Includes all pending changes needed for nixos-anywhere:
- fiberlb: L7 policy, rule, certificate types
- deployer: New service for cluster management
- nix-nos: Generic network modules
- Various service updates and fixes
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace form_urlencoded with RFC 3986 compliant URI encoding
- Implement aws_uri_encode() matching AWS SigV4 spec exactly
- Unreserved chars (A-Z,a-z,0-9,-,_,.,~) not encoded
- All other chars percent-encoded with uppercase hex
- Preserve slashes in paths, encode in query params
- Normalize empty paths to '/' per AWS spec
- Fix test expectations (body hash, HMAC values)
- Add comprehensive SigV4 signature determinism test
This fixes the canonicalization mismatch that caused signature
validation failures in T047. Auth can now be enabled for production.
Refs: T058.S1
Refactored flaredb-server and plasmavmc-server to use a unified configuration
approach, supporting TOML files, environment variables, and CLI overrides.
This completes T027.S0 Config Unification.
Changes include:
- Created dedicated modules for both flaredb-server and plasmavmc-server
to define structs.
- Implemented for in both components.
- Modified in flaredb-server to use instead of .
- Modified in plasmavmc-server to add dependency.
- Refactored in both components to load config from TOML/env and apply
CLI overrides.
- Extended in plasmavmc-server/src/config.rs to include all
relevant Firecracker backend parameters.
- Implemented in
plasmavmc/crates/plasmavmc-firecracker/src/lib.rs to construct backend
from the unified configuration.
- Updated docs/por/T027-production-hardening/task.yaml to mark S0 as complete
and the overall task status as active.
