Salta al contenuto principale





OneXSugar: Playing with the first dual-screen transforming handheld


Nintendo Switch meets Nintendo DS in a handheld with the power to play both.





Hydrogen power ignites low-altitude economy



in reply to crankyrebel

Hadn't done any from this series yet. Might have to give it a go. Or the crossovers.


Identité, droit de vote, nature : quatre batailles, quatre Oui


C’est dans la chaleur du 20 juillet 2025 que l’Assemblée générale du Parti HTTPS‑VD (ex‑PPVD) s’est réunie dans la bonne humeur pour préparer la votation du 28 septembre. Nous avons échangé sur les objets soumis au vote : identité électronique, écologie,

C’est dans la chaleur du 20 juillet 2025 que l’Assemblée générale du Parti HTTPS‑VD (ex‑PPVD) s’est réunie dans la bonne humeur pour préparer la votation du 28 septembre. Nous avons échangé sur les objets soumis au vote : identité électronique, écologie, mode d’élection et participation citoyenne.

Certains sujets ont beaucoup fait parler d’eux dans les médias et suscité des réactions très émotionnelles dans tous les camps politiques. D’autres, au contraire, ont laissé les partis silencieux et semblent ne pas éveiller l’intérêt du public.

Pourtant, ces thèmes sont cruciaux pour l’évolution de notre société — et particulièrement importants pour nos membres. Les débats du jour ont été riches et engagés.

Alors à vous de jouer ! Lisez notre synthèse, échangez autour de vous, et n’oubliez pas de voter le 28 septembre.

e-ID : paranoïa ou progrès ? HTTPS choisit le code et la clarté

Le texte de la loi sur l’identité électronique (LeID) a déjà été longuement analysé par notre formation, (consultable sur https-vd.ch/2024/09/30/le-id-s…), les conditions attendues d’un service d’identité numérique ayant été largement discutées dans nos publications passées. La loi proposée crée un cadre légal clair sur un usage numérique qui existera de toute manière dans l’avenir proche, que ce cadre soit prêt ou non. Aucune législation sur le sujet ne saurait être parfaite, mais cette proposition de la loi fournit le minimum nécessaire pour faire avancer la situation dans une direction souhaitable, grâce à des garanties efficaces. Là où l’opposition à la LeID a décidé de succomber aux sirènes de la paranoïa, nous avons souhaité garder notre sang froid et regardé non seulement le contenu réel de la loi et de son ordonnance d’application, mais également le projet déposé sur github.

Contrairement à ce que prétendent les arguments du comité référendaire, la LeID ne crée pas une identification universelle. Les prestataires utilisant le système d’identification auront accès uniquement aux informations qui seront nécessaires à l’utilisation de leurs services les autres informations ne serons pas transmisent. L’accès à ces informations sera en outre conditionné à une demande dûement argumentée auprès des autorités compétentes et les données collectées ne pourraient pas être conservées au-delà de 90 jours. A cela s’ajoute le fait que tout service qui aurait perdu des données ou qui aurait compromis des accès serait immédiatement soumis à un audit, dont les manquements constatés seraient rendus publics, afin d’augmenter la transparence du système dans son ensemble.

A cela s’ajoute une possibilité à toute personne utilisant le service d’identification d’effectuer un signalement aux autorités si une mauvaise gestion de l’outil ou un comportement suspect est constaté, ce qui lancerait une procédure d’enquête.

Les garanties sont fortes et la transparence effective, ce qui répond à nos attentes.

Seule ombre constatée au tableau, la facilité à passer outre l’obligation de garder le code du système ouvert. Malheureusement ce point pourtant essentiel n’est jamais relevé par les opposants à la loi.

Pour résumer, cet e-id 2.0 apporte un cadre clair, des garanties suffisantes et le premier projet d’application est prometteur.

HTTPS-VD recommande donc vivement de voter OUI à la Loi fédérale du 20 décembre 2024 sur l’identité électronique et d’autres moyens de preuves électroniques (Loi sur l’e-ID, LeID) afin que la Suisse dispose d’un cadre légal adapté.

Le Mormont : un site pillé, une initiative solide, un contre-projet recyclable

HTTPS partage le souci des initiants quant à la conservation du patrimoine naturel du Mormont. Il s’est ainsi prononcé en faveur de celle-ci. Elle intègre la protection du Mormont lui-même et précise les exigences en matières de gestion des ressources naturelles et de l’énergie sur l’ensemble du territoire vaudois. Depuis de trop nombreuses années, l’industrie du ciment a exploité ce site sans aucune considération pour l’environnement et la durabilité ; il est aujourd’hui temps de protéger cet endroit.

Le contre-projet, bien que se focalisant principalement sur un autre problème que le Mormont, intégrerait à la Constitution un élément très important : l’économie circulaire. Cet article est très réjouissant et mériterait de faire l’objet d’une votation séparée afin de pouvoir exister en parallèle du texte de l’initiative, car il vise plus large que la situation épineuse du Mormont seul.

