# mvirt 0.29.2

migrations: no
wire: unchanged
rev: b1beecccea71701c5b3c4f5eae07403c8de32df3

mvirt 0.29.2

The internal CA key and backups are sealed under the platform KEK, certificate
renewal is observable, and several quiet leaks are closed.

ROLL PREREQUISITE (#131): keep an off-host copy of
/var/lib/mvirt/cp/secret-kek.key before rolling. After every voter runs this
release the leader seals the CA key; a pre-0.29.2 binary can then no longer
sign (tunnel listener, raft leaf, node onboarding) -> roll forward only.
Every restore now needs the KEK (`cplane restore --kek-file ...`).

- cplane: the internal CA private key is sealed under the KEK (re-sealed in
  place once all voters upgrade, no migration); backup artifacts are
  encrypted, no .kek beside them; restore refuses without the key
  (closes #131).
- cplane: certificate status shows renewAt, renewalState (NotDue/Due/
  InProgress/Held/Overdue), lastAttempt and a placeholder flag; acme log
  entries name the hostnames and land in the cert's project feed;
  load-balancer-settings shows effectiveAcmeProfile (closes #410).
- mvirt-s3: no seeded S3 key under NixOS; the native object store runs
  only on a platform-mode install - proxy-only hosts stop the 2 s warning
  (closes #87).
- cplane: a failed image pull backs off longer than a crash, a registry
  rate limit longest, with jitter (refs #288).
- pgaas: a member's pg_hba names the peer, the controller and the SNAT
  source, reconciled on change by reload (refs #277; takes effect with the
  next provider image).
- cplane: assistant web_search/web_fetch are audited and rate-limited; tool
  records are never dropped silently (closes #26).
- cplane: edge credentials only for members whose host runs an edge
  (closes #252).
- cplane: IPAM never hands out a held carrier address (ADR-0067 D13).
- meta: concurrent migrators on Postgres are serialized (refs #248).
- console: Select shows a themed chevron and honours caller heights
  (closes #50).
- ci: mvirt-meta Postgres tests run in CI; release keeps nix's fetcher
  cache (closes #195). Tests for LB front-ends in externally-routed blocks
  (closes #161).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.