Writing
Notes from running the stack this service is built on. Same rule as everything else here: a claim is worth publishing when you can go and check it.
Three months, four NixOS hosts, 1,221 commits, and a CI pipeline that did not exist in August — plus the week the commit log changed hands for good.
Fitting a 27B model on one 24GB card is two arithmetic unknowns - weight memory at your quantisation and KV cache at your context - and a curve, not a number.
Assign a visitor to a variant from a rotating HMAC key, count the outcome server-side, and hold no persistent identifier — plus what that makes unanswerable.
A validator tests one message it received. A check on your own receiving host tests your real signing path and records the selector your mail system stamped.
An unauthenticated form endpoint is an abuse vector and a measurement failure at once: every probe looks like a genuine submission in your own metrics.
If the credential that unwraps your backup lives inside it, a total host loss leaves an archive nobody can open. Escrow the identity, then test the restore.
Blocking crawlers by User-Agent stops only the crawlers that identify themselves. The durable control is verified source ranges, pinned by hash.
A filtering resolver has no test mode: your test query is answered by real policy, and often by an exemption that hides the policy from you.
Signing a zone your own resolvers answer converts a soft failure into a hard one: a validating resolver returns SERVFAIL, and the name dies everywhere at once.
On NixOS a config change edits a file, not a running process. Without restartTriggers the deploy is green and the old configuration stays resident in memory.
VictoriaLogs keeps every line it is given, so a retrying agent or a restart loop doubles your history — de-duplication is the caller's job, not the store's.
CPUWeight and IOWeight are shares of contention, not ceilings: a weight of 10 beside 100 gets a tenth of whatever is contended, and nothing when idle.
An endpoint measures the path it traverses. Run the test on the host you are measuring and the number is dominated by loopback and CPU, not by the network.
HTB scheduling decides from queue state, not from an accounting problem. That is how peers get fair shares of a link while no per-peer usage record is kept.
Ciphertext in git, plaintext at activation. The sops store protects the repository, so the leak this fleet actually had was a running system quoted into a log.
Auto-merge decides 'the change was correct earlier', not now. If the base moves, what lands is a merge result no job evaluated — and a conflict can drop a gate.
A masked value and a truncated read are renditions, not files. An edit built from one writes the rendition in: a placeholder, or a silent drop past the cutoff.
A token scoped to one repo answers 404 for another, the same as for a repo that does not exist. How a cross-repo step exits zero and changes nothing at all.
One job per runner daemon: a job that holds its slot while waiting on work that needs a slot deadlocks the queue - and the symptom is a hang, not a failure.
One merge can produce more than one workflow run for one commit, and they queue instead of cancelling - so the latest green run may not have touched the host.
A green PR check describes the merge base it ran against, not the current main: Forgejo does not re-run PR workflows when the base branch advances.
Scope derived from a git diff must fail closed: a shallow checkout makes the diff fail, and reading that failure as no changes deploys nothing at all.
An untested rollback does not fail loudly: a denied sudo reads as empty output, the script finds no previous generation, and the host stays broken.
A secrets-only merge can produce no workflow run at all: the paths filter decides whether a run exists, the scope job decides which hosts it reaches.
A green deploy can leave a host on an old generation: scope comes from a single commit's diff, and an empty scope skips every deploy job while the run still reports success.
The three VPN tiers differ in exactly one thing — who resolves your DNS, and what that resolver can see. What each tier actually changes, and what it costs you.
Every provider publishes a trust page nobody can check. Ours is generated at build time from artifacts the hosts sign themselves — and the build refuses to render numbers no host put its key behind.
Same branch, same gates, two different triggers. The pipeline that builds these pages, and the day a pull request was allowed to overwrite what main had already verified.
A no-log policy is only meaningful when the exceptions are named. What this service records, what it does not, how each part is tested — and the four things a tunnel cannot protect you from.
The site's icons are private-use code points no system font maps. They are served from our own origin, subsetted to the glyphs actually in use, and a build gate fails if that ever stops being true.
30 posts. Every one is filed under a category and carries tags; each category and each tag has its own archive page, so a single subject is one hop away from here. The feed is Atom, at /feed.xml — no third-party reader, no tracking pixel, no newsletter you did not ask for.