Run upsmon as a NUT secondary on Fedora and Fedora Atomic

Steps#

1. Install nut-client.

   Fedora:

   dnf install -y nut-client
   

   Output on Fedora 45, cut marked:

   …
   [1/1] Total                             100% |   1.1 MiB/s | 423.4 KiB |  00m00s
   Running transaction
   [1/3] Verify package files              100% | 500.0   B/s |   1.0   B |  00m00s
   [2/3] Prepare transaction               100% |   2.0   B/s |   1.0   B |  00m00s
   >>> Running sysusers scriptlet: nut-client-0:2.8.5-9.fc45.x86_64
   >>> Finished sysusers scriptlet: nut-client-0:2.8.5-9.fc45.x86_64
   >>> Scriptlet output:
   >>> Creating group 'nut' with GID 57.
   >>> Creating user 'nut' (Network UPS Tools) with UID 57 and GID 57.
   >>> 
   [3/3] Installing nut-client-0:2.8.5-9.f 100% | 546.2 KiB/s |   1.2 MiB |  00m02s
   Complete!
   

   Expected: Complete!. On a first install the nut user and group are created.

   Fedora Atomic:

   rpm-ostree install --idempotent --apply-live -y nut-client
   

   Output on Bazzite (with a deployment already staged, see Before you start), cut marked:

   …
   Writing OSTree commit...done
   Staging deployment...done
   Freed: 140.4 MB (pkgcache branches: 0)
   error: packages would be removed: 13, allow replacement to override
   

   Expected: the package is applied live. I have not seen that path: on my box the live apply was refused (Failure modes row 2), the package went into the staged deployment, and a reboot brought it in.

   If the live apply is refused like this (Failure modes row 2), run systemctl reboot; if the install failed on disk space (row 1), nothing was staged: free space and run the install again. Either way, check rpm -q nut-client before step 2. Without the package on the booted deployment, steps 2–5 have nothing to configure. After the reboot:

   2026-10-16 11:56:43
   nut-client-2.8.5-8.fc44.x86_64
   State: idle
   BootedDeployment:
   ● ostree-image-signed:docker://ghcr.io/ublue-os/bazzite-nvidia-open:stable
   …
                     Version: 44.20261012.1 (2026-10-13T00:06:38Z)
             LayeredPackages: coolercontrol lact liquidctl nut-client
   

   That is the output of uptime -s; rpm -q nut-client; rpm-ostree status --booted | head -6 (the head cut drops the later lines, such as LocalPackages). Expected: nut-client in LayeredPackages and rpm -q nut-client prints a version.

2. Back up the existing configs once.

   for f in nut.conf upsmon.conf; do
     [ -f /etc/ups/$f ] && [ ! -f /etc/ups/$f.orig ] && cp -a /etc/ups/$f /etc/ups/$f.orig
   done
   ls /etc/ups/*.orig
   

   Output on Fedora 44:

   /etc/ups/nut.conf.orig
   /etc/ups/upsmon.conf.orig
   

   Expected: both .orig files exist. Running the loop again does not overwrite them.

3. Set the placeholders and read the password without putting it in argv or shell history.

   UPS=<UPS> SERVER=<SERVER> NUT_USER=<NUT_USER>
   read -rs NUT_PASS
   

   Type <NUT_PASSWORD> and press Enter. No output.

4. Set NUT to client mode.

   printf 'MODE=netclient\n' > /etc/ups/nut.conf
   

   No output. netclient means this host runs only upsmon and no local driver or server.

5. Write upsmon.conf as a secondary and make it readable by the nut group only.

   The password goes into the MONITOR line unquoted, so use one without spaces or #. The umask 027 stays in effect for the rest of this root shell.

   umask 027
   cat > /etc/ups/upsmon.conf <<EOF
   MONITOR $UPS@$SERVER 1 $NUT_USER $NUT_PASS secondary
   MINSUPPLIES 1
   SHUTDOWNCMD "/usr/sbin/shutdown -h +0"
   POLLFREQ 5
   POLLFREQALERT 5
   DEADTIME 300
   NOCOMMWARNTIME 300
   FINALDELAY 5
   EOF
   chown root:nut /etc/ups/upsmon.conf
   chmod 640 /etc/ups/upsmon.conf
   stat -c '%U:%G %a %n' /etc/ups/upsmon.conf
   

   The heredoc delimiter is unquoted on purpose, so the shell fills in the variables from step 3. Output on Fedora 44:

   root:nut 640 /etc/ups/upsmon.conf
   

   Expected: root:nut 640. The file holds the password.

