EnigmaCurry
Joined 16 years ago
Karma
163
Submissions
101
Member since
Oct 30
Matrix @enigmacurry:enigmacurry.com
View on Hacker NewsRecent submissions
Comment · 3 months ago
Thats the thing, LXC isn't a VM, its a container, so they all share the same kernel. I think its worth a shot, so I may test this.
Comment · 3 months ago
If you're going to expose static secrets to your app, it kind of doesn't matter whether they are in a single vault or in a gpg encrypted file or something. The real benefit of a vault IMHO is to distribute dynamic certificates instead of a static secret, so that way it's time-boxed, and the static secret (private key) never actually leaves the vault.
Comment · 3 months ago
Not directly related to openbao, but I've thought about this for awhile that I'd like to use ssh certificates instead of ssh keys to allow an agent a time limited SSH access to a server, and that seems to work for gating the initial connection, but I haven't yet figured out how to enforce the established connection dies after a certain time. I could maybe hand roll a solution with ExposeAuthInfo and ForceCommand wrapper, but it feels like this sort of thing should be handled delicately..
Comment · 4 months ago
Yes, I don't really touch the PVE server at all after the initial install. I just build and deploy from my Fedora workstation running nix.
Comment · 4 months ago
This is what I've built [1], and I'm using it daily for things like agent sandboxing when I deploy it builds a new image completely replaces the OS disk - on upgrade it only keeps its data drive mounted to /var.
Comment · 4 months ago
NixOS has transformed my use of Proxmox. I configure, build, and deploy everything from my nix workstation. I don't need to use the PVE gui at all. Proxmox is just a target, and I've abstracted things enough to where I can deploy the same machines to libvirt on a local machine too. Why would I need to let my agent into my PVE box? I haven't looked at incus, but if I wanted to run the full stack declaratively, nixos and LLMs are so powerful now that I would probably just say to run libvirt and ZFS on nixos natively.
Comment · 4 months ago
I'm happy to see this, and I have lots of thoughts about this. Building declarative services on Nix is a far superior way of distributing Linux to VMs than most any other way I've tried. I am working [1] on very similar things, but I've been leaning more on the self-hosted path, my VM template targets libvirt and Proxmox VE with a single CLI api. I even have an experimental branch that targets DigitalOcean. For VMs especially, I want my OS to be immutable. My VMs should contain no state other than my application state. Upgrades should be a full image replacement and reboot.
So in my template, I have created the VMs with two disks: first one is for NixOS and is built from an image, and it is read-only. The second is mounted to /var and is used for all system configuration as well as application state. If I have multiple VMs, they can all share the same base image (thin provisioned). That's the mode that I want for my deployments of services, immutable and as stateless as possible. For agent use, its different, you actually want a mutable NixOS root so that the agent can do what it wants.
I built three modes: immutable, semi-mutable, and mutable. mutable removes the read-only lock on the root, and just lets you manage the VM as a pet. semi-mutable adds an ephemeral overlayfs that gets wiped the next time you upgrade the base image. So that gives you kind of the best of both worlds: an immutable read-only base image and the ability to "nix profile add" whatever you (or your agent) wants, but with the contract that these imperatively installed things will disappear the next time you upgrade. Are you planning on adding a LICENSE to your machine0-nixos repo?
Comment · 5 months ago
I am learning Clojure this week, and my test project is a calculator / unit convertor [1]. I wanted it to run in the CLI and on the web, so it targets several hosted platforms: Babashka / JVM / ClojureScript. It's a single code base written in cross platform .cljc files. I already have about 250 tests written for the abstract calculator API, run as a test matrix across platforms, so the project is already in a good place for testing a new runtime.
I just learned about basilisp from the parent comment, so I asked Claude to add Python support to the same .cljc files I have, and we finished the port in about 30mins, and then fixed Python specific test cases for another 30 mins, but now all of the existing tests are passing. That's impressive in several ways.
Portability is achieved by testing. You have to put the platforms you want to support into your test harness, and the earlier the better. A calculator is purely functional, so this is a fairly straight forward port and really easy to test for. I'm not sure about larger projects, but it seems like there is something seriously right about Clojure's design that makes this easy to do.
Comment · 5 months ago
That may have been the dumbest line in the article, the oils in question, are made out of seeds.
Comment · 5 months ago
Yes. The registrar is for the root domain. You provide your own DNS. DNS can do wildcards for any root domain its delegated.
Comment · 7 months ago
Sent from my Ipad
Comment · 7 months ago
Same. Here's how I scratch the NixOS itch on Proxmox and/or libvirt[1]. One interface for both targets.
Comment · 7 months ago
Yes, that solves it completely. But the exercise we were trying to do was to do it without that.
Comment · 7 months ago
> Many home routers try to preserve the source port in external mappings. This is a property called “equal delta mapping” – it won’t work on all routers but for our algorithm we’re sacrificing coverage for simplicity.
It is precisely this point that has flummoxed me when connecting my p2p wireguard config[1] with a friend that uses a pfsense router, no matter what we tried, pfsense always chooses a random source port.
But in the simple case this blog outlines, if both ends use the same source port, this method punches through 2 firewalls effortlessly:
Comment · 8 months ago
Use APIs for building things (and preparing for things to be built upon). Production.
Use CLI for exploration, coding, and learning. Greenfield.
In general, Declarative > Imperative.