[jaspermayone]

Summary

weft, the Krater host, is built.

• Created on pve01 with qm create (VMID 361, 10.100.90.61), installed with nixos-anywhere, and on the tailnet with tag:patchwork and tag:patchwork-krater.
• Size: 4 GB and a 40 GB disk, not 2 GB and 20 GB. Krater builds its image on the host and runs SeaweedFS storage. terraform/proxmox/variables.tf and the docs now match.
• Imported into the Terraform state: proxmox_virtual_environment_vm.nixos["weft"]. A read-only plan shows only agent.timeout 15m to 2m, which is a value in the state, not on the VM.
• secrets/secrets.nix: weft's host key, and weft as a recipient of ad-join.age. Only ad-join.age is re-encrypted. weft gets no app secret here. Krater's secrets come in feat(krater): krater staging on weft, production ready behind one switch #32.

After merge

1. deploy .#weft. agenix can then decrypt ad-join.age, and ad-join.service joins weft to AD. It fails today, because weft cannot read the file yet.
2. Add the weft A record in AD DNS (ansible/ad.yml -t host-dns).
3. The lnx-weft-* members come from the AD PR (feat-ad-host-group-members).

Test plan

• secrets/secrets.nix parses. Only ad-join.age changes among the secrets.
• tofu import and a read-only targeted plan.
• weft is up, and tailscale status shows both tags.