You can do this but adding another remote i.e. ¹:

git remote set-url --add --push origin git@gitlab.com:hmajid2301/go-routinely.git

Make sure to add both repositories with this command

Then when you go git push it will push to all repositories.

You can double check with:

goroutinely on  fix/ci [$] via 🐹 v1.25.5 via ❄  impure (nix-shell-env)
❯ git remote show origin
Welcome to this knot!
* remote origin
  Fetch URL: git@git.haseebmajid.dev:majiy00.tngl.sh/go-routinely
  Push  URL: git@git.haseebmajid.dev:majiy00.tngl.sh/go-routinely
  Push  URL: git@gitlab.com:hmajid2301/go-routinely.git
  HEAD branch: main

Looking Back: 2025 Goals Review

My core aims were:

• Release a working version of Banter Bus by end of January
• Try to release say 20ish YouTube videos next year
• Look at making some money from my side projects

I successfully completed the first goal, though the other two took a back seat due to changing priorities. With regards to YouTube, I didn’t really find the motivation to make videos. I will likely have another crack at it this year, aiming at creating content with simpler editing which takes less effort.

Fun Metrics

• 📝 35 blog posts published
• 💻 1,208 commits across all projects
• 📚 7 books read (fantasy mostly!)
• 🎤 2 conference talks given

Projects

Banter Bus

Link: https://banterbus.games Repo: https://gitlab.com/hmajid2301/banterbus

I did manage to release the first version of Banter Bus at the end of January. It was unfortunately in a broken state. Multiplayer games are hard to test I found out, but it was a good learning experience nonetheless.

I came back to it in around September/October to help clear the backlog of tasks I had. Like graceful shutdown. Resuming games on startup and improving the UI. Whilst of course fixing game breaking bugs and a few dodgy SQL queries. I really enjoyed building this again, with HTMX and Go. It ended up being the basis for a conference talk I did at GoLabs later in the year as well.

It also became a nice little project to practice some terraform and kubernetes. I deployed it in my homelab, on a k3s (k8s) cluster leveraging fluxcd for a more automated gitops approach.

SaaS (Voxicle)

Video: https://www.youtube.com/watch?v=oM9UUdwlaWA

I tried to build a feedback collection called voxicle (micro-saas) in public, trying to give daily updates on bluesky. But eventually I found myself losing focus and interest. So I ended up not enjoying it, I may go back to it sometime.

The idea was to have a small business on the side to make a bit of income, using my side projects to generate some cash. But of course it’s easier said than done. However the code is all there and the skeleton to start another SaaS is there. So if I decide to start another one or carry on this one it should be easy enough.

Home Lab

I carried on working on my homelab. By the end of the year I’ve simplified it to a NAS, running TrueNAS and a single machine (Framework Desktop). Which acts as both my desktop and a homelab self hosting a number of services. The most useful being, authentik for auth, jellyfin as a media server and gitlab runners for CI/CD on GitLab.

I worked on creating a mostly declarative k3s cluster, where I could set it up with barely any manual commands. Such as having a postgres user created for terraform, which we could then use to create databases for services running the k3s cluster.

Overall I have a long list of services I want to look at self hosting and trying to see if I can use them vs other offerings. Such as replacing good reads with book lore.

I also added a JetKVM, so I can control my PC remotely if I need to in an emergency. I have it set to auto boot when it gets power. So it should always switch on in theory.

Current Setup:

• Framework Desktop
• TrueNAS
• Jet KVM

Career & Professional Growth

Career Change

I decided to change jobs after my current employer decided to do some major restructuring and decided it wasn’t really for me anymore. The time spent to get ready to interview and then interview, just seemed to take me out of routine. This career change was one of the major life events of 2025, and ultimately impacted my ability to focus on side projects like Voxicle.

Conference Talks

I did two conference talks last year

Observability Made Painless: Go, OTel & LGTM Stack

YouTube: https://www.youtube.com/watch?v=t3Xz-IrxNwk

Learning more about o11y and OTel has proven to be useful. At my job as well I have been able to see a few gaps and helped to improve the o11y. Especially around tracing and missing spans etc. I’m glad I researched this topic in more detail. Even ignoring the OTel part there is a lot of useful knowledge that is very transferable.

What I learnt building a web app with Go and HTMX

The video hasn’t been released yet on YouTube

But this talk like my other one was basically some learnings I had when building Banter Bus with HTMX and how others could get started building their own full stack app with HTMX and Go. Plus some other tools I used that I really liked such as sqlc.

Technical Exploration

Impermanence, TPM LUKs decryption and Secure Boot

Since I didn’t have any personal projects later in the year. I decided to spend my time playing around my Nix config (because I’m that cool). On my framework desktop, I finally managed to get impermanence setup. Such that any files I don’t specify to get persisted (or folders) are wiped on reboot. Forcing me to make more of my config declarative which can be a pain. But makes it much easier to setup a new machine.

I can do a mostly unattended install of my NixOS config, with only a few manual steps post install. Mostly around enabling secure boot. I also decided to setup LUKs with TPM decryption, which brings its own world of exploits, such as the PCR 15 not being checked, tricking the TPM. Or the cold boot attack. However, does mean I don’t have to type a password in twice.

Niri

I decided to try Niri in November after seeing a random YouTube Video. I decided to try it with noctalia-shell, which solved a bunch of my issues with running a tiling window manager and missing some of those quick access utilities I had on gnome. But Niri seems to work pretty well on my Ubuntu 24.04 machine. So I could easily use the same workflow at work and home.

I like the idea of being able to scroll horizontally, one random use case I started using was with Guild Wars 2, keeping the wiki open next to it, so I could look up random info I needed quickly.

Overall I am happy moving over to Niri from Hyprland and there wasn’t much of a learning curve. I just copied most of my keybindings over.

Personal Growth

Reading

After being inspired by someone I worked with, who had a massive book shelf with tons of fantasy books in their background whilst on conference calls. I decided to start reading again, when I use to commute pre covid I got about 60 odd mins of reading in a day. But I stopped, and barely read since. So I decided to watch a bunch of videos, get some recommendations and have created a massive backlog of mostly fantasy books I want to read.

This started in about in November and I managed to read almost 8 by the end of the year. I don’t expect to keep this pace, my reading pace normalized to a more sustainable rate towards the end of the year. At first I was finishing a book every 5 days or so.

Looking Forward: 2026 Goals

• Go back to making YouTube videos
  • Recreating my workflow in NixOS
• Do one conference talk this year
• Continue expanding my homelab with new self-hosted services
• Read at least 20 books throughout the year
• Find another couple of personal projects
• Play Banter Bus with people at work
  • Having the confidence to share it, that it won’t break

Conclusion

2025 was a year of significant change and growth. While I didn’t achieve all my initial goals, I shipped Banter Bus, changed jobs, gave two conference talks, and rediscovered my love for reading. I’ve learned that it’s okay for priorities to shift, and that sometimes the best progress comes from adapting to new circumstances rather than rigidly sticking to a plan. Here’s to making 2026 even better!

Since finishing the second round of development on my game/web app banter bus (currently not deployed anywhere since I took down my k8s cluster), I have been looking for something else to sink my teeth into.

I decided I was going to sell my custom-built PC and then use the money to get a Framework desktop. So I thought I might as well go with something simpler that would work just as well for development.

As part of this, I decided to finally tackle some of the tasks I wanted to complete with my Nix configuration. Mainly setting up impermanence, which means files we don’t persist will get deleted across reboots, forcing us to specify more of our machine in config/nix code. I haven’t done this yet with home-manager, but will at some point do that as well, though that will take much more effort and also be more dangerous.

Whilst doing this, I decided that I would also like to set up Secure Boot with Lanzaboote and LUKS but using TPM decryption, vs needing to type in a LUKS password then another password to login.

I set up my new device using nixos-anywhere, a great tool when you have a well-defined nix config to build from, which can build and install NixOS on a device if it can SSH to it. My favourite tool for installing NixOS whenever I need to (probably more often than I’d like to admit). Whilst this all worked great and eventually I managed to get my setup working, I am writing this blog post on my new Framework Desktop. I wondered if we could cut down the number of manual steps, originally inspired by ¹.

However, I hit some issues with all of the tools above playing nice. Mostly sops-nix with impermanence, getting the SSH keys on the machine so I could use my secrets. In this increasingly long blog post, I will show you how I got it set up. I won’t go into lots of detail about each specific tool. I will assume you are somewhat familiar with them. Each could have their own blog post (or maybe YouTube video; I should start creating videos again, I think).

I will show you the final config I managed, with minimal manual effort needed. This should work on any Framework device (especially the Secure Boot part).

Config

Now I’ll quickly show you how I have set up my Nix config for the various tools above. These configurations are interdependent: impermanence creates the persist structure, sops-nix needs persisted SSH keys for decryption, and Lanzaboote needs persisted signing keys for Secure Boot. Link to my config (at the point I published this article).

sops-nix

When we have secrets that we don’t want to keep in plaintext, we can use sops to encrypt the data with our age/SSH keys. Either host key for NixOS secrets or our age key for home-manager related secrets. For example, for defining the user’s password, which in our secrets.yaml file looks like user_password: ENC[AES256_GCM,data:wSbEwtgPzM1FLYAb3rMCXneXJr2xM4w4lydvwA+DDP1i4DNPKQvC7VUKe00wIp3rDhjLTept/WA8uIGEJsPaf30/iYc2txdDWVvjDL81UnXtIfFoXKsYWQ7vrftShMJckByMiD5uZoYkSA==,iv:0YpQ5RL5CSjfS6jfpZArore25jn42uW3IRr8xLK/798=,tag:oVyxq1uIsKfV/HQWum6LQA==,type:str]. But this can be decrypted by our Nix config and stored at /run/secrets (and other folders next to it).

This means when we do a nixos-anywhere install, we need to send it relevant SSH keys/age keys so that it can decrypt our secrets such that we can log in. Otherwise, there will be no secret and we won’t be able to log in to our machine.

In my hosts/framework/default.nix config I have:

{
  sops.secrets = {
    user_password = {
      sopsFile = ./secrets.yaml;
      neededForUsers = true;
    };
  };

  user.passwordSecretFile = config.sops.secrets.user_password.path;
}

And then when defining users, we can do something like this in modules/nixos/user/default.nix, where we can define the hash of the password above:

{
    users.mutableUsers = false;
    users.users.${cfg.name} = {
      hashedPasswordFile = cfg.passwordSecretFile;
    };
}

And finally my modules/nixos/security/sops/default.nix config:

I reference this file in the persist, which I’m not sure I need to do:

{
    sops = {
      age.sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
    };
}

Lanzaboote (Secure Boot)

We will use Lanzaboote so we can enable Secure Boot.

Secure Boot usually refers to a platform firmware capability to verify the boot components and ensure that only your own operating system is allowed to boot. - NixOS Wiki ²

Here are the relevant parts of my Nix config modules/nixos/system/boot/default.nix for Secure Boot. We want to persist the /etc/secureboot folder, which is where our signing keys will be auto-generated by Lanzaboote on our first boot. We also need to disable systemd-boot if we are using Lanzaboote.

The combination of auto-generate keys and auto-enroll means fewer manual steps we need to take post-install to enable Secure Boot. However, the first time I did this, I did set this up manually following the Lanzaboote getting started guide. Do whichever you prefer; it’s not like it’s many steps anyway.

{
  boot.lanzaboote = mkIf cfg.secureBoot {
    enable = true;
    pkiBundle = "/etc/secureboot";

    autoGenerateKeys.enable = true;
    autoEnrollKeys = {
      enable = true;
      autoReboot = true;
    };
  };

  boot.systemd-boot = {
      enable = false;
      configurationLimit = 20;
      editor = false;
  };

  environment.persistence = {
    "/persist" = {
      directories = [
        "/etc/secureboot"
      ];
    };
  };
}

Impermanence

My impermanence module is longish, so I won’t go into lots of details. But we use btrfs to be able to roll back to a clean state, then copy files we specify in our persist btrfs subvolume.

disko

I use disko with nixos-anywhere to be able to partition my disks without lots of manual commands. Here is my disko config. You can see the subvolumes we create for our btrfs setup, i.e., /persist for persisting files between reboots.

Here is where I define my LUKS settings as well, so that our data will be encrypted at rest (full-disk encryption).

PCR 15

Eventually, we will want to enroll TPM to decrypt LUKS so that it is decrypted automatically but will only work with our TPM chip soldered onto our motherboard. Part of this will be specifying the PCRs. I don’t know loads about how it works.

PCR, Platform Configuration Registers.

Platform Configuration Registers (PCR) allow binding of the encryption of secrets to specific software versions and system state via hashes, so that the enrolled key is only accessible (may be “unsealed”) if specific trusted software and/or configuration is used. - Arch Wiki

We check the previous registers before we give access to the data inside the TPM, i.e., our LUKS password stored inside the TPM. There is a really good post ³ about how TPM decryption might not be secure enough, though I don’t think we need to worry about PCR 9 ⁴ (due to checksums on initrd, from what I understand anyway).

I may do a longer post about how this all works when I learn more myself. But if we don’t check PCR 15, someone could just copy the metadata and pretend they have our disk, assuming they have physical access to our PC. The TPM is not checking the PCR 15 value, so therefore would just spit out our LUKS password, which they could then use on our original disk. Now, of course, this all depends on your threat model, but I thought it’d be fun to fix this issue, at least on my laptop.

So I copied the module. Until the expected option is configured, it won’t do anything; we won’t know this until the system has been built. So it’ll be one more manual step we need to take, but perhaps worth it to make my system more secure.

{
  security.nixicle.pcr-verification = {
    enable = true;
    # expectedPcr15 = "caf33e79c645b65849256238a11fa68ae197e5cb89730c463c1cdf1d9128376f";
  };
}

Steps

Now onto how I deploy NixOS onto a new system/device with all the above playing nice and reducing the number of manual steps we need to take. Normally, I had Claude create some scripts I can use with go-task, but for the sake of this blog post, we will do it step by step, i.e., normally I would do task install:secure. Where we could then follow the script using charm’s gum to make nice interactive scripts. This includes info like the username, IP to SSH onto.

Anyway, make sure the device can be SSH’d onto; usually you can just use a live media USB. I build my own with nixos-generators. But any live media should be fine; use NixOS if you don’t have anything set up. I do something like this: mkdir -p ~/.ssh && curl https://github.com/hmajid2301.keys > ~/.ssh/authorized_keys, so that I can SSH onto the live media. Also, take note of the IP address of the machine; you can find this by running ip addr.

For example, on my local network it might be 192.168.1.71.

Install

Enter our encryption password to a file:

MY_PASS=$(mktemp)
echo "YOUR_LUKS_PASSWORD" > $MY_PASS

Get SSH keys ready for copying onto the new machine; this is so that sops can decrypt the various secrets. Either you can copy the existing SSH keys and replace them after, or you can generate new ones and update your sops config and sops files with these new keys. The latter is the more secure option, but I went with the first one as I was feeling lazy (security through inconvenience is still security, right? Right?):

Note: If this is your first installation and you don’t have existing SSH keys at /persist/etc/ssh/, you can either generate temporary keys or skip this step and regenerate your secrets after installation with the new host keys that will be created.

