InnerScientist

    
// abandon all hope ye who commit here
(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])

Edith: damit, Not the first to post this abomination

So, when is the first party cable going to be launched? The device only hast an adapter shipped with it, which won't help you connect to the PSU 12VHPWR.

And it burns, burns, burnsThe gpu of fireThe gpu of fire

Just after it's too late

I have rss feeds for my main service updates so I know what new features I have, the services mostly run in podman containers and update automatically each Monday. I also have daily backups (timed to run just before the update on monday) in case anything does break.

If it breaks I fix it depending on how much I want/need it, mostly it's a matter of half an hour to fix it and with my current NixOS/Podman system I haven't yet needed to fix anything this year so it breaks infrequently.

Also why are you using Kubernetes on a single host if you want minimal maintenance? XD

My recommendation is to switch to just managing containers, you should just be able to export the volumes out of kubernetes and import them as normal volumes, as long as they're mounted in the right place you keep your data and if it doesn't work just try again. Not like you need to destroy the current system to slowly replace it.

Edit: I also recommend to update and reboot frequently, this stops updates and unstable configurations from piling up.

But it's past me, I swear. Reckless acts of a younger man.

Yeah, it's crazy how much a person can change in 20 minutes.

Don't worry guys,i have a plan,

Humanity has left the game

And so, the problem wasn't the ai/llm, it was the person who said "looks good" without even looking at the generated code, and then the person who read that pull request and said, again without reading the code, "lgtm".

If you have good policies then it doesn't matter how many bad practice's are used, it still won't be merged.

The only overhead is that you have to read all the requests but if it's an internal project then telling everyone to read and understand their code shouldn't be the issue.

Now upscale it back to the original size using ai

One thing that makes a project good is knowing what it does, I've seen quite a few projects where they talk about all the features and technology and how to configure it but not a word about what it actually does, what problems it solves and so on.

I won't self host your program if you don't even tell me what it does, don't make me search and clue together large parts of the documentation just to find if I want it. A simple explanation is enough but somehow I've seen quite a few programs that don't have it.

Seems more like "stage drowning" to me.

Yeah it works great and is very secure but every time I create a new service it's a lot of copy paste boilerplate, maybe I'll put most of that into a nix function at some point but until then here's an example n8n config, as loaded from the main nixos file.

I wrote this last night for testing purposes and just added comments, the config works but n8n uses sqlite and probably needs some other stuff that I hadn't had a chance to use yet so keep that in mind.Podman support in home-manager is also really new and doesn't support pods (multiple containers, one loopback) and some other stuff yet, most of it can be compensated with the extraarguments but before this existed I used pure file definitions to write quadlet/systemd configs which was even more boilerplate but also mostly copypasta.

Gaze into the boilerplate

    
{ config, pkgs, lib, ... }:

{
    users.users.n8n = {
        # calculate sub{u,g}id using uid
        subUidRanges = [{
            startUid = 100000+65536*( config.users.users.n8n.uid - 999);
            count = 65536;
        }];
        subGidRanges = [{
            startGid = 100000+65536*( config.users.users.n8n.uid - 999);
            count = 65536;
        }];
        isNormalUser = true;
        linger = true; # start user services on system start, fist time start after `nixos-switch` still has to be done manually for some reason though
        openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys; # allows the ssh keys that can login as root to login as this user too
    };
    home-manager.users.n8n = { pkgs, ... }:
    let
        dir = config.users.users.n8n.home;
        data-dir = "${dir}/${config.users.users.n8n.name}-data"; # defines the path "/home/n8n/n8n-data" using evaluated home paths, could probably remove a lot of redundant n8n definitions....
    in
    {
        home.stateVersion = "24.11";
        systemd.user.tmpfiles.rules =
        let
            folders = [
                "${data-dir}"
                #"${data-dir}/data-volume-name-one" 
            ];
            formated_folders = map (folder: "d ${folder} - - - -") folders; # a function that takes a path string and formats it for systemd tmpfiles such that they get created as folders
        in formated_folders;

        services.podman = {
            enable = true;
            containers = {
                n8n-app = { # define a container, service name is "podman-n8n-app.service" in case you need to make multiple containers depend and run after each other
                    image = "docker.n8n.io/n8nio/n8n";
                    ports = [
                        "${config.local.users.users.n8n.listenIp}:${toString config.local.users.users.n8n.listenPort}:5678" # I'm using a self defined option to keep track of all ports and uids in a seperate file, these values just map to "127.0.0.1:30023:5678", a caddy does a reverse proxy there with the same option as the port.
                    ];
                    volumes = [
                        "${data-dir}:/home/node/.n8n" # the folder we created above
                    ];
                    userNS = "keep-id:uid=1000,gid=1000"; # n8n stores files as non-root inside the container so they end up as some high uid outside and the user which runs these containers can't read it because of that. This maps the user 1000 inside the container to the uid of the user that's running podman. Takes a lot of time to generate the podman image for a first run though so make sure systemd doesn't time out
                    environment = {
                        # MYHORSE = "amazing";
                    };
                    # there's also an environmentfile option for secret management, which works with sops if you set the owner of the secret/secret template
                    extraPodmanArgs = [
                        "--pull=newer" # always pull newer images when starting, I could make this declaritive but I haven't found a good way to automagically update the container hashes in my nix config at the push of a button.
                    ];
                 # few more options exist that I didn't need here
                };
            };
        };
    };
}

I use podman using home-manager configs, I could run the services natively but currently I have a user for each service that runs the podman containers. This way each service is securely isolated from each other and the rest of the system. Maybe if/when NixOS supports good selinux rules I'll switch back to running it native.

Hey now, you can also spend 20 pages of documentation and 10 pages of blogs/forums/github¹ and you can implement a whole nix module such that you only need to write a further 3 lines to activate the service.

1 Your brain can have a little source code, as a threat.

...No really, has anyone used this warranty and if so, what does it actually do? (And I mean strictly home users)

Maybe they don't officially offer support for those PCs?Not like they offer any actual support for home users anyways...

"We"? Who's "we"? There is no "we".

"I trust them as far as I can throw them""Bet"

InnerScientist

@ InnerScientist @lemmy.world

Posts

1
Comments

340
Joined

3 yr. ago

InnerScientist

Anyone Can Push Updates to the DOGE.gov Website

what debugging regex feels like

Handful of users claim new Nvidia GPUs are melting power cables again

Handful of users claim new Nvidia GPUs are melting power cables again

Frontier AI systems have surpassed the self-replicating red line.

Arm ends legal efforts to terminate Qualcomm’s license

How do you keep up?

Permanently Deleted

Y-10K

Watching the Generative AI Hype Bubble Deflate

Go in the van

What are the things that makes a selfhostable app/project good?

Grandpa

Rockguard

My thoughts on docker

My thoughts on docker

My thoughts on docker

Microsoft allows Windows 11 to be installed on older, unsupported hardware but specifically nixes official support — minimum requirements for full compatibility remain unchanged

Both sides income, like police

Permanently Deleted