HTTPS vous recommande donc de voter OUI à l’initiative populaire « Pour une sauvegarde du patrimoine naturel et des ressources dite «Initiative Sauvons le Mormont» » et son contre-projet et de donner la priorité à l’initiative., car une fois que la situation du Mormont aura été réglée, il sera toujours temps d’intégrer les principes de l’économie circulaire à la Constitution.

Petites listes, grands effets : un quorum qui a besoin d’air

La modification propose de regrouper les listes apparentées avant le calcul du quorum. Cette modification permettrait une représentation plus juste des petites formations politiques, au détriment des grandes formation, qui bénéficie aujourd’hui d’un regroupement qui fait disparaître les petites formations et brouille le choix des électeurs par des jeux de politique politicienne. Les ententes communales pourraient donc se séparer en de plus petites formation affichant clairement leur étiquette. Cela générerait un léger surplus de travail aux administrations communales, mais d’une ampleur très faible par rapport à ce qui est annoncé par les opposants à la modification.

Ainsi, des listes de niche, locales, engagées, souvent éphémères mais légitimes auront la possibilité d’exister. Cela redonnerait du sens au vote, au lieu de pousser l’électeur·ice à cocher la case « moindre mal » pour ne pas « gâcher sa voix ».

Le 28 septembre, HTTPS-VD ne protégera pas les places assises. Nous devons ouvrir la voie et voter Oui à la modification de l’article 93 al.4 de la Constitution du canton de Vaud visant à préciser le champ d’application du quorum dans le cadre des élections communales et cantonales, OUI à plus de diversité, plus de débat, moins de calculs tactiques. Bref : OUI à une démocratie qui respire.

5 ans pour voter : vivre ici, c’est déjà en faire partie

Actuellement, en tant qu’étranger, pour voter au niveau communal, il faut avoir vécu 10 ans en Suisse, dont 3 sur le territoire vaudois. C’est long, très long. Surtout pour celles et ceux qui travaillent, participent, consomment et paient leurs impôts dans le canton de Vaud, mais restent assignés au silence.

La réforme propose de passer la durée de résidence en Suisse à 5 ans. Ceci est cohérent dans la mesure où cinq années correspondent à la durée un cycle électoral complet (communal, cantonal et fédéral). C’est aussi largement assez pour comprendre comment fonctionne la politique au niveau local — et savoir comment on veut y prendre part.

À une époque où beaucoup se désolidarisent des lieux où ils vivent, où l’ancrage local devient rare, encourager la participation et l’engagement est plus qu’un symbole : c’est une urgence démocratique.

Dans une Suisse où mobilité, morcellement administratif et précarité territoriale sont la norme, cette extension des droits politiques est une mise à jour bienvenue. Il ne s’agit pas d’un passe-droit, mais d’un rattrapage démocratique.

HTTPS-VD ne voit pas l’intérêt de mettre la démocratie sous clé pour une longue décennie. Nous devons l’ouvrir à celles et ceux qui ont leur vie ici depuis suffisamment longtemps. Pour cela il faut voter OUI à la modification de l’article 142 de la Constitution du canton de Vaud visant à faciliter l’accès aux droits politiques communaux pour les étrangères et étrangers. Parce qu’attendre 10 ans pour avoir voix au chapitre, c’est long pour une société qui prétend avancer.

Conclusion

Le 28 septembre, HTTPS-VD recommande de voter quatre fois OUI, pour une démocratie plus ouverte, plus représentative et mieux équipée face aux défis contemporains.

Sur la loi sur l’e-ID, nous saluons un cadre légal qui va enfin dans la bonne direction. « L’e-ID n’est pas un outil de contrôle, c’est un outil de confiance — à condition d’être encadré. Et ce cadre, la loi le fournit. Ce texte n’est pas parfait, mais il est suffisant pour avancer. » rappelle Sébastien Piguet, co-président de HTTPS-VD. Quant à la réduction du délai de résidence à 5 ans pour accéder aux droits politiques communaux, c’est un pas nécessaire vers une démocratie plus inclusive. « Il ne suffit pas de promettre la participation : il faut la permettre. Ouvrir la démocratie à celles et ceux qui y contribuent déjà, ce n’est pas une faveur, c’est une reconnaissance. » insiste Nils Schaetti, co-président de HTTPS-VD. Des objets discrets, des enjeux essentiels. Le 28 septembre, nous pourrons dire Oui à une démocratie qui s’ouvre à toutes et tous.

Sources




Older Gens Living 'The Good Life'


I am sure the way this world is going, there will be no one to attend to us, curled up in a corner, covered in our own shit. Now I am hungry for tacos.
in reply to crankyrebel

I have a hard time understanding why anyone would want to reach an age where they can't even wipe their own ass.
in reply to crankyrebel

I’ll never understand the ‘Mexican food gives you diarrhea’ bit. And if it does, there’s probably something wrong with you.