SSH_KEYS=$(mktemp -d)
mkdir -p "$SSH_KEYS/persist/etc/ssh"

sudo cp /persist/etc/ssh/ssh_host_ed25519_key "$SSH_KEYS/persist/etc/ssh/"
sudo cp /persist/etc/ssh/ssh_host_ed25519_key.pub "$SSH_KEYS/persist/etc/ssh/"
sudo cp /persist/etc/ssh/ssh_host_rsa_key "$SSH_KEYS/persist/etc/ssh/" 2>/dev/null
sudo cp /persist/etc/ssh/ssh_host_rsa_key.pub "$SSH_KEYS/persist/etc/ssh/" 2>/dev/null

Update permissions on the SSH keys folder:

Note: This step is crucial for sops-nix to work with impermanence. If you skip this, you’ll need to re-encrypt your secrets with new host keys.

sudo chmod 600 "$SSH_KEYS/persist/etc/ssh"/ssh_host_*_key 2>/dev/null
sudo chown -R $(id -u):$(id -g) "$SSH_KEYS"

Then finally we can start the install process:

Note: Update the username@host as needed, nixos is the default user for the NixOS ISO.

nixos-anywhere \
--flake ".#framework" \
--disk-encryption-keys /tmp/disk-encryption.key "$MY_PASS" \
--extra-files "$SSH_KEYS" \
--build-on-remote \
"nixos@192.168.1.71"

Post Install

After the command is done, your PC will reboot. At this point, you can start to get it ready for Secure Boot if you want. For a Framework laptop to enable Secure Boot, first we need to erase the Secure Boot settings.

It may differ on your device:

Framework-specific: Enter Setup Mode

On Framework you can enter the setup mode like this:

    Select "Administer Secure Boot"
    Select "Erase all Secure Boot Settings"

When you are done, press F10 to save and exit.

Then enter your password for LUKS so it can decrypt your drive and boot like normal. You will see your PC reboot due to the auto-reboot we set above with Lanzaboote. That’s fine; it’s all very normal. If your computer starts speaking Latin or emitting smoke, that’s NOT normal. Please consult a priest or your local fire department.

On my Framework device, it then told me it’s going to enroll my keys, and I didn’t interrupt the process. Then I logged into my device and enabled TPM decryption:

Note: Replace /dev/nvme0n1p2 with your actual LUKS partition. Check your disko config to confirm the correct partition path.

# The --tpm2-pcrs=15:sha256=0000... uses all zeros as a placeholder that will be updated after first boot
sudo systemd-cryptenroll /dev/nvme0n1p2 \
    --wipe-slot=tpm2 \
    --tpm2-device=auto \
    --tpm2-pcrs=0+2+7 \
    --tpm2-pcrs=15:sha256=0000000000000000000000000000000000000000000000000000000000000000

Check and make sure it all looks normal; you should see files signed (except perhaps one old one):

❯ sudo -E sbctl verify
[sudo] password for haseeb:
Verifying file database and EFI images in /boot...
✓ /boot/EFI/BOOT/BOOTX64.EFI is signed
✓ /boot/EFI/Linux/nixos-generation-40-7ik2vgrngo25ml7c2wb43uy52pt7ahpovfrrxczp445y76u56dlq.efi is signed
✗ /boot/EFI/nixos/kernel-6.18.2-otn6nn3tkudhh5xpj5736u2q3h4kjzojd6fkg4rqzdf5l5c7gxuq.efi is not signed
✓ /boot/EFI/systemd/systemd-bootx64.efi is signed

# Verify Secure Boot is working
sudo bootctl status

Now we can enable Secure Boot; again, this may vary on your device.

On Framework you need to manually enable Secure Boot:

    Select "Administer Secure Boot"
    Enable "Enforce Secure Boot"

When you are done, press F10 to save and exit.

Finally, after logging in again, we can run the following to get the actual PCR 15 hash value:

❯ systemd-analyze pcrs 15 --json=short
[{"nr":15,"name":"system-identity","sha256":"0000000000000000000000000000000000000000000000000000000000000000"}]

Take the sha256 value from this output and update your config’s security.nixicle.pcr-verification.expectedPcr15 field with the actual hash, then run:

sudo nixos-rebuild switch --flake .#framework

Then, of course, go about setting up everything else. If you copied existing SSH keys during installation, you may want to rotate them for better security by generating new host keys and re-encrypting your sops secrets with the new keys.

That’s it! Hopefully, you found that useful! I appreciate it was very long-winded, but that’s how I was able to do a mostly unattended install with few manual steps after getting the process started. If you made it this far, you deserve a cookie 🍪 (or at least a functioning NixOS installation).

Appendix

I had to do a bunch of research whilst working on this; here are some useful links I used:

• A really interesting post about how you can break TPM encryption with Secure Boot: https://oddlama.org/blog/bypassing-disk-encryption-with-tpm2-unlock/#crude-implementation-of-pcr15-verification
• Lanzaboote getting started guide: https://github.com/nix-community/lanzaboote/blob/master/docs/getting-started/enable-secure-boot.md
• Idea for copying SSH keys: https://github.com/nix-community/nixos-anywhere/issues/604
• nixos-anywhere SSH keys copy: https://github.com/nix-community/nixos-anywhere/blob/main/docs/howtos/secrets.md#example-decrypting-an-openssh-host-key-with-pass
• Discourse post with same issue as mine: https://discourse.nixos.org/t/impermanence-sops-nix-nixos-anywhere-lead-to-missing-hashedpasswordfile-s/66472
• Another discourse post with a similar issue: https://discourse.nixos.org/t/nixos-anywhere-failing-to-deploy-secrets/68392

Well turns out it seems to be the way NixOS works with the firewall, you can read all the details here ¹. Where the poster explains it really well.

My understanding is the following:

This changes RPF (reverse path filtering) from “strict” to “loose” mode:

• Strict: Reply must go back out the exact same interface it came in on
• Loose: Reply can go out any interface, as long as there’s a valid route back to the source

Solution

But the fix is enabling this option: networking.firewall.checkReversePath = "loose";. Please make sure you understand exactly what you are doing when enabling this.

Sometimes the app store “App Lounge” gets stuck updating apps, my old solution was to delete the app and reinstall it but that can be a pain. Then I discovered a slightly better solution.

• Go to settings
• Apps & Notifications
• Find App Lounge
• Then go to Storage & cache
• Clear storage and “Delete app data”

You will need to log in again to the app, but the update process shouldn’t get stuck anymore hopefully.

[^1] https://community.e.foundation/t/applounge-updates-stuck/47296/11

[!WARNING] The pam_shim is POC code, so be careful with using it on your own machine. Use it at your own risk.

The problem

At work I have to use Ubuntu but I want to share my nix config between all my devices i.e. desktop and work laptop. On my home setup I have been using Niri with Noctalia shell (quickshell) on NixOS. Everything works fine I can use the Noctalia shell lock screen and can authenticate fine.

However when I tried to do that on my Ubuntu machine, it wouldn’t let me log back in after locking the screen. Remember everything is installed via Nix (home-manager).

PAM

PAM is Linux’s standard authentication framework. When you lock your screen and type your password, PAM handles the authentication logic. It’s called “pluggable” because system administrators can configure different authentication methods (passwords, fingerprints, smart cards) without modifying applications.

PAM & Nix

Nix packages are completely self-contained. When you install a package with Nix, it includes all its dependencies in /nix/store/. But this creates a problem with PAM:

NixOS

Application → /nix/store/xxx-linux-pam/lib/libpam.so.2
           → /nix/store/yyy-pam-modules/lib/security/pam_unix.so
           → /etc/pam.d/ (managed by NixOS)
           → Authenticate ✅

Ubuntu

Application → /nix/store/xxx-linux-pam/lib/libpam.so.2
           → /nix/store/yyy-pam-modules/lib/security/pam_unix.so (doesn't exist!)
           → /etc/pam.d/ (managed by Ubuntu, expects different paths)
           → Authentication FAILS ❌

So we are locked out “forever” until we reboot, obviously not great. I know I hit this issue before with Hyprland and hyprlock (or swaylock) and ended up installing them via apt and not Nix. But this time I wanted to avoid doing that. I came across this issue.

Solution

We can use pam_shim, which creates a translation layer we can use. Whilst not breaking Nix’s package isolation.

1. PAM Shim Library: pam-shim creates a wrapper library that intercepts PAM calls and redirects them to the host system’s PAM library (/lib/x86_64-linux-gnu/libpam.so.0 on Ubuntu)

2. Patching: The replacePam function uses patchelf to replace PAM library references in the QuickShell binary with the shim library

3. Runtime: When noctalia-shell’s lock screen tries to authenticate:

   • QuickShell calls PAM functions
   • Calls go through the shim library
   • Shim redirects to Ubuntu’s native PAM
   • Authentication works against Ubuntu’s PAM stack

QuickShell → pam_shim intercepts pam_authenticate()
        → fork() subprocess
        → exec /lib64/ld-linux-x86-64.so.2 (system dynamic linker)
        → loads /lib/x86_64-linux-gnu/libpam.so.0 (Ubuntu's native PAM)
        → reads /etc/pam.d/common-auth (Ubuntu's PAM config)
        → loads /lib/x86_64-linux-gnu/security/pam_unix.so (Ubuntu's PAM module)
        → checks /etc/shadow (system password database)
        → returns PAM_SUCCESS via IPC to pam_shim
        → pam_shim returns result to QuickShell
        → Authentication SUCCEEDS ✅

Fix

update flake.nix

# PAM shim for non-NixOS systems
# Using 'next' branch for full libpam.so.0 API coverage
pam-shim = {
  url = "github:Cu3PO42/pam_shim/next";
  inputs.nixpkgs.follows = "nixpkgs";
};

inputs.pam-shim.homeModules.default

In our non-NixOS system i.e. modules/roles/non-nixos.nix

# PAM authentication fix for non-NixOS
pamShim.enable = true;

And add this overlay for all quickshell packages (what Noctalia shell uses). This will also work with other quickshells like DankMaterialLinux.

# Override quickshell globally with PAM-shimmed version
nixpkgs.overlays = [
  (final: prev: {
    quickshell = config.lib.pamShim.replacePam prev.quickshell;
  })
];

Where you have your noctalia-shell Nix config defined, i.e. noctalia.nix.

# Noctalia shell with PAM shim for lock screen authentication
systemd.user.services.noctalia-shell = mkIf config.desktops.addons.noctalia.enable (
  let
    shimmedQuickshell = config.lib.pamShim.replacePam pkgs.quickshell;
  in
  {
    Service = {
      ExecStart = lib.mkForce "${pkgs.writeShellScript "noctalia-nixgl" ''
        export PATH="${pkgs.wlsunset}/bin:${pkgs.wl-clipboard}/bin:${pkgs.cliphist}/bin:${pkgs.coreutils}/bin:${pkgs.gnugrep}/bin:${pkgs.gnused}/bin:${pkgs.bash}/bin:/run/wrappers/bin:${config.home.profileDirectory}/bin:/usr/bin:/bin"
        exec ${config.lib.nixGL.wrap shimmedQuickshell}/bin/quickshell -p ${config.programs.noctalia-shell.package}/share/noctalia-shell
      ''}";
    };
  }
);

Appendix

• pam_shim Repository

The fix ended up being pretty simple ¹:

Nautilus > Preference > Show thumbnails.

Set it to "On this computer only" for only seeing thumbnails on your system, .

If u need it to do same for a remote server, select "All files"

Or since we are managing this via NixOS and want to do things declaratively we can do do the following in our Nix config ².

{
dconf.settings = {
  "org/gnome/nautilus/preferences" = {
    show-image-thumbnails = "always";
  };
};
}

That’s it, in your SMB share you should now be able to view thumbnails for all of your videos.

Background

I use Neovim (btw!) and Nix (btw btw!!!). I mean, half the reason to use these tools is to tell other people you use them, right? 😉 Otherwise, why would I go through the pain I experienced today? “What pain?” you ask. Good question!

A few weeks ago, I noticed that running tests in Neovim was failing with a no test found error. I’m using neotest and neotest-golang to run tests within Neovim.

Here’s a link to my config.

I’m also using the nightly build of Neovim, so getting the latest version isn’t great if you want stability. Things can break at any moment, like running tests. Anyway, today (November 1st), I had some free time and decided to spend most of the day fixing this issue. poświęcenie

Setup

I’m using NixOS (should I do another “btw” joke??? 🤔), so I want to manage all my dependencies with Nix. I’m also using NixCats, which allows me to configure Neovim with Lua but package it with Nix (it has a few other features I don’t really use, but others might).

One of the nice features of NixCats is that we can easily add Neovim plugins that aren’t in nixpkgs using our flake inputs:

plugins-neotest-golang = {
  url = "github:fredrikaverpil/neotest-golang";
  flake = false;
};

We just need to add plugins-x, and then we can reference it in our NixCats config like pkgs.neovimPlugins.neotest-golang. It’s tied to my flake, so I can just run nix flake update to update those Neovim plugins along with every other input. Then I upgrade my setup, as you might with apt upgrade, but with nh os switch or nh home switch.

Debugging 🐛

This setup means I can use the latest version of this plugin (v2.5.0 at the time of writing), but even upgrading to the latest version wasn’t enough. I probably shouldn’t have tied it to the main branch. 😅

I found this issue, which made me think I should try the latest version.

After a lot of (wasted) debugging, I finally read the migration guide. An amateur mistake, I know. 🤦

nvim-treesitter

It turns out I need to use nvim-treesitter, but the main branch, not the master branch, which is frozen and no longer under development. There’s an existing overlay we can use so we don’t have to change how we install our dependencies.

