NASty v0.1.0

This is the storage resilience, control & observability release.
Filesystem operations are now bound to persistent UUIDs, unavailable
registrations can be retired safely, and subvolumes and physical disks gain
finer policy controls. Under load, NASty prioritizes its control plane while
reporting maintenance progress and bcachefs memory more accurately. Alerts
gain acknowledgement and managed TLS monitoring, update and Tailscale paths
become safer, and root-equivalent operations receive tighter authorization
boundaries.

Headline changes

• UUID-bound filesystem lifecycle (#721, #733, #753). Mount, remount,
  unmount, destroy, and option changes verify the persisted filesystem UUID.
  Foreign pools cannot silently inherit a managed name or mountpoint. Entirely
  unavailable filesystems can be forgotten safely without touching their disks,
  encryption keys, or data.
• Storage policy and scheduler controls (#732, #742). Existing subvolumes
  can change or inherit compression, replica, and erasure-coding policy.
  Physical disks gain stable-identity I/O scheduler controls that persist
  across reboots.
• Responsive control plane and truthful maintenance state (#739–#743).
  Authentication, API, and status work receive priority over bulk operations.
  Reconcile alerts track actual moving-byte progress, scrub/fsck completion no
  longer produces false restart failures, and the dashboard reports the
  kernel-observed bcachefs btree-node cache.
• Actionable alerts and TLS health (#746, #776, #777). Active alert
  occurrences can be acknowledged without pretending the condition is
  resolved. Managed ACME certificates gain live per-host status plus expiry and
  renewal-failure alerts.
• Safer updates and Tailscale lifecycle (#747, #749, #766, #769, #775,
  #793). Tailscale has an independently pinned NixOS package source, legacy
  wrappers migrate safely, update state survives transport failures, failed
  activations collect better diagnostics, and nasty-cleanup all can reclaim
  failed generations when /boot is full.
• Tighter Admin boundaries (#781). Root-equivalent Compose, unsafe mounts,
  passthrough devices, raw QEMU options, unmanaged block exports, and similar
  operations now require an unscoped Admin. Operators retain managed,
  constrained workflows.

Storage & operations

• Filesystem creation and lifecycle operations use authoritative UUID identity
  instead of trusting names or mountpoints (#721).
• Mount identity discovery tolerates the short post-mount visibility delay
  sometimes seen through blkid and lsblk, while real mismatches still fail
  immediately (#733).
• The Forget action removes only the host registration for a completely
  unavailable filesystem. It fails closed if the pool is visible, mounted, or
  still has dependencies, and does not erase disks, data, or encryption keys
  (#753).
• Subvolume compression, replicas, and erasure coding expose explicit,
  inherited, and effective policy and can be changed after creation (#732).
• I/O scheduler settings move from filesystem-level configuration to individual
  physical disks and are restored using stable disk identity (#742).
• Scrub and fsck completion no longer races with status polling into false
  interrupted or failed states (#743).
• Reconcile-stall detection follows actual moving keys and bytes rather than
  only static pending totals (#739).
• The dashboard exposes approximate bcachefs btree-node cache usage. This is one
  component of bcachefs memory, not a total memory figure (#741).
• The bundled bcachefs tools and DKMS module move from 1.38.8 to 1.39.2
  (#745, #756, #772).

Security, authorization & privacy

• Root-equivalent operations require an unscoped Admin, including Compose
  lifecycle, app-runtime configuration, unsafe mounts, passthrough devices,
  raw QEMU options, snapshot rollback, raw Samba parameters, and unmanaged
  iSCSI/NVMe-oF sources (#781).
• VM disk, network, bridge, MAC, and QEMU configuration receive stricter
  allow-list validation. Operators can continue to use managed image files and
  proven managed block volumes (#781).
• Compose inspection rejects configuration that cannot be safely resolved,
  including include, extends, volumes_from, interpolated bind sources,
  Docker socket exposure, and mounts into protected engine state (#781).
• Mounted filesystem browsing works again in guest links and the standard-user
  portal while retaining descriptor-anchored traversal, symlink protection, and
  descendant-mount boundaries (#728).
• Telemetry documentation now accurately describes the pseudonymous
  installation ID and transmitted usage information (#718).
• Enabled telemetry adds aggregate SMB, NFS, iSCSI, and NVMe-oF configuration
  counts. Names, paths, hosts, file contents, and resource identifiers remain
  excluded (#720).

Alerts, TLS & networking

• Operators and Admins can acknowledge a specific active alert occurrence.
  Acknowledgements persist across restarts, do not falsely resolve the
  underlying condition, and a recurrence receives a new occurrence ID (#746).
• Managed ACME certificates gain warning and critical expiry alerts plus
  renewal-failure detection (#776).
• TLS cards use live Caddy and certificate state, including issuing, renewed,
  expiring, expired, and failed states (#777).
• IPv4 DNS addresses are serialized correctly for NetworkManager instead of
  being byte-swapped (#751).
• SMB discovery permits WSD metadata traffic on TCP 5357 in addition to
  discovery on UDP 3702 (#779).
• SMART monitoring can be enabled for passed-through disks and controllers in
  VMs; ordinary virtual disks remain disabled by default (#736).

