you might here some folks talking about dendritic nix modules, but around here we just call them flake parts.

a new emmanation of my trusty old vim config, now available as a home-manager nix module. now i can track my dependencies with nix instead of using git subtree and it makes installing backend programs like language servers and such way easier. https://src.ix.cyb.red/pe-vim/

i wish nixos had a more recent version of badwolf, maybe i'll just package it myself

if i had to make an app today, i would probably pick like phoenix, elm, and postgresql. i would want to use sqlite+litefs, but i need more experience with it.

minibase has a network security architecture with a number of overlapping layers of protection. first, routers and discovery endpoints either require a password or an authorized public key to accept traffic. this setup restricts who can reach the endpoints to an extent, but peering with enough third parties with less restrictive policies will practically allow global routing. since this is a possible policy choice, minibase also requires internal traffic to be authenticated. overlay traffic is automatically encrypted by yggdrasil, but applications should still treat the traffic like its clearnet and use tls. currently i'm requiring a dns acme challenge to generate wildcard certs, but eventually it might make sense to scope the certificates to the specific service its associated with. we don't have much config generation in the nix modules yet, but something like this should be possible eventually. i'm working on configurations for ory oathkeeper, hydra, and kratos to provide a federated auth framework that your network services and minibase configs can integrate with.

so i learned that my vpn provider uses nftables to tag traffic for split tunnelling. so it looks like i'll be converting my iptables rules. there's some implication for docker containers that i'll have to reckon with, but i'm already nesting them inside a nixos container so i don't really need docker to touch the network at all. after that i'll be able to define some rules to allow traffic meant for the yggdrasil network to reach the tunnel. this will be important later.

freebsd makes a lovely server os, nixing it would be fucking excellent. i wonder if they ported systemd? shit's making me curious

nixbsd is taking a long time to build, but that's expected. i guess a fast machine can do it in just 8h. might be about time to get my binary cache setup. my machine can only handle max-jobs=2 :(

time to give nixbsd a spin

experimenting with litefs has been really interesting. i'm still learning about consul, so nothing distributed is happening yet. so far i have a setup that shares a virtual filesystem with a set of nixos containers running ejabberd and redka. soon some ory services for auth and security which also support sqlite will join the party, but those require higher availability that i can manage with my current deployment. the big server needs to me migrated before security can come online.

cloning nixpkgs is way too difficult, none of my local machines could even do it

decentralization of nixos https://discourse.nixos.org/t/monorepos-dont-map-to-our-social-structure/44162/5

it would be interesting to build a new nixpkgs based on a totally different base system. like, genode (sel4+) that can take the interesting security properties of nix and apply them to a non-posix secure-by-construction type of OS

I wonder if bento has slightly missed the key to being a total genius approach to host management. ok hear me out. each node periodically pulls configuration from a coordination node that hosts a binary cache. the admin may make changes and pre-build them maybe kick off an update task manually if they want, but the point is there's an automated checkin. for my case, the device I have available for coordination isn't really capable of hosting a binary cache for any of my other machines. the nix store for my dev machine is larger than the entire disk of the coordinator! and due to the yearly heat my best machine can't be reliably powered on all the time. so i started thinking to myself, "self, what if instead of having a central coordinator we fetched configuration from a reliable git mirror (maybe git+torrent some day) and consume it as a flake. the source could even be swapped out using a flake registry (so you don't even have to commit to self-hosting anything other than a json file). then managed hosts only have to be setup to consume the registry and the shared flake (which registers the update agent) and DONE?"

some day, you'll be able to download nix-on-android from f-droid and nix run git+https://git.cyb.red/pkgs/free-internet.flake and join the no se vende mesh collective.. something like that

tried out a demo vm setup of nixos, but i really want to level up my server game and provision the whole thing using terranix.

this is what i like to see https://gerbil.scheme.org/guide/nix.html

i have successfully put a docker container inside of a nixos container, a turturken so to speak. next up, we get arion-compose working in there and then see about mem_limit and cpus!

i have finished porting my laptop config to nixos in record time. i did the entire rebuild in one day, only a handful of hours total. love it.

today i will start trying to extract my dots from my memex database and manage the dependency tree entirely using nix flakes

minibase bootstrap iso first look is up on the gits https://git.ix.cyb.red/IX/minibase/src/branch/main/dev/bootstrap #nix #lix

installing lix fixed my busted nix install. i installed the rpm from their website and it didn't work so i typed curl -sSf -L https://install.lix.systems/lix and was happy happy happy

nix lix aux is for sure a winner

my first nix flake https://git.ix.cyb.red/pkgs/msmart-ng.flake its kind of ok i guess. i'm still learning ^^

reject UNIX embrace FORTH