Like so:

nvim-treesitter-main = {
  url = "github:iofq/nvim-treesitter-main";
  inputs.nixpkgs.follows = "nixpkgs";
};

I’m also using snowfall-lib, so I can add a new overlay like so in my flake.nix:

overlays = with inputs; [
    # ...
    nvim-treesitter-main.overlays.default
];

I also created a new overlay file, overlays/nvim-treesitter-main/default.nix:

inputs: final: prev: {
  vimPlugins = prev.vimPlugins // {
    nvim-treesitter = prev.vimPlugins.nvim-treesitter.withAllGrammars;
    nvim-treesitter-textobjects = prev.vimPlugins.nvim-treesitter-textobjects.overrideAttrs (old: {
      dependencies = with prev.vimPlugins; [ nvim-treesitter ];
    });
  };
}

You can also add the cache to save some time rebuilding all the grammars on your own machine:

trusted-substituters = [
  "https://nvim-treesitter-main.cachix.org"
];

Then, in my Neovim config, I updated the setup to look like this:

require("nvim-treesitter").setup()

After this, when I opened a Markdown document, I noticed it was all white. But using InspectTree, the AST looked correct. It seemed like highlighting wasn’t working, which, again, if I had read the docs, I would’ve seen that I need to create an autocommand.

vim.api.nvim_create_autocmd("FileType", {
	pattern = "*",
	callback = function(args)
		-- Add error handling to prevent crashes during session restore
		local success, err = pcall(function()
			-- Check if parser is available before starting
			local lang = vim.bo[args.buf].filetype
			local ts_lang = vim.treesitter.language.get_lang(lang)
			if ts_lang then
				vim.treesitter.start(args.buf)
			end
		end)
		if not success then
			-- Silently fail if treesitter can't start for this buffer
			vim.notify("Treesitter failed to start for " .. vim.bo[args.buf].filetype .. ": " .. err, vim.log.levels.DEBUG)
		end
	end,
})

textobjects

To set up textobjects, we need to set up the plugin separately as well, also using the main branch. It now looks something like this:

require("nvim-treesitter-textobjects").setup({
    select = {
        lookahead = true,
        selection_modes = {
            ["@parameter.outer"] = "v",
            ["@function.outer"] = "V",
            ["@class.outer"] = "<c-v>",
        },
        include_surrounding_whitespace = false,
    },
    move = {
        set_jumps = true,
    },
})

-- Set up select keymaps using the new API
vim.keymap.set({ "x", "o" }, "af", function()
    require("nvim-treesitter-textobjects.select").select_textobject("@function.outer", "textobjects")
end)
vim.keymap.set({ "x", "o" }, "if", function()
    require("nvim-treesitter-textobjects.select").select_textobject("@function.inner", "textobjects")
end)
vim.keymap.set({ "x", "o" }, "ac", function()
    require("nvim-treesitter-textobjects.select").select_textobject("@class.outer", "textobjects")
end)

Notice how we now set up the textobjects as keybindings. Then, for swap and repeatable, assuming you were using those, it looks something like this:

vim.keymap.set("n", "<leader>a", function()
    require("nvim-treesitter-textobjects.swap").swap_next("@parameter.inner")
end)
vim.keymap.set("n", "<leader>A", function()
    require("nvim-treesitter-textobjects.swap").swap_previous("@parameter.outer")
end)

local ts_repeat_ok, ts_repeat_move = pcall(require, "nvim-treesitter-textobjects.repeatable_move")
if ts_repeat_ok then
    vim.keymap.set({ "n", "x", "o" }, ";", ts_repeat_move.repeat_last_move_next)
    vim.keymap.set({ "n", "x", "o" }, ",", ts_repeat_move.repeat_last_move_previous)
    vim.keymap.set({ "n", "x", "o" }, "f", ts_repeat_move.builtin_f_expr, { expr = true })
    vim.keymap.set({ "n", "x", "o" }, "F", ts_repeat_move.builtin_F_expr, { expr = true })
    vim.keymap.set({ "n", "x", "o" }, "t", ts_repeat_move.builtin_t_expr, { expr = true })
    vim.keymap.set({ "n", "x", "o" }, "T", ts_repeat_move.builtin_T_expr, { expr = true })
end

incremental selection

You can now do this via the LSP instead of the textobjects plugin, so I added the following plugins:

vim.keymap.set("x", "<c-space>", function()
    vim.lsp.buf.selection_range("outer")
end, { desc = "Expand selection (incremental)" })

vim.keymap.set("x", "<M-space>", function()
    vim.lsp.buf.selection_range("inner")
end, { desc = "Shrink selection (incremental)" })

vim.keymap.set("n", "<c-space>", function()
    vim.cmd("normal! v")
    vim.lsp.buf.selection_range("outer")
end, { desc = "Start incremental selection" })

vim.keymap.set("x", "<c-s>", function()
    vim.lsp.buf.selection_range("outer")
end, { desc = "Expand to scope" })

Neotest

I thought that would be enough, but I noticed in my ~/.local/state/nvim/neotest.log that I was getting the following error:

WARN | 2025-11-01T20:10:40Z+0000 | ...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:203 | CHILD | Error in remote call ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:130: attempt to index a nil value
stack traceback:
    ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:130: in function 'get__parse_root'
    ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:162: in function 'parse_positions_from_string'
    ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:209: in function 'func'
    ...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:195: in function <...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:194>
    [C]: in function 'xpcall'
    ...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:194: in function <...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:193>
WARN | 2025-11-01T20:10:40Z+0000 | ...eovimPackages/opt/neotest/lua/neotest/lib/subprocess.lua:203 | CHILD | Error in remote call ...Packages/opt/neotest/lua/neotest/lib/treesitter/init.lua:130: attempt to index a nil val

I found this issue and this fix. Then I updated Neotest to the latest version by again adding it as an input:

plugins-neotest = {
  url = "github:nvim-neotest/neotest";
  flake = false;
};

and

test = with pkgs.vimPlugins; [
  pkgs.neovimPlugins.neotest
];

Finally fixed? 🙏

Then I ran nh home switch (similar to home-manager switch --flake ~/nixicle#haseeb@workstation). I reloaded Neovim, and voila, it works now! That was my day of yak shaving and fixing random broken stuff. 🐐

I guess it goes without saying that if you’re running on the bleeding edge, things will break. The advantage is that usually only one thing breaks at a time, whereas with a major upgrade, multiple things might break, and you have to fix them all at once.

Also, this classic video is a must-watch!!!! 🤣

Recently I have been trying to update the emojis when I run nh. Particularly the nom output.

The old output was like so:

To fix this update your nh derivation like so:

environment.systemPackages = with pkgs; [
  (pkgs.nh.override {
    nix-output-monitor = pkgs.nix-output-monitor.overrideAttrs (old: {
      postPatch = old.postPatch or "" + ''
        substituteInPlace lib/NOM/Print.hs \
          --replace 'down = "↓"' 'down = "\xf072e"' \
          --replace 'up = "↑"' 'up = "\xf0737"' \
          --replace 'clock = "⏱"' 'clock = "\xf520"' \
          --replace 'running = "⏵"' 'running = "\xf04b"' \
          --replace 'done = "✔"' 'done = "\xf00c"' \
          --replace 'todo = "⏸"' 'todo = "\xf04d"' \
          --replace 'warning = "⚠"' 'warning = "\xf071"' \
          --replace 'average = "∅"' 'average = "\xf1da"' \
          --replace 'bigsum = "∑"' 'bigsum = "\xf04a0"'
      '';
    });
  })
];

Note you will no longer be able to use the default nix cache to build this. So everytime nh updates you will need to manually build it.

That’s it!

• Finish the setting page
• Improve observability
  • Send data to LGTM Grafana Cloud

🛠️ What I Worked On

Observability

This was more for my Gophercon talk, but I fixed the local LGTM stack setup so that we can send logs, metrics and traces and view it all in Grafana. Then correleate them correctly and move between them in the GUI.

Worked on the terraform code to then create the same stack in Grafana cloud to setup the LGTM stack. Including deploying an alloy agent on my VPS. So we can send all of our OTLP data their and have consumed by the Grafana cloud.

Setting Page

Started work on the settings page to allow the user to update various settings about the organization. Such as the name, logo and description.

Added ways for user to change their org name, avatar and description.

✅ Wins

• Learnt a lot more about OTLP observability

⚠️ Challenges

• Didn’t work much on this project got busy with real life

💡 What I Learned

• How to correlate logs, traces and metrics in the Grafana UI using the LGTM stack.

⏭️ Next Build Log Objectives

• Finish the setting page

So I have a small home lab, where I have a few random things running, like a GitLab CI runner, a media server etc. All my home lab servers (3 of them) are running NixOS and are defined within my Nix flake what services they run.

For example: https://gitlab.com/hmajid2301/nixicle/-/blob/main/systems/x86_64-linux/ms01/default.nix?ref_type=heads

They are set up using nixos-anywhere like most of my other services. Then using deploy-rs we can ssh onto our home lab servers and deploy nix config, i.e. updating packages.

I wanted a more automated way to do, i.e. anytime nixicle repo changes, try to deploy those changes to my home lab on CI.

Tailscale

I connect to my home lab using Tailscale a very cool tool, think like a VPN, it uses WireGuard behind the scenes. With some extra stuff on top to provide a really nice user experience. Highly recommend if you are looking to get into homelabbing.

So first, our CI runner would need to be able to connect to Tailscale to be able to deploy our new config onto the home lab servers.

I will assume you have already set up your Tailscale account for the next part. I may create a tutorial later on how you can do it. Better to be honest, there is a ton of decent literature available already, including videos.

First, let’s create an auth key. Go to: https://login.tailscale.com/admin/settings/keys

We want to enable Ephemeral, so the device gets removed from our list, else every time CI runs we will get a new device in our list of machines. Then, in my case, I need to also check the pre-approve, so the admin doesn’t need to manually approve it, slightly defeating the purpose of CI.

You can also optionally create a tag for your machines using this auth key. In my case, I wanted to tag it with CI. Which we can then use for ACL rules etc.

Gitlab CI

After creating the key copy the value, you won’t be able to see it again, so keep that in mind. Add it to your CI variables, you can check the masked option, so the auth key isn’t accidentally printed in CI.

(You can access this using the left side bar; setting > CI/CD > Variables)

Then our CI file may look something like this .gitlab-ci.yml

image: nixos/nix

stages:
  - deploy

tailscale:
  stage: deploy
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - mkdir -p /etc/nix/ /etc/ssh/
    - echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
    - nix-env -iA nixpkgs.docker nixpkgs.go-task nixpkgs.flyctl nixpkgs.tailscale nixpkgs.jq
    - ssh-keygen -t ed25519 -N "" -f ~/.ssh/id_ed25519
    - ssh-keygen -t ed25519 -N "" -f /etc/ssh/ssh_host_ed25519_key
    - mkdir -p ~/.ssh
    - chmod 700 ~/.ssh
    - echo "Host *" >> ~/.ssh/config
    - echo "  StrictHostKeyChecking no" >> ~/.ssh/config
    - echo "  UserKnownHostsFile /dev/null" >> ~/.ssh/config
    - export SSH_ASKPASS_REQUIRE=never
    - eval $(ssh-agent -s)
    - ssh-add ~/.ssh/id_ed25519 2>/dev/null

    - tailscaled --state="mem:" --statedir=/var/lib/tailscale &
    - tailscale up --authkey=${TAILSCALE_AUTHKEY} --hostname="gitlab-$(cat /etc/hostname)" --accept-routes --ssh
    - nix profile install github:serokell/deploy-rs
    - deploy ".#ms01" --hostname ms01 --ssh-user nixos --skip-checks --confirm-timeout "600" --remote-build

Let’s break this file down

First, we want to create some SSH keys so that you can SSH on the CI runner onto the home lab server.

The next part we start up the Tailscale daemon in the background, and then we authenticate with Tailscale so our runner can now connect to our home lab servers

Then, finally, we install deploy-rs and use it to SSH to our machines and deploy to it.

Tailscale SSH

I also had to enable Tailscale ssh on the host devices so we could SSH from the runner without needing to include an SSH private key and adding that to the allowed SSH list on each server. Which we can do like so:

tailscale set --ssh

This lets Tailscale take over SSH for us, users can still SSH like normal, but you can also SSH like normal as well. But just make sure you are aware of the security implications before you turn it on.

Then I set up on ACLs like so:

	"tagOwners": {
		"tag:ci":           [],
		"tag:homelab":      [],
	},

	// Define access control lists for users, groups, autogroups, tags,
	// Tailscale IP addresses, and subnet ranges.
	"acls": [
		// Allow all connections.
		// Comment this section out if you want to define specific restrictions.
		{"action": "accept", "src": ["tag:ci"], "dst": ["tag:homelab:*"]},
		{
			"action": "accept",
			"src":    ["tag:homelab"],
			"dst":    ["tag:homelab:*"],
		},
	],

	// Define users and devices that can use Tailscale SSH.
	"ssh": [
		// Allow all users to SSH into their own devices in check mode.
		// Comment this section out if you want to define specific restrictions.
		{
			"action": "accept",
			"src":    ["autogroup:member", "tag:ci"],
			"dst":    ["tag:homelab"],
			"users":  ["autogroup:nonroot", "root"],
		},
		{
			"action": "accept",
			"src":    ["tag:ci"],
			"dst":    ["tag:homelab"],
			"users":  ["nixos", "root"],
		},
	],

I am no expert on ACL rules in Tailscale, but I think this allows the CI runner to SSH onto the home lab servers. Which I, of course, have already tagged with home lab.

Currently, I am using a fork of the original plugin, as the fish shell v4 broke it but eventually can use the original.

How it works:

Fish will search $fish_complete_path dynamically, so the idea is to implement a function which listens for changes to $XDG_DATA_DIRS, and attempts to keep that in sync with $fish_complete_path.

But in your nix config you can put this plugin:

{
  programs.fish = {
  # ...
  plugins = [
    # ...
    # INFO: Using this to get shell completion for programs added to the path through nix+direnv.
    # Issue to upstream into direnv:Add commentMore actions
    # https://github.com/direnv/direnv/issues/443
    {
      name = "completion-sync";
      src = pkgs.fetchFromGitHub {
        owner = "iynaix";
        repo = "fish-completion-sync";
        rev = "4f058ad2986727a5f510e757bc82cbbfca4596f0";
        sha256 = "sha256-kHpdCQdYcpvi9EFM/uZXv93mZqlk1zCi2DRhWaDyK5g=";
      };
    }
  ];
}

According to someone who solved these issues and got in touch with me, this works on zsh: https://github.com/BronzeDeer/zsh-completion-sync Or for other shells, look here: https://github.com/direnv/direnv/issues/443.

• Mark feedback public/private
• Start on settings page

🛠️ What I Worked On

Mark feedback as private/public

Logged in users can mark feedback as private so it won’t be shown on the public dashboard.

Gitlab Dependency Proxy

I started using the Gitlab dependency proxy so that we can pull in image from Docker hub using Gitlab to avoid hiting rate limits. But also means we can use image cache which should makes jobs a quicker when pulling say postgres.

Add Dev Environment

Previously there was just a local and production environment. Now there is a development environment we can deploy to. This is now done CI on a MR via GitLab CI.

It is available at: https://dev.voxicle.app

Fix generate CI job

For a while the CI job to check if generated code was correct was failing with extra CSS classes in the tailwind generated file. For the life of me I couldn’t work out why. Recently I decided to have a crack, testing it locally with gitlab-ci-local. In the end it seemed to be caused by mockery. After moving mockery under the tailwind cli tool it seemed to work fine. But again I have no clue why, it had extra classes like sr-only but doing a grep (or ripgrep) for the generated mocks there was no sr-only. So I still don’t know why this fixed anything. Will need to investigate more later.

  generate:
    desc: Generates all the code needed for the project i.e. sqlc, templ & tailwindcss
    cmds:
      - templ generate
      - tailwindcss -i ./static/css/tailwind.css -o ./static/css/styles.css --minify
      - mockery --all
      - sqlc generate
      - gomod2nix generate
      - task: format

✅ Wins

⚠️ Challenges

• Getting the GitLab proxy to work took longer than expected
• Trying to work out how much is left in this app before I should start sharing with people and collecting real feedback
• Why moving mockery under tailwindcss works

💡 What I Learned

• The GitLab dependency proxy doesn’t work for personal projects, they need to be in a group i.e. not hmajid2301/voxicle but voxicle/voxicle

⏭️ Next Build Log Objectives

• Finish the setting page
• Improve observability
  • Send data to LGTM Grafana Cloud

For the moment, the GitLab proxy will not work if the project is in your personal namespace i.e. gitlab.com/hmajid2301. So to make it work with my project Voxicle I had to move to its own group.