Interview with Senior DevOps engineer 2025






la megafine ruvida (la pazzia autopulizia)


Sembra proprio che, ormai, io non possa avere più un minimo di pace nemmeno con me stessa!!! È greve forse, ma veramente sono al punto in cui impazzisco malino se per più di qualche decina di minuti non riesco a tenere il mio spirito dissociato dal corpo, quindi palle. Prima, infatti, mi stavo semplicemente facendo […]

octospacc.altervista.org/2025/…


la megafine ruvida (la pazzia autopulizia)


Sembra proprio che, ormai, io non possa avere più un minimo di pace nemmeno con me stessa!!! È greve forse, ma veramente sono al punto in cui impazzisco malino se per più di qualche decina di minuti non riesco a tenere il mio spirito dissociato dal corpo, quindi palle.

Prima, infatti, mi stavo semplicemente facendo la doccia — come purtroppo circa ogni settimana gli spiriti delle mie pareti mi supplicano di fare, visto che sono costretti a vivere con me — e, via via che mi lavavo, mi sentivo sempre più sporca, in qualche modo. Oh, più andavo avanti e più impazzivo, perché più mi strofinavo e mi sciacquavo e più percepivo la pelle ancora ruvida, consumata, imperfetta, brutta, troppo umana e poco adatta a me; impossibile trovare pace. Ho dovuto usare più bagnoschiuma del solito (…e non che di solito io ne usi tanto, ma vabbè) e strofinare con la spugna semiruvida per qualche paio di minuti buoni, altrimenti veramente mi sarebbe esplosa la testa, è irreale. Forse in parte l’impressione di imperfezione sarà causata da quei peli stronzi delle gambe, in posizioni scomode che difficilmente riesco a togliere, perché sono talmente magra che il rasoio non aderisce bene… però giuro, se mi tocco addosso sono ruvida. Sul petto sono ruvida, sulla schiena sono ruvida, sulla fronte già mi si iniziano a formare le rughe; quindi, qualcuno converrà con me che l’aspettativa dell’esito della doccia completa non si avvicina per niente a quella che è la realtà… ok, i capelli tornano a profumare, ma per il resto non cambia una mazza e sento veramente di volermi spellareo quantomeno di poter fare la muta come le tarantole. E invece no, devo rimanere in questo mio stato estremamente triste, e sentire tutti i miei nanobozzoli ogni volta che per qualsiasi motivo mi metto le mani addosso. 😫
motosega self care 🥰(…No, non so bene cosa volevo fare con questa immaginetta creata nel tentare di dare una foto a questo post, comunque, ma questo è come la mia esistenza mi fa sentire 🥰 Mi serve veramente una motosega per contrastare il mio prurito addosso!!!)



in reply to Davriellelouna

He wants AI to become strictly regulated so no one can catch up to his stagnating bullshit engine.


in reply to moe90

The founder of Brave browser got fired from Firefox because he was homophobic



in reply to Francois

The elder scrolls 3: Morrowind. Jokes on the game designer though doesn't matter how many main story npcs I killed because I have no idea which merchant I sold the shadow shield to.
Questa voce è stata modificata (1 mese fa)


Ferragosto in Jazz


15 agosto 2025 21:00:00 CEST - GMT+2 - Campo Antico Ricevimenti, 01028, Orte, Italia
Ago 15
Ferragosto in Jazz
Ven 21:00 - 23:00
Elisabetta Fratoni Jazz Quartet
Presso Campo Antico Ricevimenti, sulla via Amerina di Orte, l'Elisabetta Fratoni Jazz Quartet allieterà la serata di Ferragosto.
Questa voce è stata modificata (1 mese fa)
in reply to Elisabetta Fratoni Jazz Quartet

Pagina dell'evento: campoantico.it/ferragosto-sera…
in reply to Elisabetta Fratoni Jazz Quartet

Per chi volesse passare l'intera giornata di #Ferragosto in #Agriturismo qui c'è la pagina con l'offerta: campoantico.it/ferragosto/





Escobar Phone creator pleads guilty to scamming buyers, never delivered devices


Gustafsson was the CEO of Escobar Inc., a corporation registered in Puerto Rico that held successor-in-interest rights to the persona and legacy of Pablo Escobar, the deceased Colombian narco-terrorist and late head of the Medellín Cartel. Escobar Inc. used Pablo Escobar’s likeness and persona to market and sell purported consumer products to the public.

From July 2019 to November 2023, Gustafsson identified existing products in the marketplace that were being manufactured and sold to the public. He then used the Escobar persona to market and advertise similar and competing products purportedly being sold by Escobar Inc., advertising them at a price substantially lower than existing counterparts being sold by other companies.

