Set thegeneralist-central's user shell to zsh (matching macOS pattern).
Drop the isDarwin guard on .zshrc generation so all hosts get the
SSH_TTY-gated nu exec — non-interactive SSH (Codex etc.) stays in zsh,
real interactive sessions still land in nu.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- `internal.thegeneralist01.com` and `archive.thegeneralist01.com` are
not public. I have Split DNS enabled on them (in Tailscale), with the
IP of the DNS server set to a private Tailscale IP of my home server;
- CoreDNS (also on my home server) is used to resolve the two private
domains' IPs to the home server itself;
- nginx only listens to its machine's (home server's) Tailscale IP;
- Therefore, all of it is hermetic!