The task description above was truncated when I pasted it (the ends of long lines were cut off). I can't edit the description (edit policy), so here is the complete text. Please use this instead of the description.

Affected version

Rolling (seen on a self-built image from the rolling tree, 2026.09.15, upgrading from VyOS 2026.03). The relevant code in src/conf_mode/service_dhcpv6-server.py is unchanged on rolling HEAD.

Regression information

Not a regression in the code itself. It shows up whenever the _kea UID differs between the old and the new image. T6163 fixed the same problem for the lease files; the server-id file was left out.

Steps to reproduce

1. Run service dhcpv6-server (default VRF) on an image where kea-dhcp6 has created /config/dhcp/kea-dhcp6-serverid. KEA_DHCP_DATA_DIR=/config/dhcp comes from isc-kea-dhcp6-server.service.d/override.conf.
2. add system image a newer image in which _kea has a different UID, then reboot into it.
3. kea-dhcp6 fails:

kea-dhcp6[11603]: ERROR DHCP6_CONFIG_LOAD_FAIL configuration error using file: /var/run/kea/kea-dhcp6.conf, reason: unable to configure server identifier: unable to open DUID file /config/dhcp/kea-dhcp6-serverid for writing
systemd[1]: isc-kea-dhcp6-server.service: Failed with result 'exit-code'.

Ownership after the upgrade (ls -ln /config/dhcp):

-rw-r----- 1 100 102  1992 dhcp4-leases.csv
-rw-r----- 1 100 102 11573 dhcp4-leases.csv.2
-rw-r----- 1 100 102   319 dhcp6-leases.csv
-rw-r----- 1 100 102   440 dhcp6-leases.csv.2
-rw-r----- 1 101 102    41 kea-dhcp6-serverid

_kea:x:100:109:Kea DHCP User,,,:/var/lib/kea:/bin/false
zabbix:x:101:110::/nonexistent:/usr/sbin/nologin

The old image (2026.03), from /usr/lib/live/mount/persistence/boot/2026.03/rw/etc/passwd:

_kea:x:101:109:Kea DHCP User,,,:/var/lib/kea:/bin/false
zabbix:x:102:110::/nonexistent:/usr/sbin/nologin

So _kea moved from UID 101 to 100 between images (and zabbix from 102 to 101). The server-id file was created by _kea (UID 101) on the old image; on the new one, UID 101 is zabbix. The lease files show the correct owner only because the conf script re-owns them on every commit.

Cause

add system image copies /config and keeps the numeric owner of regular files (T5883, T9403). System-user UIDs are not stable across images; they depend on package install order. service_dhcpv6-server.py re-owns only the lease files:

# Ensure correct permissions on lease files + backups
for file in glob(lease_file_glob):          # '/config/dhcp/dhcp6-leases*'
    chown(file, user=user_group, group='vyattacfg')

kea-dhcp6-serverid lives in the same directory but doesn't match the glob. It keeps the old UID, and kea-dhcp6 (default instance, runs as _kea) can't open it for writing. The VRF instances (isc-kea-dhcp6-server@.service) run as root and are not affected.

Workaround: sudo chown _kea /config/dhcp/kea-dhcp6-serverid; restart dhcpv6 server. That keeps the same server DUID, so clients aren't disturbed.

Proposed fix

Re-own the server-id file together with the lease files:

for file in glob(lease_file_glob) + glob('/config/dhcp/kea-dhcp6-serverid'):
    chown(file, user=user_group, group='vyattacfg')

Or re-own everything Kea keeps under /config/dhcp. T9403 / PR #5535 (preserving ownership on image copy) wouldn't cover this case on its own, because the problem is that the UID number changes, not that ownership is lost.