GitLab Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/323773

Background

The GitLab dependency proxy, allows us to cache Docker images that we pull from Docker Hub. This allows us to reduce bandwidth and speed up builds, i.e. quicker to pull Postgres for our tests in CI.

It can also avoid us potentially hitting rate limits with Docker Hub as well. Especially in groups that have a lot of projects that are constantly running in CI.

Setup

First go to your group and enable the Dependency Proxy and potentially the automatic cache clean up if you like.

Then we can now do ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/postgres:17.4 to pull images. You can set that up in GitLab, CI.

In my case, some of my jobs use the nixos/nix so in GitLab CI I use:

image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/nixos/nix

I also use docker-compose in CI:

tests:integration:
  extends:
    - .test
  script:
    - docker compose --profile test up -d
    - task tests:integration -- ${GOTEST_EXTRA_ARGS}

We need to authenticate with the proxy, and you can do in CI like so:

.test:
  services:
    - name: docker:dind
  before_script:
    - docker login -u "$CI_DEPENDENCY_PROXY_USER" -p "$CI_DEPENDENCY_PROXY_PASSWORD" "$CI_DEPENDENCY_PROXY_SERVER"

Then we can update our docker-compose.yml file like so:

services:
  postgres:
    image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX:-docker.io}/postgres:17.4
    profiles:
      - test
    ports:
      - 5432:5432
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./docker/postgres-init.sql:/docker-entrypoint-initdb.d/init.sql

You will notice :-docker.io this means that if the environment variable is not set for the dependency proxy. It defaults to docker.io so this docker compose file will work locally and in CI.

But for non Docker Hub images you cannot use the dependency proxy, so we leave it like so:

  smocker:
    image: ghcr.io/smocker-dev/smocker:1.0.0
    profiles:
      - other
    ports:
      - 44300:8080
      - 44301:8081

That’s it! You can now use the GitLab dependency proxy, which should help speed up CI a bit.

Variables

• CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX pulls through the top-level group.
• CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX pulls through the subgroup, or direct group the project exists in.

Links

• https://docs.gitlab.com/user/packages/dependency_proxy/

• Public page for feedback
  • private and public feedbacks
  • allow anonymous voting

🛠️ What I Worked On

Public Feedback Dashboard

We started of with this:

And finish with this

Users can now do the almost everything they can when logged in but when anonymous. We attach a deviceID cookie to them to be able to spot if its the same user. This only works for the same device and until they clear their cookies but should be good enough for most of the users I think for now.

DevEx improvements

Add mprocs to be able to nicely manage running multiple commands in parallel and need leaving floating processes running. Such as being ableto watch file changes with templ and tailwindcss and also start the hot reloaded web service with air.

Try to run dependencies using docker-compose vs services in Gitlab CI. So we don’t have to make changes in multiple places.

Also started a new tab in zellij to be able to run some common commands easily, I just need to go into the pane and hit enter i.e. zellij run -- task lint.

OpenTofu

There are lots of stuff I setup manually and I would like to move into code, declaratively using terraform/open tofu. In this case:

• cloudflare DNS

Observability

I have been working on my slides for my Gophercon talk about otel and observability, so I have been fixing gaps and the broken setup in Voxicle. So now we have logs, metrics and traces viewable in a locally running instance of Grafana. It will be easy enough to set this up in production to point to which ever tool I decide to use.

✅ Wins

• Subdomains take you to voxicle i.e. orga.voxicle.app
• Public page shows public feedbacks
• Made some DevEx improvements, taskfiles, gitlab CI
• Made my infra setup more declarative with OpenTofu

⚠️ Challenges

• Getting podman to work with the dind service in Gitlab CI
  • Going down a rabbit hole of trying to run podman vs using the Docker daemon inside

💡 What I Learned

• How to setup open tofu new project

⏭️ Next Build Log Objectives

• Mark feedback public/private
• Start on settings page

⏮️ Previous Build Log Objectives

• ✅ Better error modals (fixed)
• ✅ Start working on public page
• ✅ Multi tenant sub domains
  • i.e. org1.voxicle.app

🛠️ What I Worked On

Error Modal Bug

I have some middleware that will show an error modal when we return an error back to the client. I may change this to be a toast for certain actions vs a full on modal but we can do that in the middleware.

There was a bug where the modal wouldn’t work insted it would return the status code and HTML like so:

401 Unauthorized (Failed to login.)<div>...</div>

Set HX-Retarget, to replace other items i.e. not #feedback_list but we want to update #error_modal_container. So in the middleware we now set this header, with an error modal.

w.Header().Set("HX-Retarget", "#error_modal_container")
w.Header().Set("Content-Type", "text/html")

With the following script, to show the modal after a HTMX swap:

<script>
    document.body.addEventListener('htmx:afterSwap', function(evt) {
      if (evt.detail.target.id === 'error_modal_container') {
        document.getElementById('error_modal')?.showModal();
      }
    });
</script>

hx-indicator trigger

For really fast request we don’t want to show the loading spinner quickly and then hide it. So for the first x seconds don’t show the loading spinner wait say 1 second then show it. So it is less likely to flash on screen and disappear. Which doesn’t provide an amazing experience for the user, of course there is a chance that this could still happen.

I fixed it by doing something like this, when we make a request to our backend.

<span id="delete-indicator" class="hidden justify-center items-center transition duration-300 delay-2000 hx-indicator">
    <span class="loading loading-spinner"></span>
    <span class="ml-2">Sending...</span>
</span>

Public Feedback Page

One of the main features of the web app is allowing other people to vote on features, so we allow anonymous votes. So decided to manage anonymous votes in its own table, which keeps track of a device_id. A long lived cookie we populate. Which of course means you can vote again from another device. But this is a good enough trade off.

So started work to show the feedbacks on a single public page, which a user can then filter on like the private one but then also vote for it anonymously or if you are logged in the vote counts as normal.

Subdomains

Part of the public page is allowing the app to handle subdomains i.e. org1.voxicle.app/public/feedback to show the public feedback page.

Refactored Schema

Remove organization_id and replaced with slug as this is already unique and means we have to do fewer looks up to the DB. Involved a long migration script and updating tests and some code as well.

✅ Wins

• Error modal fixed
• Worked out how to handle anonymous votes

⚠️ Challenges

• Not understanding why hx-swap-oob wouldn’t work with HX-Retarget.

💡 What I Learned

• (remembered) HTMX only swaps by default on 200 HTTP Status code
  • <meta name="htmx-config" content='{"responseHandling": [{"code":"...", "swap": true}]}'/>
• hx-swap-oob used for other changes first container is replaced, we can use hx-retarget

⏭️ Next Build Log Objectives

• Public page for feedback
  • private and public feedbacks
  • allow anonymous voting

What is Neovim?

Neovim is a text editor, that you can run in your terminal. Much like vim and vi or nano. So we would run this inside our terminal emulator and Zellij. It differs from vim because you can configure it using lua vs vimscript . Some of the other unique features it had, you can now do in vim (I believe). Such as tree sitter support and LSPs.

Why Neovim?

So why Neovim, good question! Before Neovim, I was using VS Code, and I was mostly pretty happy. But in 2023, I decided to give Neovim a go:

• As most things with me and using Linux, I like to be able to customise and personalise things for myself
• Requires fewer resources to run compared with my old editor
• Runs in the terminal so can use it with tmux
• Forced me to learn my tools a lot better

I was already using vim binding since 2013, someone at university told me to learn vim, and I never looked back. This then fit so well and let me include tmux/Zellij in my workflow, and things became a lot clearer. In terms of one project per session.

Some less known plugins

• oil.nvim
• headlines.nvim
• nvim-treesitter-textobjects
• grug-far.nvim
• dropbar.nvim

How I configured it?

Until recently, I used NixVim which was all my Neovim config in Nix. Whilst this meant everything was in Nix and that was nice. However, it created a single lua file, and meant I had to like lua code in strings, losing the LSP.

So I decided to move my config to NixCats, where we can install our dependencies using Nix so we get all the benefits of Nix. Then our config is lua, I think when you have so many files and complex structure it makes sense to write in the language the config should be in. Not via Nix as this sorta of proxy.

The config is pretty messy and needs a tidy up, many to-dos, but it works and was basically feature parity with my old config. It also made me more familiar with setting up Neovim in lua itself.

dependencies

Due to how NixCats works, we can split our dependencies into categories, then enable and disable as we need.

lspsAndRuntimeDeps = {
    general = with pkgs; [ universal-ctags ripgrep fd stdenv.cc.cc ];
    css = with pkgs; [
      stylelint
      prettierd
      rustywind
      tailwindcss-language-server
    ];
    docker = with pkgs; [
      dockerfile-language-server-nodejs
      docker-compose-language-service
      hadolint
    ];
    html = with pkgs; [
      htmlhint
      rubyPackages_3_4.htmlbeautifier
      htmx-lsp
      vscode-langservers-extracted
    ];
    go = with pkgs; [
      go
      golangci-lint
      delve
      gopls
      go-tools
      gotools
      gotestsum
    ];
}

# ...

optionalPlugins = {
    debug = with pkgs.vimPlugins; [
      nvim-dap
      pkgs.neovimPlugins.nvim-dap-view
      nvim-dap-go
    ];
    test = with pkgs.vimPlugins; [
      neotest
      neotest-golang
      nvim-coverage
      vim-dotenv
    ];
    lint = with pkgs.vimPlugins; [ nvim-lint ];
    format = with pkgs.vimPlugins; [ conform-nvim ];
}

Setup

We can then set up different versions of our Neovim config, here we are bundling the config with the Neovim script. So to introduce changes to config we need to rebuild our config. Which makes it more reproducible. But can be annoying when we are testing out changes and don’t want to do a full rebuild every time (wrapRC).

  # see :help nixCats.flake.outputs.packageDefinitions
  packageDefinitions.replace = {
    nixCats = { pkgs, ... }: {
      settings = {
        wrapRc = true;
        suffix-path = true;
        suffix-LD = true;
        aliases = [ "vimCat" ];
        configDirName = "nixCats-nvim";
      };
      categories = {
        general = true;
        go = true;

        ai = true;
        diagnostics = true;
        editor = true;
        debug = true;
        test = true;
        lint = true;
        format = true;
        git = true;
      };
    };

To deal with this issue, we can do something like this, where we pass the unwrappedCfgPath where our lua config is. We can reload it by closing Neovim and opening it up again, vs doing a full rebuild of say home-manager.

regularCats = { pkgs, ... }: {
  settings = {
    wrapRc = false;
    suffix-path = true;
    suffix-LD = true;
    unwrappedCfgPath =
      "${config.home.homeDirectory}/nixicle/modules/home/cli/editors/neovim";
    configDirName = "nixCats-nvim";
    aliases = [ "nvim" ];
    neovim-unwrapped =
      inputs.neovim-nightly-overlay.packages.${pkgs.system}.neovim;
  };
};

So you can some of this is installing tooling, some of it installing plugins. Which we can then lazy load later. These dependencies are all installed with Nix. So we get all of those benefits, such as reproducibility. We can easily share our Neovim config that anyone could use on their machine. In my case, if you have flakes you can try my Neovim config like so:

nix run .#homeConfigurations."haseeb@workstation".config.nixCats.out.packages.nixCats

Custom Plugins

Sometimes we have plugins that aren’t in nixpkgs yet, and it can be a while before your PR gets accepted. Or you could create your own package that you keep updated. NixCats provides an easy way to manage this.

We can add this to our flake.nix in the input section:

plugins-gx-nvim = {
  url = "github:chrishrb/gx.nvim";
  flake = false;
};

NixCat will automatically make any input starting with plugins- available to us. Where we can then install like any other plugin doing it like so.

pkgs.neovimPlugins.gx-nvim

Then this input will update normally when we do nix flake update, so we don’t have to worry about keeping it up to date ourselves.

Now onto more generic Neovim, how I have configured it. How you could set it up no matter the package manager.

lint & formatting

I use nvim-lint for linting, we just need to specify which linter we want to use for which file types. These tools have all been installed using Nix in our case, so they should be available inside Neovim.

require("lint").linters_by_ft = {
    docker = { "hadolint" },
    go = { "golangcilint" },
    html = { "htmlhint" },
    lua = { "luacheck" },
    nix = { "statix" },
    javascript = { "eslint" },
    typescript = { "eslint" },
    sql = { "sqlfluff" },
}

vim.api.nvim_create_autocmd({ "BufWritePost" }, {
    callback = function()
        require("lint").try_lint()
    end,
})

Then for formatting I use conform-nvim, where again we specify the formatters per file type. The full list can be found on to conform README. You can even set up your own formatter that is not currently supported. We can also add our own arguments to those formatters, i.e. goimports passing in my own local packages.

local conform = require("conform")

conform.setup({
    format_on_save = {
        lsp_format = "fallback",
        timeout_ms = 500,
    },
    formatters = {
        goimports = {
            command = "goimports",
            args = { "-local", "gitlab.com/hmajid2301" },
        },
        yamlfmt = {
            args = { "-formatter", "retain_line_breaks_single=true" },
        },
    },
    formatters_by_ft = {
        css = { "prettierd" },
        go = { "gofmt", "goimports" },
        lua = { "stylua" },
        templ = { "rustywind", "templ" },
        html = { "htmlbeautifier", "rustywind" },
        nix = { "nixfmt" },
        python = { "isort", "black" },
        javascript = { "prettierd" },
        typescript = { "prettierd" },
        sql = { "sqlfluff" },
        yaml = { "yamlfmt" },
    },
})

LSP

One of the most important features of my editor is to use the language server protocol (LSP) to be able to get code completions, auto import and also show docs for functions/methods.

Here are some example images

Like most people, I use the nvim lspconfig plugin, which comes with a bunch of sane defaults for almost every LSP, you might want to use.

Having a look at example of go where set some of my own options. Like setting build tags so that it runs correctly where tests have build tags.