Gustafsson then purportedly sold the products – including an Escobar Flamethrower, an Escobar Fold Phone, an Escobar Gold 11 Pro Phone, and Escobar Cash (marketed as a “physical cryptocurrency”) – to customers, receiving payments via PayPal, Stripe, Coinbase, among other payment processors, as well as bank and wire transfers.

Despite receiving customer payments, Gustafsson did not deliver the Escobar Inc. products to paying customers because the products did not exist.

In furtherance of the scheme, Gustafsson sent crudely made samples of the purported Escobar Inc. products to online technology reviewers and social media influencers to attempt to increase the public’s demand for them. For example, Gustafsson sent Samsung Galaxy Fold Phones wrapped in gold foil and disguised as Escobar Inc. phones to online technology reviewers to attempt to induce victims who watched the online reviews into buying the products that never would be delivered.

Also, rather than sending paying customers the actual products, Gustafsson mailed them a “Certificate of Ownership,” a book, or other Escobar Inc. promotional materials so there was a record of mailing from the company to the customer. When a paying customer attempted to obtain a refund when the product was never delivered, Gustafsson fraudulently referred the payment processor to the proof of mailing for the Certificate of Ownership or other material as proof that the product itself was shipped and that the customer had received it so the refund requests would be denied.

Gustafsson also caused bank accounts to be opened under his name and entities he controlled to be used as funnel accounts – bank accounts into which he deposited and withdrew proceeds derived from his criminal activities. The purpose was to conceal and disguise the nature, location, source, ownership, and control of the proceeds. The bank accounts were located in the United States, Sweden, and the United Arab Emirates.

Questa voce è stata modificata (1 mese fa)


Neox does NOT like DIRT!



in reply to Hard Is Easy

Re: Neox does NOT like DIRT!


This is a pretty huge oversight... it sounds like the first edition neox will need constant upkeep like a bike chain, etc!

Quite a departure from the typical "throw it in your bag" grigri.


in reply to crankyrebel

I'm worried they'll be doctored to shit, maybe they can't release doctored versions of them because someone with knowledge of the originals would call them out (if you're that person stay safe!), but when (and I mean when, they're waiting until they've gotten all the good people out of the way before they try lying) they're going to be full of nothing but their common targets and enemies.

Still though release the damn files, they were on your fucking desk and you gave to podcasters

in reply to Donjuanme

IT WAS ALL HILLARY CLINTON AND OBAMA! EPSTEIN AND GHISLAIN WERE FALL GUYS! BILL GATES FUNDED THE OPERATION!
in reply to IttihadChe

I’LL PROVE IT ONCE I’M CONFIDENT THE FBI HAS SCRUBBED EVERYTHING ABOUT ME AND MY FRIENDS FROM THE FILES!
in reply to kautau

Three weeks later

HERE ARE THE FILES IN THEIR COMPLETE AND UNALTERED FORM:

Link to an empty word doc that just says "If I go to jail I'll kill myself. I sure hate trump."



in reply to HonoraryMancunian

Lol, how has nobody posted this South Park link yet?

youtu.be/PN51L4iJLow

in reply to HonoraryMancunian

What's this? Another purity test? You're not doing enough and are, therefore, colluding with the oppressors?


Avatar 3: Fuoco e Cenere svela il suo primo poster e anticipa l'uscita del trailer


Avatar: Fuoco e Cenere ha condiviso il suo primo poster ufficiale, anticipando il debutto del suo trailer in arrivo in concomitanza con I Fantastici 4: Gli Inizi al cinema. Il franchise ideato da James Cameron continua ad espandersi e riporterà molto presto il pubblico affezionato su Pandora in compagnia di Na’vi coraggiosi. Dopo il primo Avatar nel 2009 e il sequel Avatar: La via dell’acqua distribuito nel 2022, Cameron riporterà Jake Sully e la sua famiglia di nuovo in azione con Avatar: Fuoco e Cenere. Terzo capitolo del franchise, ha anticipato la data d’uscita del suo primo trailer ufficiale.

Il film, invece, ha già da tempo fissato la sua data d’uscita per il 19 dicembre 2025.



Godot getting serious




Il Campo e la Trincea: La Memoria del Tenente Luigi Ferraris


il nome di Luigi Ferraris risuona potente nella memoria collettiva di Genova e non solo. A lui è intitolato (dal 1933, in occasione dei quarant’anni dalla fondazione del suo club) uno stadio storico, quello sito nel quartiere di Marassi, ove tuttora scendono in campo le due principali squadre del capoluogo ligure, Genoa e Sampdoria. Inoltre, egli è assurto a simbolo eloquente di un'intera generazione sacrificata sull'altare della Prima Guerra Mondiale


Ex-officer sentenced to 33 months in prison in Breonna Taylor case


Brett Hankison, a former Kentucky police officer who was convicted in the death of Breonna Taylor, a 26-year-old emergency medical technician, was sentenced on Monday to 33 months in prison.

