The daemon stays on nixpkgs services.tinc; only the host database moves.
stockholm pins a kartei from before barnacle and its host type still requires
the legacy RSA pubkey, so peer keys now come from kartei modules/retiolum/hosts.nix
instead of config.krebs.hosts. krebs.hosts is untouched for everything else
(dns, iptables, consul, ...).

Effects: barnacle and 5 newer hosts become known fleet-wide, and the 35
RSA-only entries drop out -- tincr is SPTPS-only and refused them once per
connection attempt anyway.

starkstrom has no kartei card and keeps the one it declares locally in
krebs.hosts; that fallback goes away once it is in kartei.

barnacle is the first node on kartei darwinModules.retiolum: 2configs/retiolum.nix
is built on nixpkgs services.tinc, systemd-networkd and networking.firewall,
none of which exist on nix-darwin.

Host data (addresses, aliases, peer host files) comes from lass/hosts/barnacle
in kartei; the NixOS machines still read their host data through stockholm and
will not route to barnacle until that kartei pin is bumped.

The Ed25519 keypair is a clan var like on the NixOS nodes, but deployed with
neededFor = "activation": clans /run/secrets installer is Linux-only (tmpfs +
move-mount). No RSA half, tincr is SPTPS/Ed25519-only.

The source has a full macOS backend (utun via SYSPROTO_CONTROL, recvmsg_x
batching), and 5pkgs/flake-module.nix filters on meta.availableOn, so the
linux-only platforms list kept packages.<darwin>.tincr from existing.
barnacle needs it for retiolum key generation.

location of person.lass from home-assistant on an OSM map with a 24h trail;
neoprism polls the hass history API every 2 min into a static json,
token via clan vars (where-lassul-us/token)

One radicle-node serves one keypair, so each machine that does radicle
work gets its own identity (vars generator `rad`) and a node running
as the `rad` system user over /var/lib/rad. The profile is group-shared
(setgid dirs, umask-002 wrappers for rad/git-remote-rad, pre-created
group-writable sqlite files) so any account in group `rad` signs with
the machine identity; mainUser is a member. RAD_HOME points there for
login shells. Imported explicitly on coaxmetal, neoprism, ignavia,
icarus and shodan.

Rename the public seed module to 2configs/radicle.lassul.us.nix and
switch its retired seed.radicle.garden entry to iris.radicle.network.