I have previously written about how I setup full disk encryption via LUKS on my NixOS machines. There I made the mistake of not initializing a filesystem on the (encrypted) partition meant to hold the key to unlock the other disks. This apparently only worked on NixOS on the happenstance that systemd was patched up to make it work. Recently (just before the NixOS 26.05 release) that patch was…
I recently found myself in a situation where I needed to write up a document intended to be updated once or twice per year and otherwise kept printed out as a hard copy in a safe location. The only requirement I have is that I want to be able to write in Markdown (I write a lot of Markdown and find it to be minimal enough fuss that I can focus on getting content on to a page) and be able to render…
Gitea supports automatically signing commits it generates (such as when merging pull requests, or editing files through the web editor). Sadly there is no documentation on how to actually configure this, besides vague references that it is left up to the server administrator to achieve. Secure key management is a topic fraught with complexity and trade off decisions, and the Gitea development team…
Open Source is a Gift. But a gift that comes with strings attached is a shitty one. HashiCorp recently announced its decision to relicense their software . I've never used, nor contributed to their software so I don't particularly care, but since there's a lot of takes flying around in the discourse I wanted to express my own thoughts on the general pattern of companies trying to…
The PiBox is a small personal server powered by a Raspberry Pi CM4. It comes in a nice enclosure which has a fan, an LCD screen, and has two bays for SATA SSDs. KubeSail , the company behind it, offers backup storage and proxy traffic as a service. They also support a bunch of templates for easily self hosting apps like Jellyfin or NextCloud. But, since I'm already very comfortable with NixOS…
Suppose we have control of our own domain and a set of services we want to share with (only) our friends and family. Here's how we can make them accessible over both Tailscale or when connected to the same physical network while using the exact same domain in each case. I personally love Tailscale and it truly makes securely connecting devices incredibly easy. That said, it's not always…
A year ago I found myself with some free time around the holidays which was the perfect opportunity for tinkering with Nix and cargo. What started out as a weekend learning project shaped up so nicely that I decided to share it with the world , and here we are a year later. Since then we've seen: 89 pull requests 17 releases 300+ GitHub stars Support for auditing dependencies via cargo-audit…
I live my life dangerously. And by that I mean I like to run unstable versions of various software that I use daily and prefer to work as I expect them. Sometimes a change will land and break my workflow, though Nix makes this tolerable since I can always switch back to an older version of my configuration. Except sometimes the breakage isn't due to a bug but an intentional change in upstream…
It's been about two days since I received my Steam Deck, and after a few hours of playing with it, I wanted to write up my very first impressions and thoughts on it. There are tons of professional reviews of it online, but I figured it might be useful if you are impatiently anticipating receiving your own unit and want to know what to expect (or, if you are Valve and you want to get some data…
Since the initial release of Crane , I've been busy hacking on adding support for building projects which may pull in dependencies from alternative registries as well as git repositories. I wanted to share how it works, so let's dive right in! Alternative Registries Although crates.io is the default registry for the majority of (public) Rust projects, cargo does allow for configuring any…
I'm pleased to announce the initial release of Crane : a Nix library for building cargo projects! In a nutshell it offers: Source fetching : automatically done using a Cargo.lock file Incremental : build your workspace dependencies just once, then quickly lint, build, and test changes to your project without slowing down Composable configuration : split builds and tests into granular steps.…
After working with Nix flakes for a while you develop a sense for how to interact with them in more efficient or ergonomic ways. That said, a number of the interactions I'm about to describe were extremely non-obvious to me, especially as someone who had never peeked at their actual implementation. This is the cheat-sheet I wish someone had shown me when I first started tinkering with flakes.…
SQLx is a Rust crate for asynchronously accessing SQL databases. It works by checking all queries at compile time, which means it needs access to the database when building. Although it supports an offline-mode (intended for CI or network-blocked builds), I prefer avoiding having to remember to manually run commands to keep schemas in sync. Let's take a look at how we can efficiently automate…
This write up was originally published within my dotfiles . NixOS is a great tool for declaratively managing system configurations (namely what packages and other config files are available), but there are still a number of imperative steps to run when setting up a brand new machine before installation. (Okay, there are some projects which seek to automate this process as well, but unless you are…