# mvirt 0.24.8

migrations: no
wire: unchanged
rev: 1ebe1dfd8b4db250350c3625d586c5310ea4ef64

mvirt 0.24.8

A patch release: HTTP-01 certificates renew even when the control plane
cannot reach its own ingress.

What changed

- #360: the ACME challenge self-check fetches the challenge over the public
  URL from the control-plane host, which cannot reach the leased block's
  ingress VIPs (#284); the order was held there forever, and four production
  certificates came within 26 hours of expiry. A certificate that is burning
  its renewal margin and was already held at the self-check is now sent to
  validation anyway, at most once per hour per certificate, with a WARN.

Upgrade: ordinary host-by-host roll (release.md §C1 + §C3). No store migration.


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.