Taylor was shot and killed on March 13, 2020, during a botched drug raid authorized by the Louisville Metro Police Department. A Louisville detective at the time, Hankison, 46, was found guilty last November of violating Taylor's civil rights while executing a search warrant on her home, which resulted in the tragedy.

Hankison will not report directly to prison, with U.S. District Judge Rebecca Grady Jennings saying during Monday's sentencing hearing that the Bureau of Prisons will decide when his sentence begins, according to The Associated Press. His prison sentence will be followed by three years of supervised probation.

#USA


I cant be the only one that sucks at playing against humans but am OK against bots???


basically, I have a lot of anxiety when playing with people, and my ranking is around 600ish, but whenever i play a bot the analysis suggests that i paid played at level 1100 or 1500.
in reply to 🍉 Albert 🍉

The moment you start playing for ELO instead of fun is the moment you should reconsider playing.

in reply to icegladiator

You would have better luck figuring out the chemical composition of the material then tracking all sales of said material. Still would be next to impossible but that's a more likely means of identifying someone than the printer itself.
in reply to icegladiator

Use a different print head, sections of print bed, or just entirely new print beds and you defeat this 'tracing'


How can I share/store sensitive data for family


I need to start making plans for when I am gone, much sooner than I thought, and I realized our finances are pretty opaque to my spouse. Our bank account is shared, but there are other sites that only I have access to.

The easiest solution would be to physically write down logins and what needs done, put it in an envelope, and tell my family where that envelope is. I'm not thrilled about that, because I would have to shred and rewrite it every time I update a password or a URL changes, and it'd be vulnerable to nosy guests.

Putting it in a shared Google Doc would be easiest for everyone. But then Google has that data. Even supposing I trust a cloud SaaS provider not to misuse the data (which is a big 'if') I do not trust them to never have a data breach.

Self-hosting seems like the next step, except I expect my home server to be the first thing to collapse once I'm gone. Filing login info with an estate attorney would still require frequent updates. Putting a document on a flash drive risks data loss, but is what I'm leaning towards.

Is there a solution I'm missing?

in reply to adhocfungus

I use Vaultwarden with two user accounts but with an "organization" that contains passwords that we both might need access to at some point. They then get updated at the same time the password is updated since it's where I store all passwords.
in reply to adhocfungus

I would use Keepass. You would have a single file, opened with a single password, that you could share with them however you want.

Wishing you the best

adhocfungus doesn't like this.




KI-Tool ver­steckt Inkompetenz


Ein Vibe-Coder schreibt ohne es zu mer­ken auf X, wie kaputt Vibe-Coding ist: Ein Sta­­ging-Sys­­tem greift direkt auf die Pro­duk­ti­ons­da­ten­bank zu. Kei­ne Ver­si­ons­kon­trol­le mit Git. Tests funk­tio­nie­ren laut den Posts nur auf dem Pro­duk­ti­ons­sys­tem. Und der Höhe­punkt: Ein KI-Tool warnt expli­zit „I can not be trus­ted, I will vio­la­te the rules“ und „hire human deve­lo­pers you can trust“ – trotz­dem ver­wen­det der Typ das Tool weiter.

Da hab ich schon Mei­nung zu.

jascha.wtf/ki-tool-versteckt-i…

#Claude #Inkompetenz #KITools #MonsterEnergy #Softwareentwicklung #VibeCoding

Questa voce è stata modificata (1 mese fa)


Quanto costa un funerale oggi in Italia?


Organizzare un funerale in Italia può costare da 1.800 a oltre 6.000 euro. Scopri cosa è obbligatorio, cosa no e quali aiuti economici esistono.
#News

in reply to Lyra

Purtroppo me l'hanno regalato, quindi l'autore è stato pagato e non posso fare resi

16.50€ per questa porcheria!

All'interno altre gemme "ai slop" come fette di banana con il picciolo, petti di pollo con ossa, forchette dai denti storti, ecc

Questa voce è stata modificata (1 mese fa)
in reply to Moonrise2473

puoi usarlo come ferma porte o come sottobicchiere 🙂

L’angolo del lettore reshared this.



in reply to sabreW4K3

But if you say that almost all adult Israelis are IDF militants, which is actually correct, everyone loses their mind.


Laura Santi è morta dopo aver avuto accesso al suicidio assistito, infine


Molto toccante anche la lettera lasciata da Laura Santi sul sito dell'associazione Luca Coscioni
#News

in reply to themachinestops

And Nintendo JP says that “Nintendo Switch and Nintendo Switch 2 cannot be remotely located, their users remotely identified nor disabled over the Internet” (tweet in Japanese warning people against accidentally losing or getting their consoles stolen over summer vacation)

twitter image

But I bet it is more like “Nintendo won’t disable them remotely even if people report ones stolen to them with serial numbers and police reports”, but they’ll happily do so if they caught you using the console in an unapproved manner in their eyes.

