The port 8000 redirect is an nginx return, /skip, /good and radio-news.r
run as CGI through fcgiwrap. Port 8001 and the dash 0.5.12 pin go away.

One python CGI (configs/paste/paste.py) replaces the htgen-paste,
htgen-imgur and htgen-cyberlocker handlers and the paste-form script.
Items keep their names and directories, so old links and the backups stay
as they are; systemd hands the directories to the new paste user. The
upload form now stores directly instead of posting back to p.krebsco.de.

nomads-cloud and grib2json are only realwallpaper dependencies; they are
pulled in by path since pkgs/ is not an overlay.

pairprogramming, radio, realwallpaper and the htgen users no longer get
their ids from stockholm's genid. NixOS keeps the ids existing users
already have in /etc/passwd and /etc/group, so nothing changes on
deployed machines; fresh installs allocate them.

The copied htgen, reaktor2 and realwallpaper modules use nixpkgs option
types instead of stockholm's, htgen's user is a small name/home
submodule (home still defaults to /home/<name>), and reaktor2 carries
its own stripAttr.

The option only fed lassul.us/ssh.pub, lassul.us/gpg.pub and makefu's
key for the download user. ssh.pub now lists every key lass logs in
with on neoprism, gpg.pub serves keys/pgp/yubi_pgp.pgp, and makefu's
key is read from kartei directly.

krebs.enable and krebs.sitemap were unused. krebs.ssl only trusted the
krebs intermediate CA, which expired on 2026-06-29, so that trust
validated nothing.

radio's playlist ACLs move from krebs.acl (setfacl -R at boot) to
systemd-tmpfiles: rwx on the playlist directory, default ACLs on its
tree so new files get rw and new directories rwx, and traverse on the
parents for lass. Existing content keeps the ACLs it already has; X is
avoided because tmpfiles applies it to existing files with an r-- mask.

Let's Encrypt refuses .r names and the vhosts on ca.r keep failing to
renew, so serve paste/cyberlocker (c.r, p.r), radio.r, radio-news.r and
yellow's flix vhosts over plain http instead.

Every machine now uses networking.firewall on networking.nftables with
the same defaults krebs.iptables had: input and forward drop, all ICMP
accepted, no reverse path filter. Open ports and trusted interfaces are
unchanged on all machines.

- interface port rules become firewall.interfaces.<if>.allowed*Ports,
interface-wide accepts trustedInterfaces
- forwarding goes through extraForwardRules; yellow keeps forward
unfiltered for the transmission namespace
- NAT rules become per-module networking.nftables.tables
- ssh-redirect: 45621 redirects to 22, new connections to 22 are reset
unless they come from lo, retiolum or wiregrill
- xerxes: the JOOL xtables target is added by jool-iptables through
ip6tables-nft, with XTABLES_LIBDIR pointing at jool's extension
- flushRuleset = false so libvirt/podman/jool tables survive reloads;
extraDeletions drops the iptables-nft tables krebs.iptables left

Rules that were silently ignored while networking.firewall was disabled,
such as clan's yggdrasil filter, now take effect.

Reference the stockholm packages we still use through
stockholm.packages.<system> instead of its overlay.

nixpkgs' pkgs.writers replaces nix-writers' top-level writeDash,
writeDashBin, writeBashBin and write (now linkFarm).

Nothing uses them; red-host reads the clan vars secretLocation directly.

Copied from stockholm krebs/3modules/realwallpaper.nix (cc283503); the
wallpaper generator comes from stockholm's packages output instead of
its overlay.

Copied from stockholm krebs/3modules/reaktor2.nix (cc283503). The bot
itself goes to pkgs/reaktor2 (with blessings, which nixpkgs lacks),
since stockholm's packages output does not include it.

Copied from stockholm krebs/3modules/htgen.nix (cc283503), so it no
longer needs pkgs.htgen from the stockholm overlay.

barnacle's hosts block only had kartei.extraHosts, so starkstrom.r and
acheron.r did not resolve there. self.retiolum now exposes extraHosts
(v4v6/v6only) rendered like kartei's, and barnacle appends it.

deploy now always takes a machine and a target host. It extracts the
bulk key once, runs clan vars generate, copies the flake source to
/var/lib/deploy/incoming over ssh, builds it there in the transient unit
deploy-build (progress via nom), shows the source diff against the
running system's source and the closure diff, asks, uploads secrets and
switches in deploy-switch. Both units survive the ssh connection dying;
rerunning deploy attaches to a running one.

Render /etc/hosts, ssh known_hosts and ssh ports from kartei (plus the
superconfig-only cards in retiolum/) instead of stockholm's krebs.hosts,
and drop krebs.build.host everywhere: readers now use kartei.hosts or
networking.hostName, which comes from the clan machine name.

- remove stockholm users/hosts/build/dns/ssh imports; declare krebs.users
locally
- drop the acheron/starkstrom krebs.hosts cards; both now appear in every
machine's /etc/hosts
- neoprism: stop serving /hosts and /retiolum.hosts
- ignavia: move the styx tinc Address override onto the kartei-built host
file; the krebs.hosts one had no effect since the kartei cutover