Zero of the bullshit.

Photo: Panthers Images

_Huge breakthrough:_ I’ve finally discovered how to get my database passwords out of plaintext .env files and into an actual password manager. The industry way of doing this is to use a key management system (KMS), and then have an orchestration system inject sensitive values into a machine’s environment variables. This is handy as the sensitive data never has to hit the disk. **You can do this same thing with 1Password** , with fewer moving parts, which is ideal for someone like me who runs a few hobby services. The steps for getting these values into a Docker container are: 1. Create a new 1Password Vault. I called mine ‘Basement Credentials’, as it’ll hold the passwords that my ‘Basement’ machine will need to hold onto. 2. Create a new 1Password Service Account and give it read access to only our new vault. 3. Install 1Password CLI. 4. Set `OP_SERVICE_ACCOUNT_TOKEN` on the user who is going to be running the docker container. Usually you’d do this with a ~/.bashrc change. (See: ‘Robbing Peter to pay Paul’ below.) 5. Create a new Secure Note in the new Vault, and name it after the application hosted in Basement. Like, Forgejo. 6. For each secret bit of data in your application that’s hanging around in your .env file, create a new field: ‘Add more’ on the 1Password Secure Note window. Choose ‘Password’, though this doesn’t matter. Name the new field after the env var, if you can. 7. Update your .env file with placeholders for 1Password to update. # .env RAILS_ENV=production SECRET_KEY_BASE="op://Basement Credentials/Forgejo/SECRET_KEY_BASE" 8. Update your docker-compose.yaml to read envs from environment variables. You likely want both `environment:` and `env_file`. (See ‘Disappointing complexity’ below.) web: image: forgejo:latest environment: SECRET_KEY_BASE="${SECRET_KEY_BASE}" [... etc, but not RAILS_ENV, which will be loaded via .env] env_file: .env 9. Load `docker compose` via `op run`. op run --env-file=.env -- docker compose up And then you’re good to go. No secret details held on disk anywhere. They can’t be accidentally committed, and you can commit your .env file, which was a key requirement for me. The way this works is that `op run` creates a shell session with those env vars available. Docker-compose will then interpolate those via the `${FOOBAR}` syntax used in the docker-compose.yaml. I’m reasonably happy with this solution for the moment. ## Disappointing complexity I’m saddened by the need to add both `environment:` and `env_file:` attributes. This works because of a (documented and intended) quirk of docker compose where `environment` takes precedence and is merged on top of whatever is in env_file. This means we can still put non-secret values in .env for configuration (where I’m used to looking) without polluting the yaml file too much with a huge list. I wish it were enough for `op run` to process the .env file and figure out what I want, but that isn’t the case: the .env file that `docker compose` sees is still the one that’s on disk (the file on disk has not changed). So, it ends up seeing it with the 1Password placeholder strings. ## Robbing Peter to pay Paul That’s a very good point you’ve made: this whole thing hasn’t changed the security concerns if someone gains access to the server. The secrets aren’t on disk any more, but that 1Password vault key is right in that .bashrc and it can output the lot. This isn’t the problem being solved. Every security system will have this issue. The aim here is to move the secrets out of the app configuration folders so the whole lot can be safely committed to git. That Git repo is distributed to many systems, including CI, whenever I update the configuration. They don’t all need to know the password for Basement. _Well, you shouldn’t be committing .env files anyway._ There are two reasons this is very good advice for almost every other project. First, because they usually have secrets in them. Mine no longer does. Second, because .env files are for configuration and other machines will need different values, so why commit this? It’s like committing your VSCode config: we don’t want to mess up another dev’s machine. However, this particular repo is _entirely_ configuration for this one server. The application itself is in another repo, following this ‘do not commit .env’ rule.

