zrail

It's not really custom. It's industry standard protocols for connecting independent (one might say "autonomous") networks.

Tailscale is this on easy mode, of course. There's a blog post by apenwarr somewhere that I can't find right now that lays out the fundamental thesis of Tailscale and its very similar to these folks' manifesto.

I have never used KeepassXC so I looked it up. It seems like it solves a very different use case than what I need:

* shared vault with my spouse's user in our organization account

* multiplatform with sync

* most importantly, available without any of the hardware that I manage being in a usable state

KeepassXC doesn't solve for any of those as far as I can tell.

1Password is amazing for this, IMO. My spouse and I have been using 1Password together for more than a decade. One of the first things I set up is a "AAA Read Me First" note with links to a bunch of other notes and documents, including our estate planning stuff.

The biggest thing that makes me stick with 1Password, despite the semi-recent VC shenanigans, is the fact that if for some reason we fall behind on billing (for example, because the credit card got cancelled because I died) the account goes into read only mode forever. As long as 1P is a going concern the data we choose to put there is safe from the biggest risk in our threat model.

I have ingress set up with Fly.io.

Simple caching nginx config on the remote end with a Fly Wireguard peer set up as an extra container in the appropriate ingress pod.

It's not free but it's the least expensive way I can find to get anycast ingress and not expose any ports to the internet from my homelab.

Separation of services is orthogonal to separation of concerns. There's nothing stopping you from having multiple entry points into the same monolith. I.e. web servers run `puma` and workers run `sidekiq` but both are running the same codebase. This is, in fact, the way that every production Rails app that I've worked with is structured in terms of services.

Concerns (in the broad sense, not ActiveSupport::Concern) can be separated any number of ways. The important part is delineating and formalizing the boundaries between them. For example, a worker running in Puma might instantiate and call three or four or a dozen different service objects all within different engines to accomplish what it needs, but all of that runs in the same Sidekiq thread.

Inserting HTTP or gRPC requests between layers might enforce clean logical boundaries but often what you end up with is a distributed ball of mud that is harder to reason about than a single codebase.

Portland, Oregon completed a project in 2011 that successfully eliminated almost all of the combined sewer overflows into the Willamette river and Columbia Slough (a swampy area on the south side of the Columbia river near the airport).

There was a ton of work done to reduce the amount of water ending up in the sewer during storms followed by some large infrastructure improvements to improve the carrying capacity of the sewer itself.

https://www.portland.gov/bes/about-big-pipe

I was referring to the pod running the kubectl loop. As far as I can tell (I could be wrong! I haven't experimented yet) the script is relying on the primary Mosquitto pod's ready state, which is also what a Service relies on by default.

Yeah I see that now. Ugh.

To preface, I'm not a Kubernetes or Mosquitto expert by any means.

I'm confused about one point. A k8s Service sends traffic to pods matching the selector that are in "Ready" state, so wouldn't you accomplish HA without the pseudocontroller by just putting both pods in the Service? The Mosquitto bridge mechanism is bi-directional so you're already getting data re-sync no matter where a client writes.

edit: I'm also curious if you could use a headless service and use an init container on the secondary to set up the bridge to the primary by selecting the IP that isn't it's own.

BSL is a source-available license that by default forbids production use. After a certain period after the date of any particular release, not to exceed four years, that release automatically converts to an open source license, typically the Apache license.

Projects can add additional license grants to the base BSL. EMQX, for example, adds a grant for commercial production use of single-node installations, as well as production use for non-commercial applications.

Sigh that's annoying.

Edit: it's not a paywall. It's the standard BSL with a 4 year Apache revert. I personally have zero issue with this.

You don't even need a dedicated GPU. Any Intel Core-series CPU past 5th gen has a built-in quicksync engine that can handle many simultaneous transcodes.

PostgreSQL defaults (last I looked, it's been a few years) are/were set up for spinning storage and very little memory. They absolutely work for tiny things like what self-hosting usually implies, but for production workloads tuning the db parameters to match your hardware is essential.