{
    "gopls",
    for_cat = "go",
    lsp = {
        settings = {
            gopls = {
                buildFlags = { "-tags=unit,integration,e2e,bdd,dind" },
                staticcheck = true,
                directoryFilters = { "-.git", "-.vscode", "-.idea", "-.vscode-test", "-node_modules" },
                semanticTokens = true,
                codelenses = {
                    gc_details = false,
                    generate = true,
                    regenerate_cgo = true,
                    run_govulncheck = true,
                    test = true,
                    tidy = true,
                    upgrade_dependency = true,
                    vendor = true,
                },
                hints = {
                    assignVariableTypes = false,
                    compositeLiteralFields = false,
                    compositeLiteralTypes = false,
                    constantValues = true,
                    functionTypeParameters = true,
                    parameterNames = true,
                    rangeVariableTypes = false,
                },
                analyses = {
                    assign = true,
                    bools = true,
                    defers = true,
                    deprecated = true,
                    tests = true,
                    nilness = true,
                    httpresponse = true,
                    unmarshal = true,
                    unusedparams = true,
                    unusedwrite = true,
                    useany = true,
                },
            },
        },
    },
},

I also have some key maps for navigating, such as <leader>gd for going to where something is defined, i.e. a function in the stdlib which will go and find the code.

nmap("<leader>cr", vim.lsp.buf.rename, "[R]e[n]ame")
nmap("<leader>gd", vim.lsp.buf.definition, "[G]oto [D]efinition")

nmap("<leader>gr", function()
    require("telescope.builtin").lsp_references()
end, "[G]oto [R]eferences")

nmap("<leader>gi", function()
    require("telescope.builtin").lsp_implementations()
end, "[G]oto [I]mplementation")

nmap("<leader>ds", function()
    require("telescope.builtin").lsp_document_symbols()
end, "[D]ocument [S]ymbols")

nmap("<leader>ws", function()
    require("telescope.builtin").lsp_dynamic_workspace_symbols()
end, "[W]orkspace [S]ymbols")

debugging

Another important feature is being able to debug, again like LSP, there are a debugging protocol we can use DAP.

I am using

• nvim-dap
• nvim-dap-go
• nvim-dap-view

Where some of the config looks like this, to show automatically show dap-view when the debugger starts.

local dap, dv = require("dap"), require("dap-view")

dap.listeners.before.attach["dap-view-config"] = function()
    dv.open()
end
dap.listeners.before.launch["dap-view-config"] = function()
    dv.open()
end
dap.listeners.before.event_terminated["dap-view-config"] = function()
    dv.close()
end
dap.listeners.before.event_exited["dap-view-config"] = function()
    dv.close()
end

vim.fn.sign_define("DapBreakpoint", { text = " ", texthl = "DapBreakpoint", linehl = "", numhl = "" })
vim.fn.sign_define(
    "DapBreakpointCondition",
    { text = " ", texthl = "DapBreakpointCondition", linehl = "", numhl = "" }
)
vim.fn.sign_define(
    "DapBreakpointRejected",
    { text = " ", texthl = "DiagnosticError", linehl = "", numhl = "" }
)
vim.fn.sign_define("DapLogPoint", { text = " ", texthl = "DapBreakpoint", linehl = "", numhl = "" })
vim.fn.sign_define(
    "DapStopped",
    { text = "󰁕 ", texthl = "DapStopped", linehl = "DapStopped", numhl = "DapStopped" }
)

Some of you may be wondering why I am not using the dap-ui plugin that most people use. I couldn’t find a layout that worked for me, so hence I decided to go with a simpler dap-view plugin. Then some key maps to hover the current values of variables.

I use the built-in widgets to do it, I don’t think this toggle is quite working, so I might just remove all this code. We can close that panel with the variables by doing ZZ (and other ways to close a buffer).

local dap_widgets = require("dap.ui.widgets")

local debug_widgets = {
    scopes = nil,
    hover = nil,
}

local function create_scopes_widget()
    return dap_widgets.centered_float(dap_widgets.scopes, {
        border = "rounded",
        width = 200,
        height = 25,
    })
end

local function create_hover_widget()
    return dap_widgets.hover(nil, { border = "rounded" })
end

local function safe_toggle(widget_type, creator_fn)
    return function()
        local current = debug_widgets[widget_type]

        -- Close if exists
        if current then
            pcall(function()
                -- Close window and clear buffer directly
                if current.winid and vim.api.nvim_win_is_valid(current.winid) then
                    vim.api.nvim_win_close(current.winid, true)
                end
                if current.bufnr and vim.api.nvim_buf_is_valid(current.bufnr) then
                    vim.api.nvim_buf_delete(current.bufnr, { force = true })
                end
            end)
            debug_widgets[widget_type] = nil
            return
        end

        -- Create and open new widget
        local new_widget = creator_fn()
        new_widget.open()
        debug_widgets[widget_type] = new_widget

        -- Track window closure
        vim.api.nvim_create_autocmd("WinClosed", {
            pattern = tostring(new_widget.winid),
            once = true,
            callback = function()
                debug_widgets[widget_type] = nil
            end,
        })
    end
end

-- Keymaps
vim.keymap.set(
    "n",
    "<leader>dv",
    safe_toggle("scopes", create_scopes_widget),
    { desc = "Debug: Toggle Scopes" }
)
vim.keymap.set(
    "n",
    "<leader>dV",
    safe_toggle("hover", create_hover_widget),
    { desc = "Debug: Toggle Variables" }
)

Then finally some key maps:

vim.keymap.set("n", "<leader>dc", dap.continue, { desc = "Debug: Start/Continue" })

vim.keymap.set("n", "<F5>", dap.continue, { desc = "Debug: Start/Continue" })
vim.keymap.set("n", "<F6>", dap.step_into, { desc = "Debug: Step Into" })
vim.keymap.set("n", "<F7>", dap.step_over, { desc = "Debug: Step Over" })
vim.keymap.set("n", "<F8>", dap.step_out, { desc = "Debug: Step Out" })

vim.keymap.set("n", "<leader>db", dap.toggle_breakpoint, { desc = "Debug: Toggle Breakpoint" })
vim.keymap.set("n", "<leader>dr", function()
    dap.disconnect()
    dap.close()
    dap.run_last()
end, { desc = "Debug: Restart" })
vim.keymap.set("n", "<leader>dp", dap.pause, { desc = "Debug: Pause" })
vim.keymap.set("n", "<leader>dl", dap.run_last, { desc = "Debug: Run the last config" })
vim.keymap.set("n", "<leader>ds", dap.session, { desc = "Debug: Focused Session" })
vim.keymap.set("n", "<leader>dt", dap.terminate, { desc = "Debug: Stop" })
vim.keymap.set("n", "<leader>dC", dap.run_to_cursor, { desc = "Debug: Run to cursor" })
vim.keymap.set("n", "<leader>dB", function()
    dap.set_breakpoint(vim.fn.input("Breakpoint condition: "))
end, { desc = "Debug: Set Breakpoint (with condition)" })

So we can start the debugger in <leader>dc, though usually, I mostly debug my tests which I will show you how to do that later.

Finally, the config for the rest of my DAP setup:

{
    "nvim-dap-view",
    for_cat = "debug",
    on_plugin = { "nvim-dap" },
    after = function(plugin)
        require("dap-view").setup({
            windows = {
                terminal = {
                    hide = { "go" },
                },
            },
        })
    end,
},
{
    "nvim-dap-go",
    for_cat = "debug",
    on_plugin = { "nvim-dap" },
    after = function(plugin)
        require("dap-go").setup({
            dap_configurations = { { mode = "remote", name = "Attach remote", request = "attach", type = "go" } },
            delve = { build_flags = "-tags=unit,integration,e2e,bdd,dind", path = "dlv", port = "40000" },
        })
    end,
},

testing

For testing, I use neotest with the neotest-golang:

require("neotest").setup({
    adapters = {
        require("neotest-golang")({
            go_test_args = { "-v", "-x", "-count=1", "-tags=integration" },
            go_list_args = { "-tags=unit,integration,e2e,bdd,dind" },
            dap_go_opts = {
                delve = {
                    build_flags = { "-tags=unit,integration,e2e,bdd,dind" },
                },
            },
        }),
    },
    output = { open_on_run = true },
})

Then I have the following key maps:

vim.keymap.set("n", "<leader>tt", function()
    neotest.run.run(vim.fn.expand("%"))
end, { desc = "Test: Run all in current file" })
vim.keymap.set("n", "<leader>tT", function()
    neotest.run.run(vim.loop.cwd())
end, { desc = "Test: Run all in all files" })
vim.keymap.set("n", "<leader>tS", neotest.run.stop, { desc = "Test: Stop" })
vim.keymap.set("n", "<leader>ts", neotest.summary.toggle, { desc = "Test: Toggle Summary" })
vim.keymap.set("n", "<leader>tr", neotest.run.run, { desc = "Test: Run Nearest" })
vim.keymap.set("n", "<leader>to", function()
    neotest.output.open({ enter = true, auto_close = true })
end, { desc = "Test: Show Output" })
vim.keymap.set("n", "<leader>td", function()
    neotest.run.run({ suite = false, strategy = "dap" })
end, { desc = "Test: Debug nearest" })
vim.keymap.set("n", "<leader>tO", function()
    neotest.output_panel.toggle()
end, { desc = "Test: Toggle output" })

The most important being the one that starts a debugger <leader>td on the nearest test. Including table tests in Go!

We can view all of our tests here using the test summary and run them like that.

Summary

It’s taken a long time, but I think in terms of my developer workflow, that’s about it. In terms of the tooling, I use. I may do another one how I work on a project and my day-to-day coding. Maybe as a YouTube video!

• Implement Authorization using RLS in Postgres
• Better error modals (fixed)

🛠️ What I Worked On

🔒 Row Level Security (Authorization)

Row Level Security for Feedback and Upvotes. With row level security we can add policies and use config variables. Such that we set the organization ID and users can only get feedback that is part of their organization. This means we can simplify our SQL queries with fewer joins and fewer where clauses. Making them easier to read. Essentially it lets us do a simple form of authorization inside the web app.

An example on select statements for the user voxicle.

create policy feedback_select_policy on public.feedback
for select to voxicle
using (
    organization_id = current_setting('app.current_org_id')::uuid
);

Where we then have some “hooks” in pgx which look like this when we configure it. Where the auth is set in the ctx in some middleware. It does make testing a bit more awkward but its a fine trade off.

pgxConfig.BeforeAcquire = func(a context.Context, conn *pgx.Conn) bool {
    state := auth.GetFromContext(a)
    if state.OrgID != uuid.Nil {
        _, err := conn.Exec(a, "SELECT set_config('app.current_org_id', $1, false);", state.OrgID)
        if err != nil {
            // TODO: log the error
            panic(err)
        }
    }

    return true
}

pgxConfig.AfterRelease = func(conn *pgx.Conn) bool {
    _, err := conn.Exec(context.Background(), "SELECT set_config('app.current_org_id', $1, false);", uuid.Nil)
    if err != nil {
        // TODO: log the error
        panic(err)
    }
    return true
}

I will do a write up/video on how I setup this up with sqlc, goose and pgx.

✏️ Refactor

Refactored the get feedback query to not include upvotes, split that into another query. More DB queries by they are simpler, and easier to understand now. Can change later if the app feels sluggish, needs to do some profiling.

🧪 Tests

Added more tests for upvotes, unit tests, integration tests and E2E tests (playwright). Made it so the tests can run in parallel -parallel 10 (GOMAXPROCS). This has caused the run time to decrease by about 50% in CI. Even though there are actually more tests now.

✅ Wins

• RLS meant we could simplify our queries
• Added more tests
• Made the tests run faster in CI
  • Run them in parallel

⚠️ Challenges

Implementing RLS took a longer to implement than I expected. Spent the better part of a week on it. Has issues because I was testing with a super user on postgres i.e. the default one in Docker. It took using AI to give me the hint what could be the issues.

💡 What I Learned

RLS - Doesn’t apply to super users so needed to create a separate user i.e. voxicle for local tests. Vs using postgres the default admin user in Docker.

That you need to be careful running tests with t.Parallel in table test See more here.

⏭️ Next Weeks Objectives

• Better error modals (fixed)
• Start working on public page
• Multi tenant sub domains
  • i.e. org1.voxicle.app

Why Nix?

In my project, it is a go web app, so all the dependencies in the project are managed as go modules by my go.mod file. Then everything else the developer needs is set up as a dev shell. Things like the standalone tailwind CLI, I am using a nix flake which already has DaisyUI built in so it can also generate those types i.e. btn in the final styles.css (or whatever you called it). The flake is here: https://github.com/aabccd021/tailwindcss-daisyui-nix

I didn’t want to have multiple package managers, using npm or something else.

You can learn more about this here: https://www.youtube.com/watch?v=bdGfn_ihHOk

Setup

Assuming we have enabled the tailwind LSP in our Neovim config, I am using NixCats, and it looks it like this (using nvim-lspconfig):

{
    "tailwindcss",
    lsp = {},
},

You can find my full config here:

• https://gitlab.com/hmajid2301/nixicle/-/blob/8c959ca5bd6436595592d0cedf932787ba86e359/modules/home/cli/editors/neovim/lua/myLuaConf/LSPs/init.lua#L199
• https://gitlab.com/hmajid2301/nixicle/-/blob/MAJ-311/modules/home/cli/editors/neovim/default.nix#L48

So first I added this flake as an input

tailwindcss_daisy.url = "github:aabccd021/tailwindcss-daisyui-nix/lsp";
tailwindcss_daisy.inputs.nixpkgs.follows = "nixpkgs";

Then install the following packages:

tailwindcss-language-server
tailwindcss_daisy.packages.${system}.default

The tailwindcss-language-server being the LSP server for tailwind. Normally, this is installed in my dot files repo. (I linked above). But this one is an overlay from the flake. So this one also has DaisyUI in its NODE_PATH. Then it also auto-complete classes from DaisyUI.

Read this issue: https://github.com/aabccd021/tailwindcss-daisyui-nix/issues/1

Finally, to get the tailwind LSP to work, we need to create an empty tailwind.config.js. Else, the tailwind LSP does not seem to start correctly. Even though the project is configured using the CSS file (probably will be fixed)

That’s it! It took me a while to figure it out, but this seems to work pretty nicely.

Last Week

• Fixed my Tailwind LSP for a better DevEx
• Improved my Gitlab CI file when building the dev Docker image
• Improved the UI
• Allow users to change the sort filters i.e. latest or oldest

Next Week

• Implement Authorization using RLS in Postgres
• Better error modals (fixed)

Recently, I have started to build apps using the web stack:

• frontend

  • htmx
  • tailwindcss
    • daisyui
  • alpine

• backend

  • go
    • templ
  • postgres

• devex

  • gitlab ci
  • nix devshells

I have now built two apps using this stack, one of them being banterbus.games a browser-based party game (currently broken). Using web sockets, so it isn’t the most normal web application. As there are a few quirks of web sockets.

Banter Bus Code: https://gitlab.com/hmajid2301/banterbus

I am currently building a more normal CRUD app, called Voxicle (https://voxicle.app), a SaaS platform for collecting and acting on user feedback. The first time, I am trying to build something which I will charge others for (hence the code also not being open-source yet). Some more context here: https://haseebmajid.dev/posts/2025-03-03-go-feedback-my-new-side-project/

In this article, go over why I like this tech stack so much. Mainly because I want to keep things as simple as possible. One other thing to note, I am a backend developer, and don’t really like writing frontend code a la JavaScript (JS). So this stack is designed to avoid writing as many JS as I can, which other developers of course love writing. So read this article through those lenses. This stack might not make sense for you.

Frontend

One of the issues I found in my side projects was that I would always lose motivation when I had to write frontend code. For a few reasons, I never had enough experience with frameworks like React or Svelte to know how to structure them. Therefore, they would quickly become a mess.

