Verified against nix eval, upstream sources and a local test:
- testvm accepts SSH password authentication (NixOS default), the README
claimed the opposite
- only /boot goes through by-partlabel; the filesystems inside the container
come up as /dev/mapper/crypted
- kanshi parses an empty config fine; a missing one is the error case, in the
README and in the desktop module comment
- modules/user.nix ABOUTME claimed a login name shared by every host
- the flake imports six modules, not five
Rewrites "Keeping a machine up to date": the checkout is ~/flakes/moonix and
/etc/nixos/flake.nix a symlink to it, which man 8 nixos-rebuild documents.
Drops the git and ssh-keygen basics. Adds an optional LUKS header backup step,
and records the checkout decision in DECISIONS.md.
nevaforget
55c81dbb8a