# mvirt 0.18.3

migrations: no
wire: unchanged
rev: 755c7a49257cf9fd59343972ccbb75fb251c2d56

Release 0.18.3 — the border gateway's forwarding sysctls are actually re-asserted.

0.18.2's level re-assert of the border sysctls (#267) shelled out to a sysctl binary the
mvirt-ebpf unit does not have on its PATH on the NixOS node image, so every write was a silent
no-op — ip_forward stayed wherever the boot left it, and a mid-life flip was never repaired.
The knobs are now written straight into /proc/sys, which needs no binary and no PATH. Found by
probing the re-assert on a live production border.


Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01577XCdTfo1u5tUo9gM6aKP

## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.