I’ve been migrating repos from Github to my privately hosted Foregjo server. One of the recent moves was this very blog. It also meant I could rip out `github-pages` which pinned me to some gems. Now I feel fully in control of this blog. I wanted to make it look less Jekyll-default-theme, but I think web sites generally look terrible. So I’ve stuck with the theme but changed the fonts. This was exciting! However, the fonts took ages to load. 322 KB of them. Pages look very odd when the font is jumping around so I used `font-display: optional`, which says “use this fancy font if it’s available immediately”. After “immediately”, the font will not swap to the requested one (even if it’s downloaded now). The next time you load the page, the font will be in memory, and will display fine. This lead to a mish-mash of fonts though. I discovered that a library, Subfont, can work well with Jekyll. It looks at the built, static website and checks which characters you need. Then, it resets your font files with just the characters you need. If you don’t use the letter ‘d’ in your website, that’s not added to the font. More likely, it’s the euro symbol, or something. That’s reduced the fonts sizes hugely. Font | Original TTF | Subset WOFF2 | Reduction ---|---|---|--- Special Elite regular | 147.5 KiB | 34.6 KiB | 76.5% Lekton regular | 74.5 KiB | 11.1 KiB | 85.1% Lekton bold | 74.1 KiB | 10.2 KiB | 86.3% Lekton italic | 26.4 KiB | 4.3 KiB | 83.6% **Total** | **322.5 KiB** | **60.2 KiB** | **81.3%** So now I’ve switched to `font-display: swap`, which will trigger a font-flicker as it’s loaded, but it’s so small I’m hoping it downloads before the first paint. ## Lekton-Medium The regular version of Lekton is a little too lightweight for me. I got GPT to make it bulkier for me (but not as bulky as bold), and I think it did an alright job so far. You can download this version of the font: Lekton Medium and its license is here. Though, of course, it has nothing to do with the work of the original author, so don’t blame them if it’s super janky.

The latest news, sport and weather for the East Midlands.

Sometimes I kvetch about how boring I find fantasy pantheons that are just Greek gods with a bad coat of paint. Sometimes I've blogged about it. --- _Guys do you want to hear about my setting's unique pantheon? My god Warfrith is the god of both war AND peace isn't that interesting?_ The next time you sit down to start writing a list of 10 gods and 1 evil god, stop. Don't do that. Do this instead. Think about your RPG friends that aren't in your immediate campaigns. Maybe they live out of state. Maybe they work third shift. Select 3-6 of them. These are your setting's **gods**. There might be other gods elsewhere in your world, but these are the local ones that form the basis of the major religion(s). (**Prerequisite** : You must have 3-6 RPG friends. If you don't have any, come join the His Majesty the Worm Discord.) Think about something you know about them. What is their job? What are their hobbies? What is their user name and pfp? These are the gods' **spheres of influence**. Take the letters of their name and rearrange them, spell it like Jolly Old England, or write some fantasy gibberish with similar phonetic tones. These are the **gods' names**. Look at your campaign map. Put temples, fanes, and wild altars to these gods everywhere. A city has one god as a patron: put their main temple there. Put a desecrated altar to one of your gods in a dungeon (the players can cleanse it). Put a Pantheon - a Temple to All Gods - on a high mountain or remote island. When your players encounter a temple to a god, they may make an offering and petition the god through prayer. Write these down. After your game session, text your friend. Tell them what the player offered them and what they prayed for. Ask them what they think would happen. Take their suggestions and action them in your world. You don't have to tell the players that their prayers were answered. Perhaps they'll never connect the prayer to what happened on account of your friend's advice. But gods work in mysterious ways like that. #

