sneak 2e05402fb4 Install the image's Ubuntu packages from the normal mirrors (closes #190) ...

The final image stage now apt-gets ca-certificates, nix-bin and runit
from Ubuntu's archive, with no snapshot and no hash check of the package
lists. The borrowed CA bundle is dropped: apt fetches the packages over
plain HTTP and checks each one against the archive's signed package
lists, so the install needs none. The Ubuntu base image stays pinned by
digest, and every other pin is kept. README.md, SPEC.md and
docs/image.md no longer describe a snapshot.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)

2026-11-06 18:13:57 +00:00

..

admin-endpoints.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

alerts.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

gitea.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

image.md

Install the image's Ubuntu packages from the normal mirrors (closes #190)

2026-11-06 18:13:57 +00:00

metrics.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

request-log.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

rules.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

settings.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

state-files.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00