DEV Community: Kir Axanov

Android. Text-to-speech

Kir Axanov — Sun, 15 Mar 2026 09:58:49 +0000

2026.03.15

Hi!

Install apps

SherpaTTS as TTS engine itself (has basic controls for reading text)
TTS Util for more convenient TTS interface (not a TTS engine)

Also you'll need adb installed on the desktop so you can copy model files from there.

Get voice models

SherpaTTS has a list of models which you can download from HuggingFace from the app.

If that list is not enough (or returns errors, or you want to use your own model), you can sideload other models.

Choose the model from e.g. HuggingFace, then search it on the release page and download needed files (already in onnx format).

If you need to convert from Piper model see here.

Extract downloaded archive and put those files into yourModelName directory (we will copy those to the device later):

*.onnx renamed as model.onnx
tokens.txt
lang - create this file with 3-letter language code on the 1st line and model name on the 2nd

Copy voice models to device

Connect the smartphone via USB. Enable USB Debugging and choose File transfer in USB connection properties on the phone.

List connected devices and make sure you got your phone there:

adb devices

Next steps should be done one by one for each model you want to copy.

Models should be copied to /sdcard/Android/data/org.woheller69.ttsengine/files/modelDir, so run:

adb push <path-to-model-files>/ /sdcard/Android/data/org.woheller69.ttsengine/files/modelDir

You can check the files via entering a shell into Android with:

adb shell

After copying, open SherpaTTS app. It will register model files and put them where it needs. Then, you can repeat same steps to copy other models.

Use via TTS Util

Open TTS Util, go to settings and select TTS Engine (SherpaTTS) and TTS Language/Voice. Tune other settings as needed.

Bye!

NixOS. Snikket. Self-host E2EE messenger with calls

Kir Axanov — Mon, 02 Mar 2026 16:26:53 +0000

2026.03.02

Hi!

Snikket is a modern federated messenger based on good ol' XMPP. It has attachments, group chats, audio / video messages and calls with end-to-end encryption and it is Docker / Podman ready.

If you too have a NixOS server and desperately searching for a self-hosted instant messenger with E2EE, calls and a high chance to keep your sanity during configuring and deploying... then continue reading (:

DNS

First of all, you should have a domain name.

My server holds a lot of stuff, so I host Snikket on a subdomain, like chat.example.com.

Besides chat.example.com you'll also need these two A-type DNS records (naming is up to you):

groups.chat.example.com - for all things about group chats
share.chat.example.com - for files sharing

NixOS and OCI containers

To be short, OCI (Open Container Initiative) containers is what Docker has. Podman is a Docker replacement (DYOR what you should choose) and also works with OCI.

NixOS does not (yet) have a nix module for Snikket, however there is wonderful compose2nix project that turns any docker-compose.yml into nix file which you can import to your server's configuration (more about it later).

Configs

Configs tree:

<your other nixos configs>
├── nginx.nix
├── snikket.nix
├── snikket
│   ├── copy-certs-job.nix
│   ├── copy-certs.sh
│   ├── docker-compose.yml
│   ├── snikket.conf
│   └── snikket.nix
<your other nixos configs>

Where:

nginx.nix - general Nginx configuration shared between all deployed services on your server
snikket.nix - all the specific configs for Snikket, other than Docker configuration
snikket/docker-compose.yml - original Docker configuration for Snikket
snikket/snikket.conf - environment file for Snikket Docker configuration
snikket/snikket.nix - what compose2nix generated from Docker configuration
snikket/copy-certs.sh - bash script to copy certificate files from Snikket container to Nginx directory
snikket/copy-certs-job.nix - systemd timer configuration that executes said bash script daily

`nginx.nix`

{ pkgs, config, ... }:

{
  networking.firewall.allowedTCPPorts = [ 80 443 ];

  services.nginx = {
    enable = true;
    recommendedTlsSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;
    appendHttpConfig = ''
      proxy_headers_hash_max_size 1024;
      proxy_headers_hash_bucket_size 128;
    '';
    resolver.ipv6 = false;
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "admin@example.com";  # <--- Change this.
  };
}

`snikket.nix`

Look at Quick-start, Firewall ports and Advanced configuration for details.

For comments like Keep in sync with SNIKKET_DOMAIN see the snikket/snikket.conf for said env variable.

In allowedUDPPortRanges pay attention to port range, see How many ports does the TURN service need? section.

You can change client_max_body_size value in extraConfig = "client_max_body_size 104857616;"; to whatever suits you, I left the defaults.

{ lib, pkgs, config, ... }:

let
  domain = "chat.example.com";  # Keep in sync with `SNIKKET_DOMAIN`.
  groups_domain = "groups.${domain}";
  share_domain = "share.${domain}";
  port = 5443;  # Keep in sync with `SNIKKET_TWEAK_HTTPS_PORT`.
in
{
  imports = [
    ./snikket/snikket.nix
    ./snikket/copy-certs-job.nix
  ];

  networking.firewall = {
    allowedTCPPorts = [ 5222 5269 5000 3478 3479 5349 5350 ];
    allowedUDPPorts = [ 3478 3479 5349 5350 ];

    # Keep in sync with `SNIKKET_TWEAK_TURNSERVER_MIN_PORT` and `SNIKKET_TWEAK_TURNSERVER_MAX_PORT`.
    allowedUDPPortRanges = [ {from = 49152; to = 49252;} ];
  };

  services.nginx = {
    virtualHosts."${domain}" = {
      enableACME = true;
      forceSSL = true;

      # Snikket manages ACME certs.
      acmeFallbackHost = "localhost:${toString port}";

      locations."/" = {
        proxyPass = "https://localhost:${toString port}";
        extraConfig = "client_max_body_size 104857616;";  # 100MB + 16 bytes
      };
    };

    virtualHosts."${groups_domain}" = {
      enableACME = true;
      forceSSL = true;

