Engineering notes from ymrtech
Notes from running the stack this service is built on. Same rule as everything else here: a claim is worth publishing when you can go and check it.
Three months, four NixOS hosts, 1,221 commits, and a CI pipeline that did not exist in August — plus the week the commit log changed hands for good.
Fitting a 27B model on one 24GB card is two arithmetic unknowns - weight memory at your quantisation and KV cache at your context - and a curve, not a number.
Assign a visitor to a variant from a rotating HMAC key, count the outcome server-side, and hold no persistent identifier — plus what that makes unanswerable.
A validator tests one message it received. A check on your own receiving host tests your real signing path and records the selector your mail system stamped.
An unauthenticated form endpoint is an abuse vector and a measurement failure at once: every probe looks like a genuine submission in your own metrics.
If the credential that unwraps your backup lives inside it, a total host loss leaves an archive nobody can open. Escrow the identity, then test the restore.
Blocking crawlers by User-Agent stops only the crawlers that identify themselves. The durable control is verified source ranges, pinned by hash.
A filtering resolver has no test mode: your test query is answered by real policy, and often by an exemption that hides the policy from you.
Signing a zone your own resolvers answer converts a soft failure into a hard one: a resolver returns SERVFAIL, and the name dies everywhere at once.
On NixOS a config change edits a file, not a running process. Without restartTriggers the deploy is green and the old configuration stays resident in memory.
VictoriaLogs keeps every line it is given, so a retrying agent or a restart loop doubles your history — de-duplication is the caller's job, not the store's.
CPUWeight and IOWeight are shares of contention, not ceilings: a weight of 10 beside 100 gets a tenth of whatever is contended, and nothing when idle.
An endpoint measures the path it traverses. Run the test on the host you are measuring and the number is dominated by loopback and CPU, not by the network.
HTB scheduling decides from queue state, not from an accounting problem. That is how peers get fair shares of a link while no per-peer usage record is kept.
Ciphertext in git, plaintext at activation. The sops store protects the repository, so the leak this fleet had was a running system quoted into a log.
Auto-merge decides the change was correct earlier, not now. If the base moves, what lands is a merge result no job evaluated, and a conflict can drop a gate.
A masked value and a truncated read are renditions, not files. An edit built from one writes the rendition in: a placeholder, or a drop past the cutoff.
A token scoped to one repo answers 404 for another, the same as for a repo that does not exist. How a cross-repo step exits zero and changes nothing at all.
One job per runner daemon: a job that holds its slot while waiting on work that needs a slot deadlocks the queue - and the symptom is a hang, not a failure.
One merge can produce more than one workflow run for one commit, and they queue instead of cancelling - so the latest green run may not have touched the host.
A green PR check describes the merge base it ran against, not the current main: Forgejo does not re-run PR workflows when the base branch advances.
Scope derived from a git diff must fail closed: a shallow checkout makes the diff fail, and reading that failure as no changes deploys nothing at all.
An untested rollback does not fail loudly: a denied sudo reads as empty output, the script finds no previous generation, and the host stays broken.
A secrets-only merge can produce no workflow run at all: the paths filter decides whether a run exists, the scope job decides which hosts it reaches.
A green deploy can leave a host on an old generation: scope comes from one commit's diff, and an empty scope skips every deploy job while the run passes.
The three VPN tiers differ in one thing: who resolves your DNS, and what that resolver can see. What each tier changes, and what it costs you.
Every provider publishes a trust page nobody can check. Ours is generated at build time from artifacts the hosts sign themselves, not from vendor claims.
Same branch, same gates, two triggers. The pipeline that builds these pages, and the day a pull request was allowed to overwrite what main had verified.
A no-log policy means nothing unless its exceptions are named: what this service records, what it does not, how it is tested, and what a tunnel cannot cover.
Our icons are private-use code points no system font maps: served from our origin, subset to the glyphs in use, and a build gate fails if that stops.
30 posts. Every one is filed under a category and carries tags; each category and each tag has its own archive page, so a single subject is one hop away from here. The feed is Atom, at /feed.xml — no third-party reader, no tracking pixel, no newsletter you did not ask for.