You said "especially if you whisper" which I read as a level of speaking, primarily because I have experienced difficulty with Whisper while whispering :)

Home Assistant uses the Wyoming protocol to talk to Whisper, Piper, and the various other components of the speech pipeline. Might be something to check out?

https://github.com/rhasspy/wyoming

This subproject looks interesting too

https://github.com/rhasspy/wyoming-handle-external

Eh, Whisper is pretty good, especially if you have some GPU to throw at it.

Maybe not if all you're doing is hooking some nodes together. That said, I have personally used these Tailscale features that with a quick glance I don't see Meshnet having:

- ephemeral nodes are super useful for things like attaching a GitHub action runner or a fly.io instance to your tailnet

- Tailscale's ACL system has a ton of capabilities

- getting corporate buy-in is possible, vs trying to get a business to buy into Nord meshnet for actual workloads

I have worked at a place with serious opsec and none of that was allowed. Everything pointed at private mirrors containing vetted packages. Very few people had the permissions to write to those repos.

fs.com will custom build direct bury OS2 assemblies for reasonable prices. I'm a happy customer thrice over.

https://www.fs.com/products/70220.html?now_cid=1148

Also maybe a random cigarette butt once in a while.

It is incredibly foolish to entertain this offer. OPM v Richmond[1] held that the government has effectively zero liability for lying about financial benefits that haven't been specifically authorized by Congress.

[1]: https://supreme.justia.com/cases/federal/us/496/414/

> An extremely fast Python package and project manager, written in Rust.

https://github.com/astral-sh/uv

HN isn't even in the conversation.

In a sane world. This particular person has been impeached and acquitted twice over, though, so I'm not sure we're there anymore.

I don't have a 12 year old (yet) but my 8 year old has mood swings when they're too cold, too hot, have a headache, the tv remote doesn't work, their tablet runs out of time, their tablet runs out of battery, when they're hungry, thirsty, and/or tired (the preceding is non-inclusive, sometimes they have a mood swing for no perceptible reason).

Kids are people. People have feelings.

I wonder how Mr. Johnson is proposing to do his enforcement, seeing as how the executive is the branch of government charged with enforcing the laws.

The Open Home Foundation (Home Assistant, ESPHome, etc) is a similar contemporary example. It's organized as a Stiftung in Switzerland, which as I understand it is somewhat analogous to a US 501(c)(3) private foundation, in so far as it is an independent legal entity that can't solicit donations directly from the public and isn't necessarily run democratically like an e.V.

There are non-profit associations in the US (notably 501(c)(6) business leagues) but I don't know enough about them or about e.V. to speak about the differences.

Eh, not really. You can set them up in LAN mode and pair them with the slicer. You lose access to the mobile app, of course, and you also lose automatic firmware updates.

I had mine set up in local mode for awhile but the mobile app is useful for people in my life that don't care about learning how to work a slicer, so we use cloud mode.

As a consumer and homeowner I try my hardest to buy "smart" things that only have local control, especially for important systems like power and HVAC. Our standby generator has a manufacturer supplied wifi pod that I never set up. Instead I use an RS485-to-USB dongle and monitor it myself with open source software. Our HVAC is the same to the greatest extent possible. When shopping for a new robot vacuum Valetudo[1] compatibility is an overriding concern.

If/when we have solar installed it will not be connected to the manufacturer or distributor's cloud systems.

[1]: https://valetudo.cloud

I recently heard the double entry system described as the lowest common denominator of all accounting systems. I.e. one can model any other accounting system with just accounts, debits, and credits.

The color annotation system here is interesting but could be easily modeled with just accounts. In fact in some implementations that I've personally built, that's exactly what we did. Accounts were bags of attributes, including currency and color.

Not to say the system as described is deficient in any way, just that it isn't any different than a plain ledger except as a notation. I'll be interested to see the follow up articles about "transmuting".