Last Friday I found myself standing at my computer and staring at it, realising that I have no idea what I should be working on with my precious free time. So I decided to make this unordered list as a bit of a focusing menu of choice. Many of these I know how to resolve, I just need to actually do it. **1. Resolve issues with images not loading correctly when loaded via Misfed.** I have some thoughts I’d like to write down on vibe-coding and how I’m surprised that the AI revolution hasn’t led to literally everyone making their own apps for which they are the only expected user. I’ve made an RSS reader that I don’t intend anyone else to ever use, just throwing instructions for features at ChatGPT and it’s gone quite well. Is the code good? It can’t possibly be. Does it matter? Not really. Are there likely massive security concerns? Likely - have fun inside its non-root container. And again, I’m the only user of it. Anyway, some websites don’t have RSS feeds, like a certain sports league who I’ve recently become interested in, and so I had ChatGPT make a scraper for it, which converts it into an RSS feed, and then I can use it with my feed reader. Downside is that the images it returns (which it downloads to ActiveStorage rather than hotlinking) are all output with URLs like `http://localhost/storage/dds8fu3r.png` and that hostname is useless. I don’t want this service to be public (another piece of software I expect to be the only user of) so it shouldn’t have a public hostname. I need to do some docker network-fu and then figure out what the src of the img tag should be for the RSS reader to download the image too. **2. Tollport needs a way to archive keys.** Tollport is a piece of software I wrote by hand (why!) during my sabbatical and one I’m still quite pleased with. I realised there’s no way to remove a personal access token once you’ve created it. There needs to be an ‘archive key’ button. **3. In the RSS reader, “Themes” need more work to make “Topics” useful.** I’m using BERTopic to generate and assign topics to feed entries. There are some problems: the topics are incredibly niche. I need a layer to group topics together, which I’m calling Themes. Additionally, right now, if I retrain a new model (which I desperately need to do following some data quality fixes) then the old topics go away. I’d rather link the old topic to a similar new topic - again, leading to a grouping like Themes. **4. Enable Action workflows on every application.** I spent an afternoon really enjoying getting Action pipelines working on my self-hosted forgejo instance. Very pleased! But in my eagerness to get it working for my RSS reader, I built images and configuration that only really work for that one project. The set up should have been Forgejo-wide but was RSS-reader-wide. This needs fixing, and will unblock me moving off of GitHub. **5. Add Mastodon discovery tools to RSS feed reader.** If a friend on Mastodon toots about a blog post, that can be used as a signal to boost importance of an entry. It can also find more feeds that way too, suggesting which to follow. **6. Linking authors in the RSS feed reader needs an improved UI.** My reader lets users Subscribe to Feeds. The software tries to make webrings too: this blog talks about this blog a lot, you should follow that one. The way it does that is by crawling links in entries in Subscriptions and looking for more RSS feeds. When it does that, it creates new Feeds and new Authors. The current Authors UI links every damn author - thousands of them - rather than just the ones the user is subscribed to, which feels smarter. **7. Identify placeholder or legit author names and make an effort to display the correct name.** Often the author in a feed will be “invalid@example.com (chrissy banks)”. As a human, I can see that it should probably be ‘chrissy banks’. The system should take a stab at identifying NotNames and guessing at a BetterName. **8. Publicly accessible homepage for basement.wales.** I recently acquired basement.wales for my basement server. I point it at my tailscale IP addresses. I have an idea of something fun to put on the public homepage though: a roguelike which behaves like a dashboard. A room where you can listen to radio.shane.computer or a library where you can look through blog posts. I’m excited about the idea of a room where you can see through the window and see that the indicators are all green, but you need a passkey to get into the room where you can read the Grafana details. (Only I would have the passkey.) **9. Factorypi should recover gracefully when it starts dropping frames.** I have The Matrix running on a loop in my studio. After some time, it starts dropping a frame. I have code that should detect this has happened and refresh the page (which fixes it immediately), but that’s not working for some reason. My guess: the setTimeout I have that keeps track of progress is running every 5 milliseconds rather than every 5 seconds. **10. SSL cert management needs automating.** That basement.wales set up means that certbot can’t access the server to confirm the SSL cert, so I had to do it manually (with TXT records). I need a way of automating that. **11. dotfiles need to be per machine.** My dotfiles were an idealistic dream of a world where one config set would work on Mac OS and Ubuntu and Debian and Raspbian, but that was a folly. A pipe dream. Instead, I should have branches per environment. **12. Resolve 1Password ssh-agent and git signing.** Same as above, maybe. In my dotfiles, I have Host * IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock" which obviously doesn’t work on any other machine than the first one. **13. Forgejo configuration is in the mounted volume. It should be version controlled.** I need to split out the important files so I can see what broke when things start failing. **14. Forgejo still refers to basement:222 when it should say git.basement.wales.** There must be a second config for what it displays in the ‘copy SSH command’ box. **15. Take another look at envs in 1Password.** I need to rethink how I have passwords in my version controlled configuration for each website. I think 1Password have a solution where you start your server with `op run` and it injects the secret envs from 1Password into the container, never needing for them to be on disk. I need to think about what security I’m trying to keep though. If someone has access to that server to see the .env files, that’s the ball game, so who really cares.

Our writer spent weeks putting capsules, sheets and liquid detergent through their paces to find the best for your clothes and the planet

A new logic puzzle game. Use number clues to plant sunflowers around your logical garden. Unlimited free puzzles across 6 different difficulty levels.

Follow along with our change log to stay in the know about upcoming and recent updates that affect your team.

Expect a more formal announcement at Gen Con.

Today I headed home from EMF Camp 2026. This was my third time I didn't realise it at the time, attending EMF Camp for the first time To people who are experiencing EMF for the first time, I want to

A timeline of progress in a Factorio world, played with a proximity voice chat mod that I made

For some reason, @DosFox decided he didn't want his HP ThinkJet I dismantled the printer and attempted to fix the flex PCB by applying So, I'm here to fix that. You can find the KiCAD source, gerbers,