Another issue is maintaining consistent state between the backend and frontend. If we drive everything from the backend we can maintain most of our state there. Which works pretty well for a simple CRUD app we are building? The UI doesn’t need to do anything super crazy or clever.

TailwindCSS

For styling, I have stuck with TailwindCSS for a number of years, some people hate it. I have never minded it. It does lead to bloated class and makes the HTML look more complicated. But I never worked out how to structure CSS. So tailwind always felt simpler to me.

I probably have a bunch of duplicated styles and can simplify what I have, as again I am no CSS expert nor frontend expert. But we can look at that if we feel the frontend is slow to load etc.

DaisyUI

I am using this component library on top of TailwindCSS, which provides us with a bunch of components and themes we can use out of the box. Straightforward to style and tweak/change. I like it again, backend developer doing frontend so perhaps for more complicated apps, you want your own design system and creating your own components is better. But again, I really like how easy it makes frontend development feel for me.

HTMX

The frontend is built using HTMX, as a simple library, where we drive most of our state from the backend. The server returns HTML (vs JSON) and then we tell it where to replace. Look at this HTMX request. When the form is submitted, we send a POST request to the /feedback endpoint the body is the input fields as JSON. (json-enc extension converts it to JSON for us). Then the target means the HTML returned replaces the outer HTML feedback_list

<form
    hx-post="/feedback"
    hx-target="#feedback_list"
    hx-swap="outerHTML"
    hx-ext="json-enc"
    class="space-y-6"
>

AlpineJS

I combined HTMX with AlpineJS, as some actions you don’t always want to go to the server. Like opening a modal, or accordion. I don’t use it a lot and maybe could refactor my site without it. But for now, it does help make things a bit simpler. Especially with Dynamic HTMX queries, which cannot be statically generated on the backend when we render the HTML template. See an example here: https://haseebmajid.dev/posts/2025-04-29-til-set-dynamic-url-with-htmx-and-alpinejs/

Backend

Go

I moved from Python to Go about 3 years ago and honestly haven’t looked back. I really liked statically typed languages. Again, each to their own, but I think having typed data just makes your life so much easier. I also really like the smaller, better devex around Go. Fast to compile. Compiles to single static binary. Easier to put into a scratch Docker image. Simple dependency management, go mod. The CLI tool has a test runner (go test).

I really like the simplicity of Go, the code is pretty easy to read and see what is going on. I have tried to avoid using frameworks like Gin, or Gorilla. In the end, I did use Fuego, so I could generate an Open API specification.

I started writing raw SQL with sqlc, so I know exactly what the query will do vs guessing with an ORM. I loved using ORMs and frameworks like Flask or FastAPI in Python but have completely reversed my opinion in Go.

-- name: AddUser :one
insert into users (email) values ($1) returning *;

-- name: AddOrganization :one
insert into organizations (display_name, slug) values ($1, $2) returning *;

Then we can generate the SQL code by running sqlc generate which generates go code. We are going to use pgx as the underlying driver.

I am using the common 3 layer structure, controller (return HTML) -> service layer (business logic) -> store layer (DB).

Postgres

I remember I used to really like experimenting with different technologies like MongoDB. But these days boring is sexy for me. Like this entire stack, keep it simple, stupid. Unless you have a good reason, just use Postgres. It works there is a lot of tooling around it. For some instances, storing JSON and querying JSON, it outperforms MongoDB.

DevEx

A few points on the DevEx part, I really like Gitlab CI, I self-host my own runners. So speed/running out of minutes is not an issue. I am just very familiar with it. I use it alongside go-task (Taskfiles), which I found simpler than make.

Finally, if you know me, I always love to mention Nix, the project is set up to use Nix dev shells for all the non go dependencies, and we then have a really similar dev env and CI env. See more: https://www.youtube.com/watch?v=bdGfn_ihHO

That’s about it! That is my high-level experience and reason for going with this tech stack for building a SaaS. I may well go into more details about the platform I choose to help with authentication and how I intend to do authorization but for now, this is a good starting point.

Background

In my app, I show the user 25 feedbacks per page, and they can delete them which opens a modal to confirm the action. If the user presses the delete button in the modal I want to send a HTTP DELETE request to an endpoint like /feedback/{id}, but the ID is dynamic, as we are using one modal for all the feedbacks vs having one modal per one feedback.

I am using HTMX, generated using templ and using AlpineJS for some frontend interactivity, where it doesn’t make sense to send a request back to the server.

Solution

The solution is relatively easily in the end

We have a button like this which triggers the modal to open, this is rendered in templ via Go. Hence the fmt.Sprintf function. Here we are setting a variable which will be used by AlpineJS.

<button
    class="btn btn-ghost btn-xs text-neutral"
    @click={ fmt.Sprintf("currentItemId = '%s'; document.getElementById('delete-modal').showModal()", item.ID) }
    aria-label="Delete Feedback"
>
    <i class="text-lg hgi hgi-solid hgi-delete-02"></i>
</button>

In one of the parent div make sure we set the x-data attribute, which matches the same variable we set on the @click.

<div class="" x-data="{ currentItemId: '' }">

Finally here is a simplified version of the button in the modal when pressed will send the delete request. The key line is x-effect="currentItemId;htmx.process($el)", we need HTMX to reevaluate the hx-delete attribute. Else the request will go to /feedback/ without the ID.

<button
    x-bind:hx-delete="'/feedback/' + currentItemId"
    x-effect="currentItemId;htmx.process($el)"
    hx-target="#feedback_list"
    hx-swap="outerHTML"
>
    Delete
</button>

That’s it, now you can set the endpoint dynamically, generally speaking I don’t need to use this pattern much. As most of the time this can be set when we render the template as they are usually static.

Appendix

• Github: https://github.com/mvolkmann/htmx-examples/blob/main/dynamic-endpoint/public/index.html
• Reddit Post: https://old.reddit.com/r/htmx/comments/1fyaw8r/htmx_and_alpinejs_dynamic_data/

Where my keybinding looked like this:

vim.keymap.set("n", "<leader>ff", function()
    builtin.find_files({ hidden = true, follow = true })
end, { desc = "Find all files" })

This was because I was ignoring the .env* paths in my gitignore, I could tell telescope to not follow the gitignore. But I would get a lot more junk when searching in Telescope. I just wanted to see certain patterns but still mostly respect the gitignore file. You can do the following:

#  create a ~/.ignore file
nvim ~/.ignore

# Mine looks like this
!.env.local
!*/.env.local
!.env.test
!*/.env.test

Now in Telescope the .env.local and .env.test files are searchable. But still ignored by git I don’t want to commit them as they contain secrets.

This of course assumes you are using ripgrep to do the search, in my config I have the following:

vimgrep_arguments = {
    "rg",
    "-L",
    "--color=never",
    "--no-heading",
    "--with-filename",
    "--line-number",
    "--column",
    "--smart-case",
    "--fixed-strings",
    },

GitHub Issue: https://github.com/LunarVim/LunarVim/discussions/3770#discussioncomment-11523524

Again got really busy with some personal stuff, and stuff at work so didn’t really have much motivation to work on this project. But I have been forcing myself to code, so at least make some progeres.

I did the following:

• Worked out we can use row level security in Postgres for better authorization
• Added lots more tests
• Edit Feedback
  • Dynamic URL using Alpine
• Figure out duplication bug
• Filter on search
• More filter options

Next Week

Next week I want to;

• Tidy up the UI for main feedback page
• Better error modals
• Implement RLS in Postgres

Some stuff kept me busy so I couldn’t really work on my project work.

I did the following:

• Added tests
  • E2E with new skeleton
  • How to debug E2E tests with delve (i.e. the server running separately)
• Fixed a bunch of TODOs in the code base
• Delete feedback

However I got a busy with other random pieces of work that come up that kept me busy. Hopefully this week will be more productive.

Next Week

Next week I want to;

• Figure out duplication bug
• Filter on search
• More filter options

In my post last month I thought I had fixed this issue but turns out I did not. The actual fix to stop getting this error:

5108: Error executing lua [string "v:lua"]:1: attempt to call global 'dropbar' (a nil value)
stack traceback:
        [string "v:lua"]:1: in main chunk

bat /home/haseeb/.local/share/nixCats-nvim/sessions/%2Fhome%2Fhaseeb%2Fprojects%2Fvoxicle.vim | rg dropbar
setlocal winbar=%{%v:lua.dropbar()%}
setlocal winbar=%{%v:lua.dropbar()%}
setlocal winbar=%{%v:lua.dropbar()%}

We want the winbar to nil. The fix that worked for me was this:

vim.o.sessionoptions = "blank,buffers,curdir,folds,help,tabpages,winsize,winpos,terminal,localoptions"

require("auto-session").setup({
	pre_save_cmds = {
		function()
			vim.cmd([[
                noautocmd windo set winbar=
                noautocmd windo setlocal winbar=
            ]])
		end,
	},
})

I did the following:

• Finish core feedback page
  • Add new feedback
  • upvote
  • display as list or grid
• Stretch
  • try to implement basic RBAC (more of a PoC)

However I got a busy with other random pieces of work that come up that kept me busy. Hopefully this week will be more productive.

Next Week

Next week I want to;

• Finish core feedback page
  • search
  • display as list or grid
  • email updates when a feature has been completed
  • more filter options
• Stretch
  • public/private views

Carry on working on the core feature set and make it so we can share with other people.

On my list of tasks I had the following:

• Fix auth refresh token flow not fully working
• Add span information to the auth middleware
• Simplify templ with pop drilling
• Update project name

And managed to do all of them, even starting to work the core feedback part of the application i.e. allowing users to actually add feedback to the project. I rebranded the app from Go Feedback to Voxicle (which means voice and cycle).

Link to new URL: https://voxicle.app

Next Week

Next week I want to;

• Finish core feedback page
  • Add new feedback
  • upvote
  • search
  • display as list or grid
  • email updates when a feature has been completed
• Stretch
  • try to implement basic RBAC (more of a PoC)
  • public/private views

Now onto the core features of the app, that users actually want to use. We can actually then start to ship the app and share with some early users and get some feedback hopefully.

I recently moved to dropbar from barbecue as it has been archived and kept getting a weird error for buffer open when I would reopen Neovim. I use the auto-session plugin, which loads back the previous state of NixVim when I last exited in that folder, i.e. open buffers.

E5108: Error executing lua [string "v:lua"]:1: attempt to call global 'dropbar' (a nil value)
stack traceback:
        [string "v:lua"]:1: in main chunk

I noticed though I would only get this error the second time I would open Neovim, which then made think maybe it was an issue with auto-session. So I looked at the serialised file it generates so it knows what to load when we open Neovim again. Which I found at:

nvim /home/haseeb/.local/share/nvim/sessions/%2Fhome%2Fhaseeb%2Fprojects%2Fvoxicle.vim

One line in there looked like this:

setlocal winbar=%{%v:lua.dropbar()%}

So I removed this line by updating my config:

require("auto-session").setup({
	pre_save_cmds = {
		function()
			vim.opt.winbar = nil -- Clear winbar before saving session
		end,
	},
})

This stopped the error from occurring, as there is no winbar line now. I am not a 100% what was happening, but it seems it was running this line before dropbar had loaded. I am using nixCats. Anyway, that’s it! That should resolve the issues.

I decided to use wristband to the tenant and then organization on my side of the app. I am not fully happy with it. During sign up the user creates a tenant but that might be confusing to the customer vs telling them its an organization. But it does mean a new user is created and tenant on both wristband side and in the service database.

Then I moved onto working on the subscription logic with paddle. Updated the pricing page to pull in data from the backend when populating the page. Also integrating the overlay checkout, which is the simplest way to integrate paddle with my app. I cannot style it as much as the inline one, but it involves writing less JS. So I will use that for now. I am finishing off the subscription webhook logic, to create the data on our side.

Next week

Next week I want to;

• Fix auth refresh token flow not fully working
• Add span information to the auth middleware
• Simplify templ with pop drilling
• Update project name

Go Feedback can be confused with the Go programming language. I spoke to the Go team and they said I could either change the mascot. or the name. I wasn’t super fond of the name much so will look to rebrand and update everywhere its called Go Feedback.

I finished off the auth flow this week, decided to move over to using the wristband UI instead of using my own components. It ended up being a lot of code which was nice to actually delete and I think the wristband setup is pretty nice and slick. I had to adjust slightly how I will create users in my own DB but it wasn’t a big deal.

I also migrated some of my UI to use the DaisyUI library, which should simplify the amount of CSS I have to manage on my own.

I also started the onboarding flow, after the user has signed up where they create a new organization. Which should be finished early next week.

Last year, I worked on two main side projects:

• OptiNix: CLI tool to easily find nix options.
• Banter Bus: My third attempt at building a browser based multi-player game.

Whilst Banter Bus is not fully done, I got it to an almost working state and at some point will go back and fix a bunch of the bugs and add some new features.

However, I finally decided I wanted to try my hand at building something that I could try to make some money from. Whilst also learning more about business, product design etc. How can I launch an actual product vs building something? Purely for fun.

So I decided to build Go Feedback, a tool which makes it easier to collect user feedback. For once, it’s also not open source, i.e. anyone can view my code (for now). Which is not something I’ve really done.

Either way, my thinking was, I wanted to build something and just learn. If nothing else, I can likely re-use the existing code I write. Such as the auth, subscription logic or even the structure of the landing page.

Funnily enough, at the beginning of the year, I really wanted to dive into game dev. But gave myself one month to finish Banter Bus (end of Jan). In that time, my passion of game dev died down, which is probably proved my heart wasn’t in it.

Being a backend developer by working on this “micro-saas” there is a lot I can learn from building my own app vs making a game which I cannot really incorporate in my day-to-day job.

Week 1

The first week I build out the landing page, I am great at frontend dev. I decided to use HTMX, alpinejs and tailwindcss. I ended up using tailwindai to help create the page. I also ended up choosing to use a theme similar to the Daisy UI cupcake theme.

I put down all the big features/ideas I had that businesses might find useful and created mock-ups for them again mostly using AI to help me. Due to inexperience in front-end development, and to be honest, currently my lack of interest to learn it properly.

I added a fake door as a waitlist to gauge interest, which currently only me and my friends have used.

Week 2

This week I spent mostly building out the auth part, i.e. login, signup and logout. I wanted to try to use the magic link email flow. To make it as easy as possible for the user to sign up without needing a password. They just need click a link in an email they are sent.

I was originally going to use clerk, but had issues (could just have been me) integrating cleanly with my backend and ended up moving over to wristband.dev. Whilst I have experience maintaining auth services, I haven’t really ever had to build it out myself for a web app. So it was a good learning experience for me.

I also learnt about other random things like CSRF and how to avoid that.

Building in public

I want to try to build in public, to collect feedback and to keep myself honest. It would also be a nice diary to track my own progress. I don’t really want to use Twitter, which lots of the “indie hacker” builder community seem to use. So I am going to try to use:

• peerlist
• bluesky

And maintain weekly blog posts, maybe even YouTube or TikTok videos to show off the progress. Some weeks there will likely be nothing to really show off.

