sneak dfb2948160 Install the image's Ubuntu packages from the normal mirrors (closes #190) ...

The final image stage now apt-gets ca-certificates, nix-bin and runit
from the archive the image's own sources name, with no snapshot and no
hash check of the package lists. The borrowed CA bundle is dropped: the
archive is reached over plain HTTP, so the install needs none. The Ubuntu
base image stays pinned by digest, and every other pin is kept. SPEC.md
and docs/image.md no longer describe a snapshot.

Model: deepseek-v4-pro

2026-11-05 20:27:15 +00:00

..

admin-endpoints.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

alerts.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

gitea.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

image.md

Install the image's Ubuntu packages from the normal mirrors (closes #190)

2026-11-05 20:27:15 +00:00

metrics.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

request-log.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

rules.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

settings.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00

state-files.md

rproxy and servewaf replace the one-process smallwebwaf (closes #172, closes #165)

2026-11-05 13:15:05 +01:00