Krzysztof kuhy Rudnicki 0cea82cab5 feat: the nftables drift check now runs itself at boot ... `verify` gated on the two invariants whose breach cut every bridged container off the internet on 2026-08-29 and again after the 2026-08-30 reboot -- but nothing invoked it, so it reported drift only when a human thought to ask, and the outage it exists for is exactly the one nobody thinks to ask about. nftables-drift.service now runs it after nftables.service, docker.service and network-online.target at every boot, plus a daily Persistent timer. A breach is a failed unit in `systemctl --failed`, not a log line: a self-check that detects a failure has to gate, not warn. Proven in ~/utils/vmbox across two real reboots -- drifted /etc leaves the unit failed with the diff and the missing docker0 accept in its journal, matching /etc leaves it active with no false positive -- then installed and run green on the host. Not yet observed across a host reboot. Also bumps the gatelock pin to v0.7.3, which is what turned main's dependency-freshness job red; CI_GREEN_SKIP is set because this commit is that fix. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015d48t4qsQLBJnDwDeo2Nom		2026-08-30 15:49:12 +02:00
..
tests	feat: the nftables drift check now runs itself at boot	2026-08-30 15:49:12 +02:00
aw_autostart.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
aw_install.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
aw_service.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
dns_dhcp.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
dns_firewall.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
dns_units.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
dot_resolver_install.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
dwm_config.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
gitea_network.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
kcd2_autorebuild.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
kcd2_expose.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
kcd2_serve.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
local_llm_model.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
mobile_service.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
nc_discover.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
nc_flash.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
nc_image.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
nc_packages.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
nc_php.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
nc_remote_flash.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
nc_remote.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
nc_services.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
pi_flash_exec.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
pi_flash_image.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
pi_flash_remote.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
rpi_nc_ca.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
rpi_nc_deps.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
rpi_nc_fixes.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
rpi_nc_install.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
rpi_nc_ssl_remote.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
rpi_nc_ssl.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
rpi_nc_system.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
searxng_expose.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
searxng_limiter.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
searxng_settings.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
searxng_stack.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
searxng_start.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
searxng_status.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
syncyomi_expose.sh	Run SyncYomi from the local fork build and stop clobbering the Caddy edge	2026-08-28 14:44:40 +02:00
syncyomi_stack.sh	Run SyncYomi from the local fork build and stop clobbering the Caddy edge	2026-08-28 14:44:40 +02:00
unreal_mcp_repo.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
website_admin.sh	Run the website's post editor as a loopback unit, no Caddy route	2026-08-29 17:50:03 +02:00
website_build.sh	Run the website's post editor as a loopback unit, no Caddy route	2026-08-29 17:50:03 +02:00
wg_firewall.sh	feat: gate on nftables drift so the docker cut-off cannot come back silently	2026-08-30 14:56:24 +02:00
wg_keys.sh	Dissolve linux_configuration/scripts/ and single_use/	2026-08-23 18:53:30 +02:00
wg_sshd.sh	feat: the nftables drift check now runs itself at boot	2026-08-30 15:49:12 +02:00
wg_verify_units.sh	feat: the nftables drift check now runs itself at boot	2026-08-30 15:49:12 +02:00