   What the lines do: 1 is the number of power supplies this UPS feeds on the host; secondary means this host shuts itself down and leaves powering off the UPS to the primary. DEADTIME 300 lets the server go missing for 5 minutes before upsmon declares the UPS dead (the default is 15 s); why I picked 300 for my server is in part 5 of the UPS series. FINALDELAY 5 is the wait between the shutdown notice and SHUTDOWNCMD.

6. Check the login without arming a shutdown. This runs upsmon in the foreground for 15 s from a temporary copy of the config whose SHUTDOWNCMD is /bin/true.

   T=$(mktemp -d /run/upsmon-verify.XXXXXX); chmod 750 "$T"; chgrp nut "$T"
   sed 's#^SHUTDOWNCMD .*#SHUTDOWNCMD "/bin/true"#' /etc/ups/upsmon.conf > "$T/upsmon.conf"
   cp /etc/ups/nut.conf "$T/"; chgrp nut "$T"/*; chmod 640 "$T"/*
   systemctl is-enabled nut-monitor.service nut.target 2>/dev/null | paste -sd' ' || true
   upsc "$UPS@$SERVER" ups.status
   NUT_CONFPATH=$T NUT_STATEPATH=$T timeout 15 upsmon -D -F 2>&1 | grep -E 'Logged into|Login|denied|ERR|failed to connect' || true
   rm -rf "$T"
   

   Output on Bazzite, names replaced, cut marked:

   …
   disabled disabled
   OL
      0.013950	[D1:main-loop] Logged into UPS <UPS>@<SERVER>
   

   Expected: upsc prints the UPS status (OL = on line) and upsmon prints Logged into UPS <UPS>@<SERVER>. Fedora 44 Server printed the same three lines (timestamp 0.023528). If the login line is missing, stop here: nothing is enabled yet.

7. Enable nut.target and nut-monitor, then start it. nut-monitor.service is WantedBy=nut.target only, so enabling the service alone does not start it at boot (part 5 has the story).

   systemctl enable nut.target nut-monitor.service
   systemctl restart nut-monitor.service
   

   Output on Fedora 45:

   Created symlink '/etc/systemd/system/multi-user.target.wants/nut.target' → '/usr/lib/systemd/system/nut.target'.
   Created symlink '/etc/systemd/system/upsmon.service' → '/usr/lib/systemd/system/nut-monitor.service'.
   Created symlink '/etc/systemd/system/nut.target.wants/nut-monitor.service' → '/usr/lib/systemd/system/nut-monitor.service'.
   

   Expected: the multi-user.target.wants/nut.target symlink is created (on Fedora 44 only that first line appeared: nut-monitor was already enabled by an earlier run of my script).

8. Read the service state, the UPS status and the last log lines.

   sleep 5
   systemctl is-active nut-monitor.service; systemctl is-enabled nut.target
   upsc "$UPS@$SERVER" ups.status
   journalctl -u nut-monitor.service -n 6 --no-pager -o cat
   

   Output on Fedora 45, cut marked (Fedora 44 printed the same lines):

   …
   active
   enabled
   OL
   Warning: no custom notification command defined, just so you know
   writepid: fopen /run/nut/upsmon.pid: Permission denied
   upsnotify: notify about state NOTIFY_STATE_READY_WITH_PID with libsystemd: was requested, but not running as a service unit now, will not spam more about it
   upsnotify: failed to notify about state NOTIFY_STATE_READY_WITH_PID: no notification tech defined, will not spam more about it
   upsmon: initialized OS integration for sleep inhibitor
   upsmon: initialized OS integration for sleep/wake monitoring
   

   Expected: active, enabled, and the UPS status. The writepid and upsnotify lines appeared on both enabled hosts; the service stayed active and the status read worked. I have not determined their cause (Failure modes row 3).