Questa voce è stata modificata (1 mese fa)
in reply to 1Fuji2Taka3Nasubi

This is by definition "we are just assholes"

Someone play for 5 minutes with a mig switch a legit dump of their own, legally purchased game, just for convenience, to have multiple games on the same cart? The console is now almost useless. You can't play any digital games that you purchased with real money, and physical games can't get any update. Game requires a 20gb day one patch to be playable? Though luck buddy, go to buy a new console!

They stole your console? Oh no! Yes, we absolutely could do the same, as it's bound to your Nintendo account and we could add a button "report as stolen and ban it from internet" in your profile. But we won't, go to buy a new console!

in reply to themachinestops

Guys hi, just looking for some support share, a Fantasy Adventure Story, for all ages and just some entertain with some storyes: - maybe you are curious (many was not very kind just for share a film), heartless with hatefull speach and respekt always


A Self-hosted, BSD-native Gemini Protocol Server Stack


For those who are adventurous enough to explore the non-http corners of the Internet, the Gemini protocol is a delightful experience to use. It has been around a number of years, making the biggest bang around the time when discontent with the web’s gener

For those who are adventurous enough to explore the non-http corners of the Internet, the Gemini protocol is a delightful experience to use. It has been around a number of years, making the biggest bang around the time when discontent with the web’s general demise started to reach current heights (so maybe around 2022).

My “capsule”, Vigilia, is self-hosted, and has been since its inception. It used to run on a disused Macbook Pro running Fedora Server, under our TV at home, but since then I have become much more confident in using OpenBSD. It used to run on a little Python CGI script I wrote, which also started to feel too bloated and complex, with too many bells and whistles that I frankly had no need for. It was time to make a change, so I replaced the old Macbook with a Raspberry Pi, and Fedora with OpenBSD, and then took my time to figure out a new “status quo”.

0. Philosophy


I wished to create a more Unix-minded stack. The more I have been using OpenBSD and Unix systems the more I have been sold on the “everything is a file” philosophy, as well as opting to use internal tools as much as possible rather than reinvent the wheel on my own. That is to say, I’d much rather work with simple scripts and shell commands than write complicated and buggy code.

So with that in mind, here’s the stack that I settled on after a some trial and error:

1. Hardware


I have absolutely no intention to expose our home IP address via DynDNS or similar. However, I like to be in control of my data as much as possible: ideally as little of my data should be hosted on “someone else’s computer”. If I can’t unplug the hard disk and put it in a drawer, I can’t guarantee it’s security from a hack.

So Vigilia is actually two servers. The server with the actual data is at home, in running on a Raspberry Pi 4B. But as a “public front” vigilia runs a reverse-proxying gemini server on a standard VPS over at OpenBSD.amsterdam.

2. Network setup


I will not go into the intricacies of the dual-wan setup in this post I have at home; but to keep things connected to each other I am using Tailscale to tie the servers together in a Virtual LAN. This is incredibly handy because they get to have easy to remember static IP addresses, all over an encrypted channel.

So here’s the rough idea:

  • Vigilia.cc’s DNS records resolve to the OpenBSD.Amsterdam VPS running gmid
  • VPS and home server both run tailscale
  • VPS reverse-proxies incoming gemini connections to home server


3. Gemini server config


Both the VPS and the local server run [url=https://gmid.omarpolo.com]gmid[/url]. It’s a fast and simple gemini server that mirrors OpenBSD’s httpd; which means it is very easy to configure, it is stable and secure. It can run in chrooted environments, and as its own user, so it’s just a Good Thing all over. Most importantly, it can relay and reverse-proxy TCP connections with sni fields intact, which is something for example OpenBSD’s relayd, built primarily for HTTP, does not do.

My gmid config files look something like this:
### REMOTE_SERVER:/etc/gmid.conf#user "_gmid" # running it as its own user to achieve privilege separationchroot "/var/gemini" # and in a chroot so it can't just access random bits of the file systemlog { syslog # log to /var/log/messages}vigilia_pem = "/etc/ssl/PUBLICKEY.pem"vigilia_key = "/etc/ssl/private/PRIVATEKEY.key"public_ip = "46.23.93.41" # OpenBSD Amsterdam VPS' public addresshomeserver = "100.REDACTED.REDACTED.101" # TailScale IP of the home machine public_port = "1965"homeserver_port = "2965"server "vigilia.cc" { listen on $public_ip port $public_port cert $vigilia_pem key $vigilia_key proxy { proxy-v1 # this directive enables some advanced features like forwarding IP Addresses of visitors verifyname off # I found I need to specify this somehow, maybe because of self-signed certs sni "vigilia.cc" relay-to $homeserver $homeserver_port }}
This above allows to listen for connections to vigilia.cc:1965 and forward them to HOME_SERVER:2965. So thus the homeserver has the following configuration:
### HOME_SERVER:/etc/gmid.conf#user "_gmid" chroot "/var/gemini" log { syslog }internal_address = "100.REDACTED.REDACTED.101" # TailScale IP of the home machine internal_port = "2965"# The below are the same certificates that are in use on the VPSvigilia_pem = "/etc/ssl/PUBLICKEY.pem"vigilia_key = "/etc/ssl/private/PRIVATEKEY.key"server "vigilia.cc" { listen on $internal_address port $internal_port proxy-v1 # add proxy-v1 support for relayed connections cert $vigilia_pem key $vigilia_key log on location "*" { auto index on # enables directory listing }}

