Add renovate bot (self-hosted or not) or a similar not to your nixos repository to automatically update your lock file. Enable automatic system rebuilds (not live, nixos-rebuild boot…) to keep in sync with the repo.

Include multiple nixos systems in one repo, then reuse configuration or even make them reference each other (if you want that)

Find an issue to report upstream (or even add a pull request)

Fully automate your reinstall using disko and nixos-anywhere (don’t forget luks)

Be happy (optional)

Go over everything you’ve written in your repo so far, realise it’s formatted wrong and spend 2 hours fixing it until it no longer works

Build a derivation for something that doesn’t exist (also add a pull request if applicable and you’ve got time to maintain it)

Add a little nixpkgs-unstable, as a treat (use overlays)

Backups

Build a server so convoluted, kubernetes is easier to manage (I am here)

Huh? You don’t like strong copyleft licences?

Wait you are enjoying NixOS? I though we were all in for the suffering?

I have a Server with ~16 podman services, each their own user, network namespace and uids. This is managed using NixOS and Home manager (which supports quadlets) but I am changing my setup to a single node k3s cluster with user namespaces because that seems simpler to manage. Here a snippet for how the subuids/subuids are defined:

users.users.<username> = {
        subUidRanges = [{
            startUid = 100000+65536*( config.users.users.<username>.uid - 999);
            count = 65536;
        }];
        subGidRanges = [{
            startGid = 100000+65536*( config.users.users.<username>.uid - 999);
            count = 65536;
        }];
        home = "[...]";
        isNormalUser = true;
        linger = true;
        group = "users";
        openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys;
    };

Just found a recording of the last meeting he attended: https://youtu.be/I08EpZU8z8M

Now is the time to move fast and break things, do it!

How are you running podman? As a rootful systemd service or as a rootless user systemd services?

If you have an openwrt compatible router then you can use that as the tang server.

Also you can tell clevis to use both tpm and tang and require both to work.

So when the bubble pops they’ll just stop selling while the other sellers continue?

Yeah I don’t think so, unless all sellers “lock in” their prices for 5 years it isn’t happening and they’re just saying this to get more companies to buy at high prices. If all of them do “lock in” their prices then this will probably be the second time the memory cartel is fined.

You sure it wasn’t cat?

I know you can use a root shell with cat image.ISO > /dev/[...] for disk images/ISO in disk image Format (so most ISO that aren’t Windows) but using the cp command would be news for me.

Yeah Microsoft Canonical is too quick to go all-in on new things to the depriment of the OS.

Straight to jail

If you delete a still opened file on Linux then the file will disappear for all processes which didn’t already open it, all programs that did already open it can still read and write to it and the file on disk will never be overwritten (as in, used for other files) as long as there’s still a process with the file open.

Simplifying how it works: The file you see is a link to the actual file(inode), when a program opens a file using this link they get a copy of the link. As long as one link/copy of it still exist the file won’t be deleted. When a program closes all its links get cleaned up so on shutdown all files which only have processes referring to them get marked as deleted.

I use bitwarden send, all my devices already have access to my password database and i can save and download files or text though it. You can also use the URL to let other devices access it if you want.

Maybe try an atomic distro? It’ll still break but you can roll back and deal with it later.

Small correction:

Like, copyfail and dirtyfrag would punch through containers, but also punch through SELinux.

User namespaces and optionally limited capabilities severely limit the usefulness of both of these exploits. K8s containers with user namespaces or rootless podman prevent host-root and only allow elevating to container root (host uid != 0) and cross container cache pollution (jump to other containers that use the same base image?)

Real chads use sudont

It’s an addon that you enable/install inside Technitium, you only need to configure it in the Admin ui.

I used dawarich but switched to geopulse because dawarich broke too often on updates. I only rarely use it but it works well enough.

So now you have three options that you can compare, good luck?

https://xkcd.com/1200/