Debugging Steps

This occurred off and on over the course of a few weeks. My font setup was primarily done using stylix and a bit of NixOS option config.

I noticed this only seemed to happen when the CSS on the page include a font-family like so “monospace” i.e. the monospace font in quotes. But without quotes, the font would render fine.

I made a few posts to ask for help, as I was confused, why this was happening, and found a similar issue, you can find here: https://old.reddit.com/r/NixOS/comments/1fha5hl/firefox_font_problem/.

Anyway, I didn’t get any reply, so I decided to use fc-match to see what font my system was returning.

blog on  2025-01-20-how-to-fix-firefox-rendering-emoji-font-black-bold-numbers-issue [$?] via 🐹 v1.22.10 via ❄  impure (nix-shell-env) took 19s
❯ fc-match monospace
MonoLisa-Regular.ttf: "MonoLisa" "Regular"

blog on  2025-01-20-how-to-fix-firefox-rendering-emoji-font-black-bold-numbers-issue [$?] via 🐹 v1.22.10 via ❄  impure (nix-shell-env)
❯ fc-match '"monospace"'
NotoSans[wdth,wght].ttf: "Noto Sans" "Regular"

I thought I’d found the smoking gun, ohh it was trying to use the San font to render it. I asked someone to share their working config from an Ubuntu machine and theirs also seemed to be similar to mine.

╰─ fc-match "monospace"
DejaVuSansMono.ttf: "DejaVu Sans Mono" "Book"

╰─ fc-match '"monospace"'
DejaVuSans.ttf: "DejaVu Sans" "Book"

Then whilst looking up stuff specific to how Firefox renders fonts, I realised in the DevTools there is a page for fonts, it’s just a bit hidden. I mean, it makes sense, of course there is.

So looking at this I realised it wasn’t bold text it was rendering, but it was falling back and rendering the numbers as emojis.

I then had a closer look at my font config in Nix and realised it wasn’t doing what I thought it was doing.

<?xml version="1.0"?>
<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
<fontconfig>
    <alias binding="weak">
        <family>monospace</family>
        <prefer>
            <family>emoji</family>
        </prefer>
    </alias>
    <alias binding="weak">
        <family>sans-serif</family>
        <prefer>
            <family>emoji</family>
        </prefer>
    </alias>
    <alias binding="weak">
        <family>serif</family>
        <prefer>
            <family>emoji</family>
        </prefer>
    </alias>
</fontconfig>

What I had done by copying and pasting some config I didn’t fully understand (tut tut tut) is if the character was available in the emoji font use that instead, i.e. the numbers or certain symbols like TM. So after deleting that config and reloading Firefox, it was rendering properly as expected.

That’s it! As expected, remember, to make sure you understand what your code is doing. I thought it was allowing emojis to be rendered with the monospace font, not replacing it or preferring it.

Relevant commit resolving the above issue: https://gitlab.com/hmajid2301/nixicle/-/commit/3168db8df339d79e838c98f8675eb21a23452d4e

For the last month or so, the audio on my Desktop was broken in the sense I had to run these three commands to make it work

pipewire &
wireplumber &
pipewire-pulse

Now, normally I hibernate my computer, so I didn’t really have to do this more than once or twice. However, it was very annoying either way to remember to know how to do it.

My nix config looked like this:

{
    services.pulseaudio.enable = false;
    security.rtkit.enable = true;
    services.pipewire = {
      enable = true;
      alsa.enable = true;
      alsa.support32Bit = true;
      pulse.enable = true;
      wireplumber.enable = true;
      jack.enable = true;
    };
}

I did notice this:

❯ eza -al /etc/systemd/system/wireplumber.service
lrwxrwxrwx - root  1 Jan  1970 /etc/systemd/system/wireplumber.service -> /dev/null

But this seemed to be a red herring.

Which seemed to match what was in the NixOS wiki(s). Then after a bit of help from ChatGPT, it suggested taking a look at the systemd configs in my config folder.

❯ ls -l ~/.config/systemd/user/
lrwxrwxrwx - haseeb  8 Aug  2024 pipewire-pulse.service -> /nix/store/dhn51w2km4fyf9ivi00rz03qs8q4mpng-pipewire-1.2.1/share/systemd/user/pipewire-pulse.service
lrwxrwxrwx - haseeb  8 Aug  2024 pipewire-pulse.socket -> /nix/store/dhn51w2km4fyf9ivi00rz03qs8q4mpng-pipewire-1.2.1/share/systemd/user/pipewire-pulse.socket
lrwxrwxrwx - haseeb  8 Aug  2024 pipewire-session-manager.service -> /home/haseeb/.config/systemd/user/wireplumber.service
lrwxrwxrwx - haseeb  8 Aug  2024 pipewire.service -> /nix/store/dhn51w2km4fyf9ivi00rz03qs8q4mpng-pipewire-1.2.1/share/systemd/user/pipewire.service
drwxr-xr-x - haseeb  8 Aug  2024 pipewire.service.wants
lrwxrwxrwx - haseeb  8 Aug  2024 pipewire.socket -> /nix/store/dhn51w2km4fyf9ivi00rz03qs8q4mpng-pipewire-1.2.1/share/systemd/user/pipewire.socket
lrwxrwxrwx - haseeb  8 Aug  2024 wireplumber.service -> /nix/store/36h5pwq11jj1pzf6hgbwnfvk9xj4my2p-wireplumber-0.5.5/share/systemd/user/wireplumber.service

You cannot see it at here but the symlinks themselves were broken, so after deleting all of them manually (they were red in my terminal):

trash ~/.config/systemd/user/pipewire-session-manager.service

I re-ran my Nix rebuild config command nh os switch.

Then enabled them like so systemctl enable --user wireplumber.service and restarted a few as they failed the first time due to missing a file which, I assume, was created later, and now my audio works without me needing to do anything manually. Which is the way it should’ve always been, but alas, that’s what happens when you are tweaking your setup.

That’s It! I hoped it helped.

I am still using Nix and NixOS, I am still using Neovim. I moved onto from tmux to zellij mainly because I just like the floating terminal it provides. But other than that, it’s basically the same as the end of last year.

Split Keyboard

This time last year, I had just bought a split keyboard. Now after using it for a year, I am typing even quicker than I was with a normal keyboarding on my monkey type setting. I was getting about 65 WPM now I am at 75 WPM.

For me, it’s been really great, in particular around accessing those difficult to reach symbols we need for programming or vim. Think shift, alt, ^ etc. If you can afford to get one I would give it a try. Also, as an aside, people think it looks “cool” and you’ll get many questions at work.

OptiNix

I finish my CLI tool OptiNix. Which was one made to practice some more Golang in my spare time, and build a tool I could actually use. Find Nix options from the CLI. There are a few issues people have raised with it, which I need to go back and tidy up. But it was a good side project which probably dragged on for too long.

It was nice to build a CLI, which I’ve never done before and the bubble tea library made it super easy to create an easy to use (T)UI. So I could focus on writing the business logic and not worry how to present my app on the terminal. As I say there are plenty of optimisations I can still make and should try later this year to tidy it up.

Home Lab

I also got way more into home labbing, and self-hosting lots of my own services. The two most useful being

• GitLab Runner (Especially 400 minute limit now)
• Jellyfin Media Server (used by family and friends)
  • Identity management; managed by Authentik
  • Setup to use a local NAS
• k3s
  • Kubernetes cluster for learning
  • deployed banter bus my side project here

It’s been a great way to learn more about infrastructure, and in particular about Kubernetes and flux CD (git ops). I have deployed my own side project, Banter Bus, there as well. Alongside looking how the flux image automation works. To automatically pick up changes for banter bus.

Most recently, I have been looking at learning more about monitoring with Prometheus, Grafana stack and also otel. Exporting metrics, traces from my services but also pulling metrics from the pods themselves.

One big change I did make was trying to manage the entire thing with k3s and moving to managing apps on bare metal with NixOS, where possible. Also keeping key stateful infrastructure like Redis and Postgres running on the bare metal rather than Kubernetes. Which it wasn’t really intended to (easily), I know there are ways you can do it.

But essentially, my main issue was how much config I needed to just deploy any app. Where in NixOS it was often maybe 100 lines of code. You can see my NixOS home lab config here and k3s config here.

Currently, I am only running it all on a single server basically and a few key apps on a tiny s100 from miniforum. Low powered PC. Which is always on and runs apps like:

• Gotify for notifications
• Uptime Kuma for tracking the uptime of my apps
• Home Assistant mainly to turn off and on my home lab, so I don’t waste electricity

And finally, I have a small VPS on hetzner to make it easier for other people to access Jellyfin and I don’t have issues streaming video over say a Cloudflare tunnel.

In the new year, I want to consolidate my learning into a nice document, maybe a material mkdocs site. Though, the boundary of what goes there vs my second brain vs my blog is always a bit confusing personally for myself. In theory, I could make a blog post for everything I learn, currently it’s a messy document in the nixicle repo above. At least something down on paper.

Banter Bus

Main big main side project of the year, I started YouTube series about the development of this web app. Which I Unfortunately, didn’t really keep up, but will kick-start in the new year. But essentially this is my 3rd crack at making a multiplayer browser game. Similar to say Jack Box, or Skribl.io etc.

I have got a lot further with this version because one I have my learnings from the previous versions and also The main part I would lose motivation is writing frontend code, especially JS/TS. This time I’ve tried to keep it to a minimum. Basic stack for the frontend, using HTMX, Alpine where I need interactivity and tailwind CSS. The HTML is returned from the server and generate using templ.

For a backend developer like myself this really simplifies everything and makes it much easier for me to focus on the business logic and state managed almost entirely in the backend and I don’t have to worry about how to do that in the frontend, which I don’t have much experience doing. Note this is my own opinion, not saying this is the only way to create web apps. I just noticed I would often lose motivation in my own side projects when I had to work on the frontend.

Which is the part you sometimes need to make neat and tidy to convince people to use your app. Anyway I’ve made some good progress this year. I wanted to try to get something out by the end of the year, didn’t manage. I kept getting distracted by random things like improving CI, learning more about Kubernetes deployment, telemetry (otel) and other little things. I am hoping to have a mostly working version by the end of January which I can release and share with friends and family.

I think it would really be cool to have a multiplayer game that I made that I play with my friends. Overall, I have a lot of fun making. The main thing I want to focus on is working on the unhappy path side of the code, as it’s pretty fragile at the moment.

• Link to repo here
• Link to app here

Conference Talks

This year I was lucky enough to do two conferences talks, basically the same talk about using Nix to create development environments in Go.

I wrote some tips here that I’ve learnt speaking at conferences and other people have told me.

But essentially, it’s a great way to get a free ticket to conference. Which is a great way to network with people, you’d never normally interact with. But more importantly, a great way I found to force me to learn a topic way deeper than I normally would. You know what they say, the best way to learn something deeply is to teach it to others. If you can explain it clearly, it shows you must know the topic pretty well.

YouTube

Link to my channel

I also started a YouTube channel this year, it started off well, but my last few videos didn’t get very many views. I want to keep up the YouTube channel but focusing on really improving the quality of my videos and finding my own style of video. The main thing I would like to improve is the audio quality. I think there are many things I’ve learnt making Banter Bus and would love to share (a few videos I have already done), to do give people ideas and show how I set up things like:

• templ, templating
• i18n
• Kubernetes deployments
• flux image automation

But currently I am losing motivation towards the end of the year, didn’t really keep up the dev vlogs for Banter Bus like I wanted to. I need to pivot a bit in the channel.

I think, similarly to this blog, work out what do I want from it. How can I better advertise the channel, without being? Obnoxious.

Neovim back to Lua

As a smaller point, I was managing my nvim configuration in Nix using NixVim, which is a great project if you want just manage everything in Nix. I think towards the end of the year I decided for config that’s very complicated i.e. many files, I would prefer to manage it in the native language, i.e. Lua.

So I swapped my config over to use nixcats. Which allow us to do this. Still manage dep using Nix but config via Lua, while still having the ability to pass variables from Nix to Lua.

I found learning the abstraction on top Lua, i.e. the nix, way annoying. I think it’s fine for simple config. But my Neovim config being multiple files and having Lua stringified, losing out on the LSP. I decided to have a crack at keeping in Lua and would make it easier to follow tutorials. I could also do lazy loading, which I’m not sure you can do it in NixVim.

Aims for this year

• Release a working version of Banter Bus by end of January
• Try to release say 20ish YouTube videos next year
  • Find my own styles
  • With excellent audio quality
    • Fewer umms and arr
  • Useful and catchy titles
  • Advertise the channel to improve get more views
    • I would to average say 1k views per video
• Look at making some money from my side projects
  • I was thinking about Banter Bus, but I don’t really know how
    • Besides maybe a donate button
    • Again, I want to provide a high value for the customer
  • If it was easy, everyone would do it right?

P.S. I also got around to finally playing baldurs gate and finally completing it. I didn’t really enjoy the combat the first time around. Even though I was such a big of Larian’s previous game divinity original sin 2. But eventually I gave it another go and had a lot more fun with it.

What is a terminal multiplexer?

Zellij is a terminal multiplexer think like tmux or screen. It another one of those projects written in rust. Which seems pretty popular for creating similar tools to existing ones but usually faster.

It allows us to split up our terminal into multiple panes or sections, then navigate between them. Now if you are using a tiling window manager you could also just create 4 terminals. But one other nice feature that tmux and Zellij let you do it they have a server client architecture so you can close your terminal connecting to a session. Then open a new one say an hour later and connect to your session, and it will be in the same state you left it. This also works well if you accidentally closed your terminal that was doing some work.

These tools also allow us to have tabs that we can navigate between. In the image below you can see a Zellij session which has two tabs and the current tab is split into two panes horizontally.

Why Zellij?

I was using tmux until earlier this year. The main reason I moved to Zellij was basically one main feature, floating panes. I can press a key combination and then voilà get a floating terminal I can run commands in like, linting my code or running tests and then when it’s done, I can hide it.

Now you can do this in tmux with plugins, though I couldn’t make it work (floax). You can also do this within Neovim, but the nice thing about Zellij is it stays for the duration that the tab you are in the open. Some terminals also provide the ability to split into panes and tabs, i.e. Wezterm.

There are two main reasons I want to use Zellij; the floating panes and the client server architecture. Which makes it much easier for me to jump between my projects.

How I configured it?

As will be no surprise to anyone following me, I have set it up using Nix; You can find my full config here.

{
  pkgs,
  lib,
  config,
  ...
}:
with lib;
with lib.nixicle; let
  cfg = config.cli.multiplexers.zellij;
  inherit (config.lib.stylix) colors;

  sesh = pkgs.writeScriptBin "sesh" ''
    // ...
  '';
in {
  options.cli.multiplexers.zellij = with types; {
    enable = mkBoolOpt false "enable zellij multiplexer";
  };

  config = mkIf cfg.enable {
    home.packages = [
      sesh
    ];

    xdg.configFile."zellij/config.kdl".source = ./config.kdl;
    xdg.configFile."zellij/layouts/default.kdl".text = ''
        // ...
    '';

    programs.zellij = {
      enable = true;
    };
  };
}

I’ve removed some parts of my config to make it easier to read. But essentially, we set up some config files and enable Zellij. I also have a custom script sesh which allows me to jump between my different projects. Easily! Where I basically count as a folder/git repo as a project.