4. Getting the files to the Server


Because I am lazy I want to edit files locally and I want them to magically appear on my capsule. So I am using [url=https://syncthing.net/]syncthing[/url] to copy things over automagically from DESKTOP:~/public_gemini to HOME_SERVER:/var/gemini.

Syncthing runs most reliably as my own user, I found. To do this it is best to follow the documentation for the Syncthing OpenBSD package — but basically it involves starting it via the user’s crontab with the “@reboot” directive. But as it runs as my own user, I need to set the permissions properly. HOME_SERVER:/var/gemini is owned by the _gmid user in the _gmid group so I also added MYUSER on both machines to the same _gmid group, and made sure MYUSER has write access:
#!/bin/sh# HOME_SERVERusermod -G _gmid MUYSERchown -r _gmid /var/geminichmod -r ug=rwx,o=r /var/gemini
Then I set up syncthing on HOME_SERVER. As it is running headless, I needed to access the web interface, which I achieved via SSH tunneling:
$ ssh -L 9999:localhost:8384 HOME_SERVER
This way I could open a browser on DESKTOP and access the server’s Syncthing settings.

So here are the settings:

On the DESKTOP:

  • Syncthing web interface -> Add folder
  • Folder path: ~/public_gemini
  • Folder label: Gemini files (or something)
  • Ignore patterns: “*.sock” (Unix sockets might confuse the poor thing)
  • Sharing: HOME_SERVER
  • Pause syncing for now

On HOME_SERVER:

  • Establish ssh tunnel to HOME_SERVER as described above
  • Open remote Syncthing webinterface on DESKTOP: localhost:9999
  • Accept the incoming share request for “Gemini files” from DESKTOP; but point it to /var/gemini
  • Folder path: /var/gemini
  • Folder label Gemini files
  • Advanced: UNTICK “Wach for changes” because OpenBSD doesn’t seem to allow Syncthing to poke around in /var with those various Go modules and you’d just get errors, like I did
  • Check the Ignore patterns — if it didn’t synchronise “*.sock” then specify it manually

On DESKTOP:

  • Unpause syncing

Now any file you write into DESKTOP:~/public_gemini will sync across to HOME_SERVER:/var/gemini. Yay!

6. Setting up automatic static site generation


Now if you are content to maintain your capsule manually, you are done. As I said I am lazy so I want my little “ssg” script, Lumen, to create index pages for each directory for me. Lumen, I promise, will be made available once I tidy it up.

Lumen basically lists all files recursively and generates an index.gmi for each directory. This means that Lumen has to be re-run each time the folder changes. OpenBSD is acquiring some degree of file watching natively.1 However [url=https://openports.pl/path/sysutils/entr]entr[/url] already exists in ports.

It took a bit of tweaking but basically here’s the command I ended up using, adapted from one of the examples provided in the entr manpage:
$ while sleep 0.1; do find /var/gemini/vigilia.cc/* | entr -nd python3 /var/gemini/cgi/lumen.py -d /var/gemini/vigilia.cc; done
What it does is, in a loop it recursively lists all files every 0.1 seconds in /var/gemini/vigilia.cc, and feeds the output to entr. Then entr runs with -n to specify a non-interactive session (in interactive sessions it also responds to e.g. keystrokes and tty changes – so to be safe, I don’t want that); and with -d to specify it should be looking for changes in the parent folder of any changing files. The looping and the -d directive were added because sometimes I ran into issues when a file got deleted: entr just quit because it could not find the removed file in a “stale” file list it was provided on launch. Lumen needs a -d argument as well to specifiy which directory it needs to work on.

7. System config


Because there are a few other servers like “auld.vigilia.cc” also running on the home machine (the configs for wich aren’t reproduced above for brevity’s sake) and because those rely on a number of CGI scripts I have to start them on launch. I ended up using supervisord for these. Supervisor is a cool little daemon for launching things. I could use rc but supervisord allows me to specify a few extra bits more easily, like redirecting output to syslog and other things.

