Get Expanse 1.1.9.

Changed

• Installs are about 2.5 times faster: the install step takes about two minutes in QEMU, down from five, and downloads 18 MiB instead of 192 MiB. The installed node now builds the installer's own expanse, so it is copied off the ISO rather than compiled; the ISO carries a reference node for each disk layout and the tools that disko and the node-specific parts build with; and nixos-install copies NixOS's small local-only derivations off the ISO instead of rebuilding them. The ISO grows from 1.47 GB to about 1.65 GB.
• The tty1 host console drops its Node ID row when the ID is only the hostname again (a clustered node) or a bare UUID.

Fixed

• Installed nodes reported their commit as installer; they now report the commit the ISO was built from.

Added

• Expanse is licensed under the Apache License, Version 2.0: LICENSE and NOTICE at the top of the source tree, and meta.license on the Nix package.
• The expanse package ships LICENSE, NOTICE, a THIRD-PARTY.md listing every vendored Go module and its version, and each module's own licence, under share/licenses/expanse. Installed nodes and the installer link them at /run/current-system/sw/share/licenses/expanse. Earlier ISOs shipped the binaries without the notices their MIT and BSD modules require.
• scripts/release.sh publishes a release: it builds and checks the ISO, stages SHA256SUMS, the changelog notes and a release.json manifest, pushes the tag, creates the GitHub release with the ISO attached and runs the website's tools/sync-release hook. See docs/RELEASING.md.

Fixed

• Nodes read DEGRADED for about two minutes after each boot, long enough to fire ExpanseNodeDegraded: the clock-sync check judged chrony's last correction, which is the clock step chrony makes at boot, instead of how far the clock is off now (System time in chronyc tracking).

Changed

• Installer TUI has a proper console layout: a framed, centred page that fits the terminal (80×25 upwards, redrawn on resize), a "Step n of 6" indicator, a disk table with model, size, type and current contents, a reverse-video selection cursor, a red destructive list on review, a real progress view (stage, progress bar, elapsed time and a scrolling log tail) and a done screen with the node's addresses and next steps. Colours are the VT's 16; box drawing falls back to ASCII with EXPANSE_TUI_ASCII=1. Keys and flow are unchanged.

Added

• expanse console: a read-only host information screen, like ESXi's DCUI, shown on tty1 in place of a login (expanse-console.service; tty2+ and the serial console keep their logins). Version, hostname and node ID, addresses and web UI URL, cluster name, role and quorum, health, CPU, memory, disks, md mirror state (a degraded array in red) and uptime, refreshing every 3 s. Health comes from the agent's heartbeat, so the console never re-runs checks. --once prints one screen to stdout.

Fixed

• Every node reported UNHEALTHY (and fired ExpanseNodeUnhealthy) for a minute after each boot while chrony synchronised. For the first 10 minutes after boot an unsynchronised clock now reads "unknown".
• The clock-sync check's large-offset warning (> 100 ms) could never fire.

Changed

• The web UI has a proper app shell and design system: sidebar, header with cluster name and quorum/health, user menu, light/dark toggle, breadcrumbs and a footer naming the serving node and version; status pills, styled tables, cards, forms with inline validation, toasts and <dialog> confirmations. Responsive to phone width, keyboard accessible, hand-written CSS, no build step, no CDN, self-only Content-Security-Policy.
• / is a live dashboard: nodes, quorum, blocks by phase, volumes by state, firing alerts, the current generation, a "needs attention" list and recent events.

Added

• Pages for Nodes, Generations (history, detail, diff of any two, rollback behind a confirm), Events (a live, filtered log of store writes) and Settings (admin password, OIDC status, UI CA download).

Fixed

• Plain form posts from a browser were rejected with "CSRF token mismatch".
• A node's reported health read "unknown" permanently: the agent's PATH lacked chronyc.
• The web UI footer read "Expanse dev" on installed nodes.

Changed

• The ESP and the system partition are now md RAID1 arrays across the first two disks (btrfs on the md array). Verified in QEMU: install, boot with each disk removed, and a replacement disk rebuilt and booted alone. Existing mirror installs keep the old layout until reinstalled.
• On an md ESP, systemd-boot is installed with relaxed ESP checks and without an NVRAM entry; each disk boots through \EFI\BOOT\BOOTX64.EFI.
• Mirror nodes ship sgdisk and log md events to the journal; the storage docs carry the disk-replacement runbook.
• expanse doctor storage reads the md array under the system btrfs: PASS for a healthy mirror, WARN when degraded.

Fixed

• Verified in QEMU through the interactive installer, nixos-install, first boot, a one-node cluster running a block, and a reboot that wipes root and keeps the cluster.
• Installer TUI key handling, dropped SSH keys, missing tools; the ISO's <nixpkgs> needed flakes; installed nodes had no hardware configuration and did not run the agent; the impermanence rollback raced the system disk; cluster init now refuses while expansed runs.
• The web UI could not be opened in any browser (SSL_ERROR_NO_CYPHER_OVERLAP): it now has its own ECDSA P-256 CA; import ui-ca.pem.
• An installed node's firewall blocked the web UI (8443) and metrics (7447) from other machines.
• The ISO and installed nodes log to the serial console too, with a login there.

Known issues

• Binary-backed block types (nginx, redis, …) need their program on the node's PATH, which an installed node does not ship; util/echo runs.

Fixed

• expanse version on the installer and on installed nodes reported 0.0.1 (installer). The release version lives in nix/version.nix, and the ISO is named expanse-<version>-<system>.iso.

Changed

• DRBD resources set c-min-rate 4M: a new or rebuilt replica on a busy volume syncs at 4 MiB/s or more instead of being throttled toward 250 KiB/s. Existing volumes pick it up on upgrade.

Added

• cluster init --expect 1 forms a working cluster on one machine; default volumes, blocks with storage and VIPs run there.
• Volumes grow to their replication target automatically as nodes join, one fully synced replica at a time; DRBD quorum turns on live at three replicas.
• A new UnderReplicated volume state, shown as "1 of 3 (no redundancy)"; volume list shows volumes waiting for placement with the reason.

Changed

• A volume or block storage entry without an explicit replication takes its storage class's target and is placed on as many eligible nodes as exist. An explicit --replication N still waits for N nodes.

Added

• Installer ISO with TUI and unattended modes, declarative btrfs+LVM layout, impermanent root.
• Clustering: mDNS discovery, HMAC join tokens, a Raft control plane over mTLS, generations with rollback, cordon/drain/remove, witness nodes.
• DRBD-replicated volumes on LVM thin pools: create, resize, snapshot/restore, online repair, split-brain recovery.
• Blocks: a scheduler for systemd-supervised workloads with rolling updates, anti-affinity, singleton and daemonset placement.
• Postgres, iSCSI and QEMU/KVM blocks with failover.
• WireGuard mesh, per-node nftables, L4/L7 load balancing with VIP failover.
• Web UI with OIDC login. restic backup and restore of cluster config and volume data. Prometheus metrics and alert rules. Cluster CA with zero-downtime rotation; age-encrypted secrets. Rolling upgrades, one node at a time, with zero acked-write loss.
• Every feature has NixOS VM-test coverage of real node kills, partitions and restarts.