EnigmaCurry

Thats the thing, LXC isn't a VM, its a container, so they all share the same kernel. I think its worth a shot, so I may test this.

If you're going to expose static secrets to your app, it kind of doesn't matter whether they are in a single vault or in a gpg encrypted file or something. The real benefit of a vault IMHO is to distribute dynamic certificates instead of a static secret, so that way it's time-boxed, and the static secret (private key) never actually leaves the vault.

Not directly related to openbao, but I've thought about this for awhile that I'd like to use ssh certificates instead of ssh keys to allow an agent a time limited SSH access to a server, and that seems to work for gating the initial connection, but I haven't yet figured out how to enforce the established connection dies after a certain time. I could maybe hand roll a solution with ExposeAuthInfo and ForceCommand wrapper, but it feels like this sort of thing should be handled delicately..

Yes, I don't really touch the PVE server at all after the initial install. I just build and deploy from my Fedora workstation running nix.

[1] https://github.com/EnigmaCurry/nixos-vm-template

This is what I've built [1], and I'm using it daily for things like agent sandboxing when I deploy it builds a new image completely replaces the OS disk - on upgrade it only keeps its data drive mounted to /var.

[1] https://github.com/EnigmaCurry/nixos-vm-template

NixOS has transformed my use of Proxmox. I configure, build, and deploy everything from my nix workstation. I don't need to use the PVE gui at all. Proxmox is just a target, and I've abstracted things enough to where I can deploy the same machines to libvirt on a local machine too. Why would I need to let my agent into my PVE box? I haven't looked at incus, but if I wanted to run the full stack declaratively, nixos and LLMs are so powerful now that I would probably just say to run libvirt and ZFS on nixos natively.

I'm happy to see this, and I have lots of thoughts about this. Building declarative services on Nix is a far superior way of distributing Linux to VMs than most any other way I've tried. I am working [1] on very similar things, but I've been leaning more on the self-hosted path, my VM template targets libvirt and Proxmox VE with a single CLI api. I even have an experimental branch that targets DigitalOcean. For VMs especially, I want my OS to be immutable. My VMs should contain no state other than my application state. Upgrades should be a full image replacement and reboot.

So in my template, I have created the VMs with two disks: first one is for NixOS and is built from an image, and it is read-only. The second is mounted to /var and is used for all system configuration as well as application state. If I have multiple VMs, they can all share the same base image (thin provisioned). That's the mode that I want for my deployments of services, immutable and as stateless as possible. For agent use, its different, you actually want a mutable NixOS root so that the agent can do what it wants.

I built three modes: immutable, semi-mutable, and mutable. mutable removes the read-only lock on the root, and just lets you manage the VM as a pet. semi-mutable adds an ephemeral overlayfs that gets wiped the next time you upgrade the base image. So that gives you kind of the best of both worlds: an immutable read-only base image and the ability to "nix profile add" whatever you (or your agent) wants, but with the contract that these imperatively installed things will disappear the next time you upgrade. Are you planning on adding a LICENSE to your machine0-nixos repo?

[1] https://github.com/EnigmaCurry/nixos-vm-template

I am learning Clojure this week, and my test project is a calculator / unit convertor [1]. I wanted it to run in the CLI and on the web, so it targets several hosted platforms: Babashka / JVM / ClojureScript. It's a single code base written in cross platform .cljc files. I already have about 250 tests written for the abstract calculator API, run as a test matrix across platforms, so the project is already in a good place for testing a new runtime.

I just learned about basilisp from the parent comment, so I asked Claude to add Python support to the same .cljc files I have, and we finished the port in about 30mins, and then fixed Python specific test cases for another 30 mins, but now all of the existing tests are passing. That's impressive in several ways.

Portability is achieved by testing. You have to put the platforms you want to support into your test harness, and the earlier the better. A calculator is purely functional, so this is a fairly straight forward port and really easy to test for. I'm not sure about larger projects, but it seems like there is something seriously right about Clojure's design that makes this easy to do.

[1] https://github.com/EnigmaCurry/calc

That may have been the dumbest line in the article, the oils in question, are made out of seeds.