Sesh

As I said, I have a script called sesh, which I use to open a folder in a Zellij session. It combines Zoxide (better cd tool) to fuzzy find (zoxide uses FZF I believe) any directory we have previously navigated to with Zoxide.

Once we pick a folder we will load into a Zellij session.

  sesh = pkgs.writeScriptBin "sesh" ''
    #! /usr/bin/env sh

    # Taken from https://github.com/zellij-org/zellij/issues/884#issuecomment-1851136980
    # select a directory using zoxide
    ZOXIDE_RESULT=$(zoxide query --interactive)
    # checks whether a directory has been selected
    if [[ -z "$ZOXIDE_RESULT" ]]; then
    	# if there was no directory, select returns without executing
    	exit 0
    fi
    # extracts the directory name from the absolute path
    SESSION_TITLE=$(echo "$ZOXIDE_RESULT" | sed 's#.*/##')

    # get the list of sessions
    SESSION_LIST=$(zellij list-sessions -n | awk '{print $1}')

    # checks if SESSION_TITLE is in the session list
    if echo "$SESSION_LIST" | grep -q "^$SESSION_TITLE$"; then
    	# if so, attach to existing session
    	zellij attach "$SESSION_TITLE"
    else
    	# if not, create a new session
    	echo "Creating new session $SESSION_TITLE and CD $ZOXIDE_RESULT"
    	cd $ZOXIDE_RESULT
    	zellij attach -c "$SESSION_TITLE"
    fi
  '';

This is not as flexible as the session switcher I had in tmux as I cannot swap using the same sesh script. I need to use the built-in session switcher from Zellij. I don’t really like the asymmetry, but it works fine. Furthermore, I usually end up opening a new terminal and run sesh there, rather than remembering my key bind in zellij swap sessions.

Here you can see the script, showing us the FZF fuzzy searcher alongside the Zoxide results.

Key Bindings

Another problem Zellij faces is the default key binding use Ctrl a lot and clash with my Neovim bindings. So I ended up swapping the main key to be Alt, which doesn’t seem to clash with anything else in my system.

Again, not quite as convenient as what I had in tmux, but it is mostly good enough, and I’ve built enough muscle memory. To achieve this, I updated my config.kdl file such that it looks this (I’m pretty sure I just copied someone else’s but cannot find who, sorry helpful person.).

Zellij is modal, so we have different modes, i.e. pane mode, tab mode, search mode.

Find my full config.kdl here.

theme "catppuccin-mocha"
pane_frames false
simplified_ui true
default_shell "fish"
copy_on_select true

// If you'd like to override the default keybindings completely, be sure to change "keybinds" to "keybinds clear-defaults=true"
keybinds {
    unbind "Ctrl q"
    normal {
        // uncomment this and adjust key if using copy_on_select=false
        // bind "Alt c" { Copy; }
    }
    locked clear-defaults=true {
        bind "Alt u" { SwitchToMode "Normal"; }
    }

    resize clear-defaults=true {
        bind "Alt r" "Esc" "Ctrl {" { SwitchToMode "Normal"; }

        bind "h" "Left" { Resize "Increase Left"; }
        bind "j" "Down" { Resize "Increase Down"; }
        bind "k" "Up" { Resize "Increase Up"; }
        bind "l" "Right" { Resize "Increase Right"; }
        bind "H" { Resize "Decrease Left"; }
        bind "J" { Resize "Decrease Down"; }
        bind "K" { Resize "Decrease Up"; }
        bind "L" { Resize "Decrease Right"; }
        bind "=" "+" { Resize "Increase"; }
        bind "-" { Resize "Decrease"; }
    }

    // ...
}

So I use alt + t for example to go into tab mode, and then we could press n to create a new tab. Equally, alt + p then - will create a horizontal pane split.

One other super useful key binding I use a lot is alt + f and e which opens the panes contents in my editor i.e. Neovim. Which I can then use to copy data, open links etc. Again there are tmux plugins which let use navigate the pane itself, but I like that I can just use Neovim as I normally would.

Neovim

In tmux, I had a plugin which allowed me to navigate panes using CTRL, but I haven’t setup anything similar in zellij. For now, I am happy navigating using Alt between the panes whenever I need to, that which is not frequent.

Status Bar

You can find some nice examples here for some inspiration of possible status bars.

The final part of the config is using the zellij status bar plugin. Which I wanted to look more like tmux catppuccin theme and that basically what this does. We do some string interpolation with Nix and stylix for the base16 colours. So I could change them in one place and it would do it across my config.

  default_tab_template {
      pane size=2 borderless=true {
          plugin location="file://${pkgs.zjstatus}/bin/zjstatus.wasm" {
              format_left   "{mode}#[bg=#${colors.base00}] {tabs}"
              format_center ""
              format_right  "#[bg=#${colors.base00},fg=#${colors.base0D}]#[bg=#${colors.base0D},fg=#${colors.base01},bold] #[bg=#${colors.base02},fg=#${colors.base05},bold] {session} #[bg=#${colors.base03},fg=#${colors.base05},bold]"
              format_space  ""
              format_hide_on_overlength "true"
              format_precedence "crl"

              border_enabled  "false"
              border_char     "─"
              border_format   "#[fg=#6C7086]{char}"
              border_position "top"

              mode_normal        "#[bg=#${colors.base0B},fg=#${colors.base02},bold] NORMAL#[bg=#${colors.base03},fg=#${colors.base0B}]█"
              mode_locked        "#[bg=#${colors.base04},fg=#${colors.base02},bold] LOCKED #[bg=#${colors.base03},fg=#${colors.base04}]█"
              mode_resize        "#[bg=#${colors.base08},fg=#${colors.base02},bold] RESIZE#[bg=#${colors.base03},fg=#${colors.base08}]█"
              mode_pane          "#[bg=#${colors.base0D},fg=#${colors.base02},bold] PANE#[bg=#${colors.base03},fg=#${colors.base0D}]█"
              mode_tab           "#[bg=#${colors.base07},fg=#${colors.base02},bold] TAB#[bg=#${colors.base03},fg=#${colors.base07}]█"
              mode_scroll        "#[bg=#${colors.base0A},fg=#${colors.base02},bold] SCROLL#[bg=#${colors.base03},fg=#${colors.base0A}]█"
              mode_enter_search  "#[bg=#${colors.base0D},fg=#${colors.base02},bold] ENT-SEARCH#[bg=#${colors.base03},fg=#${colors.base0D}]█"
              mode_search        "#[bg=#${colors.base0D},fg=#${colors.base02},bold] SEARCHARCH#[bg=#${colors.base03},fg=#${colors.base0D}]█"
              mode_rename_tab    "#[bg=#${colors.base07},fg=#${colors.base02},bold] RENAME-TAB#[bg=#${colors.base03},fg=#${colors.base07}]█"
              mode_rename_pane   "#[bg=#${colors.base0D},fg=#${colors.base02},bold] RENAME-PANE#[bg=#${colors.base03},fg=#${colors.base0D}]█"
              mode_session       "#[bg=#${colors.base0E},fg=#${colors.base02},bold] SESSION#[bg=#${colors.base03},fg=#${colors.base0E}]█"
              mode_move          "#[bg=#${colors.base0F},fg=#${colors.base02},bold] MOVE#[bg=#${colors.base03},fg=#${colors.base0F}]█"
              mode_prompt        "#[bg=#${colors.base0D},fg=#${colors.base02},bold] PROMPT#[bg=#${colors.base03},fg=#${colors.base0D}]█"
              mode_tmux          "#[bg=#${colors.base09},fg=#${colors.base02},bold] TMUX#[bg=#${colors.base03},fg=#${colors.base09}]█"

              // formatting for inactive tabs
              tab_normal              "#[bg=#${colors.base03},fg=#${colors.base0D}]█#[bg=#${colors.base0D},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{floating_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"
              tab_normal_fullscreen   "#[bg=#${colors.base03},fg=#${colors.base0D}]█#[bg=#${colors.base0D},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{fullscreen_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"
              tab_normal_sync         "#[bg=#${colors.base03},fg=#${colors.base0D}]█#[bg=#${colors.base0D},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{sync_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"

              // formatting for the current active tab
              tab_active              "#[bg=#${colors.base03},fg=#${colors.base li09}]█#[bg=#${colors.base09},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{floating_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"
              tab_active_fullscreen   "#[bg=#${colors.base03},fg=#${colors.base09}]█#[bg=#${colors.base09},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{fullscreen_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"
              tab_active_sync         "#[bg=#${colors.base03},fg=#${colors.base09}]█#[bg=#${colors.base09},fg=#${colors.base02},bold]{index} #[bg=#${colors.base02},fg=#${colors.base05},bold] {name}{sync_indicator}#[bg=#${colors.base03},fg=#${colors.base02},bold]█"

              // separator between the tabs
              tab_separator           "#[bg=#${colors.base00}] "

              // indicators
              tab_sync_indicator       " "
              tab_fullscreen_indicator " 󰊓"
              tab_floating_indicator   " 󰹙"

              command_git_branch_command     "git rev-parse --abbrev-ref HEAD"
              command_git_branch_format      "#[fg=blue] {stdout} "
              command_git_branch_interval    "10"
              command_git_branch_rendermode  "static"

              datetime        "#[fg=#6C7086,bold] {format} "
              datetime_format "%A, %d %b %Y %H:%M"
              datetime_timezone "Europe/London"
          }
      }
      children
  }
}

Workflow

On start up of my PC, I open a terminal and run the sesh script pick a project, say banter bus. Which should in theory resurrect the session if it was alive but seems to have issues with on Nix. I usually get around this by pressing ESC but ideally, it would resurrect the session. Usually, though, It’s not super complicated. To set up most of my projects again.

I also usually hibernate my PC so I can carry on where I left off from. When working, I will often use the floating pane which I toggle using alt + p and w. Where I will run commands like task lint to lint my code. Or say task dev to start my app and view logs.

That’s it! My Zellij setup and roughly how I use it.

Recently, I was lucky enough to speak at GoLabs 2024 in Florence, which was a load of fun and a week later at the London Gophers November Meet.

This was funnily the 3rd time I had presented a very similar talk (I did Conf42 earlier this year). The topic was how we can create development environments for Golang using Nix.

I think generally speaking some of the best parts of meetups and conferences is not even the talks themselves it’s the networking. Meeting people who work at random companies you never would’ve met otherwise etc. So I really do recommend even if you don’t intend to speak, try to go to a conference or two. Especially if your company has a learning budget you can leverage.

Tips

On to some tips that I’ve learnt, or other people taught me that helped make me a better speaker. In no particular order. Remember these are all my own opinion and from my own experiences as a presenter.

Topic

The hardest part when I want to do a talk is actually coming up with the topic I would like to talk about. I generally would like to discuss a topic that I think others don’t much about and would find interesting, i.e.

• How to use docker with Python
• Pocketbase
• Nix dev envs with Go

Coming up with topic that I feel passionate about is super important, as I think shows when you speak that you really care about topic x. But it also means I have more motivation when creating the slides.

Slides

We have a tendency to put everything you want people know on the slides. This can lead to them being crowded and harder to read, too dense full of information.

One of the best bits of advice I was given, if someone can see your slides and fully understand your talk. What does the value add of you as a speaker? Very little. So, in my opinion, the slides on their own shouldn’t make sense. You are there as a speaker to then present those slides such that it makes sense.

You want to add things like diagrams to drive your point home. Likewise, you may want to put key bullet points of topics you would like to talk about.

Leave the details in the speaker notes that the audience cannot see. As not to crowd the slides. In terms of software I really like reveal.js. Which allow us to super fancy slides (as HTML page), so super portable easy to share with others. I even host them on my Hugo (this blog). Especially if you need to show code, have a look, and it is markdown-driven.

Practice

Practice, practice and more practice. More likely than not you will be nervous just before you present. To make sure you are well-prepared, to practice your presentation. Until you can almost do the talk from memory. This may sound like a lot of effort, but it will really help you make your talk seem a lot smoother on the day.

Trust me, it can be a real pain, when you have a 40-min presentation needing to practice that multiple times a week It can be actually annoying. Talking from experience here!!! But I think it just makes your talk so much better.

As I say on the day you will be nervous and even if you make a mistake it will be easier to recover as you have Practised that talk so much. Sometimes I would just do 10 mins at a time, to make it more digestible, but as the date gets closer I would practice the entire talk more often and try to time myself. As I have found I am ALWAYS slower on the day and tend to need to speed up certain parts of my talk on the day itself.

Feedback

Alongside practice, I think feedback is so important both of my conference talks got so much better because people gave me feedback. Especially my Euro Python talk about Docker, it was a lot worse than the final version I gave.

Either you can do this by presenting live to people, say over a video call with colleagues at work, or you can record yourself send it to everyone you need to. Then they can give you feedback, the more detailed the better you don’t have to agree with everything and can decide what you want to change.

Feedback is key to improving yourself and your talk!

Talk you would watch

Finally, I think what helps me is to try to design a talk I would watch myself. At the end of the day, you are the one spending time making and giving a talk. Rather than trying to work out what other people want, set out to make a talk you would watch/enjoy.

I like talks that are a bit like stories, they build up the topic over the talk. Sometimes it’s like a bit of role play, we solved problem x but now what about problem y? Of course, this doesn’t mean entirely ignoring feedback. But don’t feel the need to change your entire to talk to suit what someone else would like (generally speaking).

Rejection

Not a tip for speaking per se, but typically, you will submit your talk when a conference has a call for proposal. I have seen most conference use either callforpapers or sessionize, which makes it easier to submit the proposal as you can re-use your existing one.

But as is normal, I found you will face more rejections than conferences who accept your talk. However, that is fine it’s not to say your talk is bad. Sometimes people misunderstand what you wanted to present based on your abstract. Sometimes it doesn’t fit with the conference. Keep submitting, eventually you will get accepted, some conferences even sometimes prefer to give first time speakers a go.

There is currently a branch in home-manager we can pull into our config, which provides a convenient way to wrap these apps in nixGL rather than needing to specify say nixGLIntel kitty in our terminal or say Hyprland config (key bindings).

First, let’s import the relevant code from the branch/PR:

 imports = [
    # TODO: remove when https://github.com/nix-community/home-manager/pull/5355 gets merged:
    (builtins.fetchurl {
      url = "https://raw.githubusercontent.com/Smona/home-manager/nixgl-compat/modules/misc/nixgl.nix";
      sha256 = "01dkfr9wq3ib5hlyq9zq662mp0jl42fw3f6gd2qgdf8l8ia78j7i";
    })
  ];

Then, simply, we can do something like this:

programs = {
    kitty.package = config.lib.nixGL.wrap pkgs.kitty;
    firefox.package = config.lib.nixGL.wrap pkgs.firefox;
}