Agent host: the VM is now nisse, not nisse-host

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

deploy/agent-host/README.md

@@ -1,7 +1,7 @@
 # The agent host
 
-`nisse-host.garrett-hall.com`, made by infra/tofu#77 (architecture X1). For now
-it holds the knowledge vault and SilverBullet, the operator's view of it (L10,
+`nisse.garrett-hall.com`, made by infra/tofu#77 as `nisse-host` and since
+renamed (architecture X1). For now it holds the knowledge vault and SilverBullet, the operator's view of it (L10,
 M5.4). The agents' containers come later (M6.1).
 
 ## What's here

deploy/agent-host/caddy/vault.dongar.net.caddy

@@ -6,5 +6,5 @@ vault.dongar.net {
 	@outside not remote_ip private_ranges
 	respond @outside 403
 
-	reverse_proxy nisse-host.garrett-hall.com:3000
+	reverse_proxy nisse.garrett-hall.com:3000
 }

docs/Development-Plan.md

@@ -553,10 +553,10 @@ SilverBullet so far (M5.4). Until M6.2, the build VMs stay made by hand, with
 `vm ready` for a rebuilt one's host key.
 
 **M6.1 The agent host.** *Needs discussion.* Containers, volumes, snapshots,
-per-agent networks (X1, X2, X4). The host exists: `nisse-host` (infra/tofu#77,
-2026-10-18; 2 cores, 4 GB, 100 GB, on VLAN 1, nightly Proxmox backups), requested
-through nisse-dev's own quota to test that path; the operator may move it out of
-the quota. It holds only the vault and SilverBullet so far (M5.4).
+per-agent networks (X1, X2, X4). The host exists: `nisse` (infra/tofu#77,
+2026-10-18, as `nisse-host`; 2 cores, 4 GB, 100 GB, on VLAN 1, nightly Proxmox
+backups), requested through nisse-dev's own quota to test that path; the operator
+has since renamed it and moved it out of the quota. It holds only the vault and SilverBullet so far (M5.4).
 
 **M6.2 Build VMs by Terraform.** *Needs discussion.* The template, VLAN and egress
 (D7, X2), collection when idle.

scripts/agent-host.sh

@@ -7,9 +7,9 @@
 # Trusts only the host keys bot-ansible posted (~/bin/tofu-wait.sh saved them).
 set -euo pipefail
 
-host=${AGENT_HOST:-nisse-host.garrett-hall.com}
+host=${AGENT_HOST:-nisse.garrett-hall.com}
 key=${AGENT_HOST_KEY:-/root/nisse-e2e/ssh/id_ed25519}
-known=${AGENT_HOST_KNOWN:-/root/nisse-e2e/nisse-host.known_hosts}
+known=${AGENT_HOST_KNOWN:-/root/nisse-e2e/nisse.known_hosts}
 repo=$(cd "$(dirname "$0")/.." && pwd)
 
 on_host() {

tests/deploy/test_agent_host.py

@@ -71,7 +71,7 @@ def test_its_port_caddys_and_the_firewalls_agree() -> None:
     port = setting("SB_PORT")
     assert silverbullet()["ports"] == [f"0.0.0.0:{port}:3000"]  # IPv4 only
     caddy = (HOST / "caddy" / "vault.dongar.net.caddy").read_text()
-    assert f"reverse_proxy nisse-host.garrett-hall.com:{port}" in caddy
+    assert f"reverse_proxy nisse.garrett-hall.com:{port}" in caddy
     assert "@outside not remote_ip private_ranges" in caddy  # the LAN only