip -4 addr show dev "$IFACE" 2>/dev/null \
        | grep -qE "[[:space:]]${_addr}/"
}

# v6_present_non_tentative <addr>
#   exit 0 if <addr>/<prefix> is currently assigned to $IFACE AND
#   the matching `inet6` line does NOT carry the `tentative` flag.
#   The `tentative` token only appears on lines for addresses still
#   undergoing Duplicate Address Detection. Linux refuses bind() on
#   tentative addresses, so checking presence alone is not enough.
v6_present_non_tentative() {
    _addr=$1
    _line=$(ip -6 addr show dev "$IFACE" 2>/dev/null \
        | grep -E "[[:space:]]${_addr}/" || true)
    [ -n "$_line" ] || return 1
    # `tentative` is reported by `ip -6 addr` immediately after the
    # scope keyword for addresses that have not yet completed DAD.
    case " $_line " in
        *" tentative "*) return 1 ;;
        *)               return 0 ;;
    esac
}

ready() {
    for _v4 in $REQUIRE_V4; do
        v4_present "$_v4" || return 1
    done
    for _v6 in $REQUIRE_V6; do
        v6_present_non_tentative "$_v6" || return 1
    done
    return 0
}

# Single-shot fast path: most boots are already ready by the time
# every Before= consumer is being scheduled, so don't even sleep.
if ready; then
    echo "wait-lan-addresses-ready: all required addresses present on ${IFACE}"
    exit 0
fi

_waited=0
while [ "$_waited" -lt "$MAX_WAIT_SEC" ]; do
    sleep "$POLL_INTERVAL_SEC"
    _waited=$((_waited + POLL_INTERVAL_SEC))
    if ready; then
        echo "wait-lan-addresses-ready: all required addresses present on ${IFACE} after ${_waited}s"
        exit 0
    fi
done

# Diagnostic dump on timeout so the journal entry is self-contained.
echo "wait-lan-addresses-ready: TIMEOUT after ${MAX_WAIT_SEC}s on ${IFACE}" >&2
echo "  required IPv4: ${REQUIRE_V4}" >&2
echo "  required IPv6 (non-tentative): ${REQUIRE_V6}" >&2
echo "  current state of ${IFACE}:" >&2
ip -4 addr show dev "$IFACE" >&2 || true
ip -6 addr show dev "$IFACE" >&2 || true
exit 1