Updates, apps & WebUI

• The engine runs at elevated CPU priority while backups, restores, filesystem
  maintenance, VM work, rebuilds, and other bulk jobs are demoted and bounded
  (#740).
• Tailscale can be updated independently from the appliance's main nixpkgs pin,
  while activation verifies that an existing tailnet connection returns
  successfully. Legacy wrapper flakes continue to evaluate during migration
  (#747, #749).
• Failed update starts reconcile against authoritative systemd state instead of
  leaving a stale running indicator. Retrying means repeating the original
  update action rather than submitting an ambiguous generic retry (#769).
• Docker readiness and app-port discovery are bounded during activation,
  avoiding false upgrade failures on app-heavy systems. Failed activation and
  rollback paths capture service and journal diagnostics (#775).
• nasty-cleanup continues to retain three system generations. The explicit
  nasty-cleanup all mode removes every non-current generation, including
  newer failed generations left after rollback, then garbage-collects and
  resynchronizes /boot (#793).
• Compose edits preserve custom hostnames and pinned ingress ports (#754).
• Installed apps gain recognizable local logos with deterministic monogram
  fallbacks that work offline (#729).
• Failed backup profile edits preserve entered values and remain open (#784).
• Backup snapshot and restore flows use accessible, focus-managed dialogs
  (#787).
• File actions remain accessible on touch, coarse-pointer, and keyboard-driven
  interfaces (#785).

Tools, docs & platform

• DiskWatch moves to 0.4.0, and the appliance adds NetWatch 0.29.2 and
  SysWatch 0.10.0 to the terminal (#767, #780, #789).
• Tailscale moves to 1.102.2 (#766).
• Vendored Swagger UI moves to 5.32.14 (#765, #795).
• The Hetzner Caddy DNS plugin moves to 2.0.1 (#764).
• Linux moves from 6.18.40 to 6.18.46 across the weekly nixpkgs updates
  (#738, #748, #768, #771, #788, #790, #791).
• Rust moves to 1.98.0. Rust dependency updates include async_zip 0.0.19,
  base64 0.23.1, rusqlite 0.40.2, rustic_core 0.13.0, and rustic_backend 0.7.0;
  obsolete quick-xml advisory exceptions are removed (#759, #762, #773, #794,
  #796).
• WebUI dependencies move to Svelte 5.56.10, SvelteKit 2.70.3, Vite 8.2.2,
  and Vitest 4.1.11, with related UI library updates (#760, #773, #797).
• A new Jellyfin deployment guide covers Compose, HTTPS, hardware acceleration,
  upgrades, backups, recovery, and troubleshooting (#770).
• API documentation now reflects the current secure WebSocket, REST, Swagger,
  and OpenAPI endpoints (#783).
• CI tests every Rust workspace target, runs appliance integration for
  WebUI-only changes, and uses the v7 official GitHub Actions (#763, #782,
  #786).
• Release engineering refreshes the custom Caddy plugin source hash and applies
  architecture-aware SquashFS compression so both installer architectures can
  be published without dropping appliance functionality (#798, #799).

Upgrading

• bcachefs 1.39.x: bcachefs 1.39.0 introduced an upstream on-disk format
  change for per-device fragmentation tracking. Ensure backups are current and
  avoid downgrading tools or kernels after a filesystem has adopted the newer
  format (#745).
• Operator permissions: existing Operator automation that performs
  root-equivalent operations may now receive access-denied errors. Review
  Compose, app-runtime, snapshot rollback, passthrough/raw VM, raw Samba, and
  unmanaged block-export automation before upgrading (#781).
• Legacy filesystem state: registrations without a persisted UUID now fail
  closed instead of operating by name. Older or manually edited state may need
  explicit recovery (#721).
• I/O schedulers: unambiguous filesystem-level scheduler settings migrate to
  per-device settings automatically. Conflicting or unresolved entries remain
  unmanaged rather than being guessed (#742).
• Failed update or full /boot: run nasty-cleanup all to remove all
  non-current generations, including a newer failed generation. This also
  removes retained rollback generations until another successful update creates
  one (#793).
• Telemetry: installations with telemetry enabled now report aggregate
  sharing configuration counts (#718, #720).
• Tailscale: native self-update remains disabled on NixOS. Tailscale package
  updates are managed through NASty's Upstream page (#747, #749).

---

Proxmox users: NASty requires UEFI. Switch the VM firmware from SeaBIOS to OVMF before installing, otherwise NASty won't boot after the first restart.

⬇