Yes. The registrar is for the root domain. You provide your own DNS. DNS can do wildcards for any root domain its delegated.

Sent from my Ipad

Same. Here's how I scratch the NixOS itch on Proxmox and/or libvirt[1]. One interface for both targets.

[1] https://github.com/EnigmaCurry/nixos-vm-template

Yes, that solves it completely. But the exercise we were trying to do was to do it without that.

Many home routers try to preserve the source port in external mappings. This is a property called “equal delta mapping” – it won’t work on all routers but for our algorithm we’re sacrificing coverage for simplicity.

It is precisely this point that has flummoxed me when connecting my p2p wireguard config[1] with a friend that uses a pfsense router, no matter what we tried, pfsense always chooses a random source port.

But in the simple case this blog outlines, if both ends use the same source port, this method punches through 2 firewalls effortlessly:

[1] https://blog.rymcg.tech/blog/linux/wireguard_p2p/

Use APIs for building things (and preparing for things to be built upon). Production.

Use CLI for exploration, coding, and learning. Greenfield.

In general, Declarative > Imperative.

GPD Pocket 4

yes I used to use it too :) I think I've written three or four SSG since then haha.

Anybody have something better?

I wrote this to publish Org docs to S3 - https://github.com/EnigmaCurry/s3-publish.el - I wanted something extremely lightweight, not even wanting to commit things to git like I normally would and waiting for CI to build something. Uploading html directly to S3 means it gets published in <1s from push.

Yea on Linux I can run 10 different VPNs (or 10 wg peers) no problem, this limitation of Android is super annoying to me. I think OPs solution is quite a good one for Android users.

This is at least a limitation in Android itself:

https://developer.android.com/reference/android/net/VpnServi...

"There can be only one VPN connection running at the same time. The existing interface is deactivated when a new one is created."

Note this is not about routing some traffic to the VPN and other traffic to the clear net. This is about running two VPN connections simultaneously.

Maybe try https://github.com/nschlia/ffmpegfs

I feel like my Rust code takes 3x as long to write as my Python code, but the gpt results for rust are about 10x better, because the tooling is a backstop against hallucinations.

I really like the Rust tooling and I like exhaustive pattern matching. Python post-dev debugging time is probably 10x vs Rust. That's why I choose Rust.

How does this compare with iSCSI?

EndeavourOS sway edition (community) [1] has been a pretty great start for preconfigured wayland+sway+waybar and various integration. I added some more stuff to my ~/.config in my own repo [2], but it was a good place to start, and EndeavourOS is basically just rolling Arch Linux with some extra niceties. The included EnvyControl [3] switcher between nvidia to integrated is nice (yea you do have to reboot tho to switch), so I have used the regular i3 config with Xorg for playing some games (nvidia hardware graphics), but use sway for my day to day use (integrated graphics on wayland).

[1] https://github.com/EndeavourOS-Community-Editions/sway

[2] https://github.com/enigmacurry/sway-home

[3] https://discovery.endeavouros.com/hardware/envy-control/2023...

irrevocable licenses are pretty different than subscriptions.

Ownership.

If you are stuck on wordpress, consider using a static export plugin like wp2static [1]. I have been playing around[2] with a setup where the normal WP UI is protected behind HTTP Basic Authentication, and wp2static exports the public snapshot

[1] https://github.com/WP2Static/wp2static

[2] https://github.com/jessopb/wp_d_rymcg

Lots of apps will still show a black screen via scrcpy:

* The lock screen of the device

* AndOTP

* Bromite Incognito mode.

I think its called a "security screen" which prevents this, or something like that.

some glaring issues - tramp being a major one. It’s slow and very unreliable.

Over SSH? Did you turn on ssh connection sharing in ssh config?

ControlMaster auto

ControlPersist yes

ControlPath /tmp/ssh-%u-%r@%h:%p

massive speedup when you do this, otherwise it starts a new connection for every operation.

Its a hardly a requirement, some people just enjoy doing it. You can just use someone else's config, lots to choose from.