# mvirt 0.14.4

migrations: no
wire: unchanged
rev: aefb018f9312c1395bdf2f7f396ec07c8a20d2ec

v0.14.4 — template imports run on the infra project's system network, not on a project and network of their own

Owner decision (2026-08-18): PaaS services (registry, DBaaS backends) and
imports share ONE system network. The ADR-0080 import Task now runs in the
manifest's infra project on that project's default network — the manifest's
system network, which already has NAT egress and resolvers by declaration —
instead of a platform-minted 'imports' network in the platform project. The
spec secret and the GC sweeps follow it; no infra project yet (first-run
setup unfinished) holds the import with a diagnostic instead of inventing a
place to run it; a legacy 'imports' network is swept once it carries no NIC.
The wizard's default draft and platform.yaml.example name the system network
'mvirt' (was 'paas').

Upgrade: control-plane host first, then nodes one at a time; a node rolls back
by booting the previous generation.


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.