So for HOME_SERVER, here is my supervisord configuration:
#### HOME_SERVER:/etc/supervisord.conf## [... snip ...][program:gmid]command=/usr/local/bin/gmid -f ; the program (relative uses PATH, can take args)process_name=%(program_name)s ; process_name expr (default %(program_name)s)directory=/var/gemini/ ; directory to cwd to before exec (def no cwd)priority=100 ; the relative start priority (default 999)autostart=true ; start at supervisord start (default: true)startretries=3 ; max # of serial start failures when starting (default 3)autorestart=true ; when to restart if exited after running (def: unexpected)killasgroup=true ; SIGKILL the UNIX process group (def false)stdout_syslog=true ; send stdout to syslog with process name (default false)stderr_syslog=true ; send stderr to syslog with process name (default false)[program:lumen-vigilia_cc]command=/bin/ksh -c 'while sleep 0.1; do find /var/gemini/vigilia.cc/* | entr -nd python3 /var/gemini/cgi/lumen.py -d /var/gemini/vigilia.cc; done'process_name=%(program_name)sdirectory=/var/gemini/priority=102autostart=truestartretries=3autorestart=trueuser=MYUSERNAMEstderr_syslog=truestdout_syslog=true
There are other directives that start the CGI scripts for “auld.vigilia.cc” in the config, omitted here.

Note that you can specify “priority” to control in what order you want the scripts to run. I first want the gemini server to run (100); then I want it to run the CGI scripts (101 — left out of the above example); then I want to run the static site generator’s watcher (102). Notice I am telling explicitly it to run /bin/ksh with a command specified in -c; this is because simply feeding it a complex command confuses supervisord, as I discovered.

One nice feature of supervisord is that it can redirect both stderr and stdout to syslog, so any commands and processes supervisord runs will have their output sent to /var/log/messages, neatly tagged and organised.

Conclusion


So there you have it — my Gemini stack from start to finish. It was a really fun experiment to start to use OpenBSD, instead of reinventing the wheel, or relying on some monolithic CGI scripts. You can do quite a lot with just system internals and a few packages.


  1. The watch utility was added to 7.7-current on 2025-05-19; it will make its way into 7.8 hopefully. ↩︎

Adapted from the original article “Vigilia’s New Gemini Stack” published via Gemini at vigilia.cc on 21 July 2025.



Trying Guix: A Nixer's Impressions


One aspect of Guix I found to be really fascinating: That there is basically no conceptual difference between defining a package as a private build script, and using a package as part of the system.

Let me explain: Say you wrote a little program in Python which uses a C library (or a Rust library with C ABI) which is in the distribution. Then, in Guix you would put that librarie's name and needed version into a manifest.scm file which lists your dependency, and makes it available if you run guix shell in that folder. It does not matter whether you run the full Guix System, or just use Guix as s package manager.

Now, if you want to install your little python program as part of your system, you'll write an install script or package definition, which is nothing else than a litle piece of Scheme code which contains the name of your program, your dependency, and the information needed to call python's build tool.

The point I am making is now that the only thing which is different between your local package and a distributed package in Guix is that distributed packages are package definitions hosted in public git repos, called 'channels'. So, if you put your package's source into a github or codeberg repo, and the package definition into another repo, you now have published a package which is a part of Guix (in your own channel). Anybody who wants to install and run your package just needs your channel's URL and the packages name. It is a fully decentral system.

In short, in Guix you have built-in something like Arch's AUR, just in a much more elegant and clean manner - and in a fully decentralized way.

Questa voce è stata modificata (1 mese fa)
in reply to HaraldvonBlauzahn

I had a go at using guix as a package manager on top of an existing distro (first an immutable fedora, which went terribly, then OpenSUSE). Gave up for a few reasons:

  • As mentioned in the article, guix pull is sloow.
  • Packages were very out of date, even Emacs. If I understand correctly, 30.1 was only added last month, despite having been available since February. I get that this isn't the longest wait, but for the piece of software you can expect most guix users to be running, it doesn't bode well.
  • The project I was interested in trying out (Gypsum) had a completely broken manifest. Seems like it worked on the dev's machine though, which made me concerned about how well guix profiles actually isolate Dev environments. This was probably an error on the dev's part, but I'd argue such errors should be hard to make by design.

All in all I love the idea of guix, but I think it needs a bigger community behind it. Of course I'm part of the problem by walking away, but 🤷

in reply to samc

  • As mentioned in the article, guix pull is sloow.


This one has beem discussed on several forums discussing the original blog post, like here or also here on lobste.rs

Part of the reason for slow pulls is that the GNU projects savannah server, which Guix was using so far, is not fast, especially with git repos. Luckily, this is already being improved because Guix is moving to codeberg.org, a FOSS nonprofit org which is hosted in Europe. So if one changes the configured server URL, it is faster. (On top of that interested people might use the opportunity to directly take influence, and donate to codeberg so that they can afford even better hardware 😉).

Questa voce è stata modificata (1 mese fa)



Fedora Must (Carefully) Embrace Flathub


in reply to typhoon

Fedora maintains its own Flatpak repo that competes with Flathub. This is about merging them.