n-OS-tr live ISO (Phase 2 Slice B+C)
===================================

This live image enables:
- n-os-tr-firstboot.service (oneshot provisioning)
- ginxsom.service (Blossom FastCGI server)
- nginx.service (TLS frontend)
- fips.service + fips-dns.service (mesh daemon + DNS responder)
- c-relay.service (Nostr relay)

First boot generates:
- ginxsom identity material under /var/lib/n-os-tr/keys/
- service environment at /var/lib/n-os-tr/env
- self-signed TLS certs under /etc/ssl/n-os-tr/

Useful checks:
- n-os-tr-smoketest
  - Output shape: [PASS|FAIL|SKIP]  <label>  (<detail>) plus a PASS/FAIL/SKIP summary.
- systemctl status n-os-tr-firstboot ginxsom nginx fips fips-dns c-relay
- journalctl -u n-os-tr-firstboot.service
- journalctl -u c-relay.service | grep 'Admin Private Key:'
- fipsctl identity
- fipsctl peers
- cat /var/lib/n-os-tr/keys/ginxsom.nsec
- curl -k https://localhost/
- curl -k -H 'Accept: application/nostr+json' https://localhost/relay

Relay endpoints:
- wss://<host>/relay
- https://<host>/admin/

If terminal colours render poorly, run: NO_COLOR=1 n-os-tr-smoketest

Notes:
- Identity is ephemeral by default for this slice (ginxsom nsec, fips identity, c-relay admin key).
- fips transport is configured for ethernet discovery and UDP bootstrap peer connectivity.
