rob thijssen
eb8ae53c8f
systemctl enable arms a path unit only from the next boot; on hosts that never reboot the watcher stays dead and cert rotations go unnoticed. quadbrat's host cert expired on May 7 and renewal could never recover (step ca renew authenticates with the expired cert), leaving its agent unable to heartbeat for five weeks of timer failures. Start the path units explicitly during deploy; also started them on all current hosts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>