      # Snikket manages ACME certs.
      acmeFallbackHost = "localhost:${toString port}";

      locations."/" = {
        proxyPass = "https://localhost:${toString port}";
        extraConfig = "client_max_body_size 104857616;";  # 100MB + 16 bytes
      };
    };

    virtualHosts."${share_domain}" = {
      enableACME = true;
      forceSSL = true;

      # Snikket manages ACME certs.
      acmeFallbackHost = "localhost:${toString port}";

      locations."/" = {
        proxyPass = "https://localhost:${toString port}";
        extraConfig = "client_max_body_size 104857616;";  # 100MB + 16 bytes
      };
    };
  };
}

`snikket/docker-compose.yml`

Download docker-compose.yml from Snikket.

Here's what it looks like (listing it for full coverage, I've changed nothing):

version: "3.3"

services:
  snikket_proxy:
    container_name: snikket-proxy
    image: snikket/snikket-web-proxy:stable
    env_file: snikket.conf
    network_mode: host
    volumes:
      - snikket_data:/snikket
      - acme_challenges:/var/www/html/.well-known/acme-challenge
    restart: "unless-stopped"
  snikket_certs:
    container_name: snikket-certs
    image: snikket/snikket-cert-manager:stable
    network_mode: host
    env_file: snikket.conf
    volumes:
      - snikket_data:/snikket
      - acme_challenges:/var/www/.well-known/acme-challenge
    restart: "unless-stopped"
  snikket_portal:
    container_name: snikket-portal
    image: snikket/snikket-web-portal:stable
    network_mode: host
    env_file: snikket.conf
    restart: "unless-stopped"

  snikket_server:
    container_name: snikket
    image: snikket/snikket-server:stable
    network_mode: host
    volumes:
      - snikket_data:/snikket
    env_file: snikket.conf
    restart: "unless-stopped"

volumes:
  acme_challenges:
  snikket_data:

`snikket/snikket.conf`

Be sure to keep in sync with snikket.nix.

# The primary domain of your Snikket instance.
SNIKKET_DOMAIN=chat.example.com

# An email address where the admin can be contacted
# (also used to register your Let's Encrypt account to obtain certificates).
SNIKKET_ADMIN_EMAIL=admin@example.com

# For reverse-proxy.
SNIKKET_TWEAK_HTTP_PORT=5080
SNIKKET_TWEAK_HTTPS_PORT=5443

SNIKKET_TWEAK_TURNSERVER_MIN_PORT=49152
SNIKKET_TWEAK_TURNSERVER_MAX_PORT=49252

`snikket/snikket.nix`

Generate this file with (run in snikket directory):

nix-shell -p compose2nix --run "compose2nix -inputs docker-compose.yml -output snikket.nix -project snikket"

You need to regenerate it in case docker-compose.yml was changed.

`snikket/copy-certs.sh`

Snikket handles ACME with its own service with certbot, so we need to copy those files to Nginx directory.

Also we need to rename key file and add a group read permissions to it.

#!/usr/bin/env bash
DOMAIN="chat.example.com"
SOURCE="/var/lib/containers/storage/volumes/snikket_snikket_data/_data/letsencrypt/live/$DOMAIN"
TARGET="/var/lib/acme/$DOMAIN"

cp -rL "$SOURCE" "$TARGET"
mv "$TARGET/privkey.pem" "$TARGET/key.pem"
chown -R acme:nginx "$TARGET"
chmod g+r "$TARGET/key.pem"

`snikket/copy-certs-job.nix`

Too lazy to figure out when to copy updated certs - just do it daily at 00:00 UTC:

# Periodic job that copies cert files from Snikket container to nginx directory.
{ config, pkgs, ... }:

{
  systemd.timers."snikket-copy-certs" = {
    wantedBy = [ "timers.target" ];
      timerConfig = {
        OnBootSec = "5m";
        OnCalendar = "*-*-* 00:00:00 UTC";
        Unit = "snikket-copy-certs.service";
      };
  };

  systemd.services."snikket-copy-certs" = {
    path = with pkgs; [ bash ];
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "/path/to/copy-certs.sh";  # <--- Change this.
    };
  };
}

Running

Certs

Check that all Snikket services are up and ready (certs service can take a while to verify newly created certs):

systemctl status podman-snikket*

Replace podman-snikket* with docker-snikket* if you've chosen the Docker backend for compose2nix command.

Run snikket/copy-certs.sh. Now certs should be working.

Restart Nginx for good measure:

systemctl restart nginx.service

First admin user

To create your first user (who is admin), run this command and follow the invitation link:

docker exec snikket create-invite --admin --group default

All other users must join Snikket by an invite link, which you can create in admin panel at chat.example.com/admin/invitations. Invites can be one-time only and not restricted (also you can choose user role and circle).

Bye!

Pain & suffering. Filenames on PocketBook

Kir Axanov — Mon, 19 Jan 2026 14:09:17 +0000

2026.01.19

Hi!

I have a wonderful PocketBook ebook reader. But every filename with non-ASCII characters turns into gibberish if it was copied from pc (via USB). As a workaround I was copying a zip archive for then to unarchive it and all filenames were OK.

Only after some embarrassing number of evenings lately (playing with rsync, cp, convmv and ALL AVAILABLE encodings) I've figured out the reason...
I was mounting the ebook with iocharset=iso-8859-1 by default, but on the ebook itself its partitions were mounted with iocharset=utf8 (with codepage=437 in both cases, btw). Bingo!

How to mount with needed iocharset (utf8 here):

# Like so: sudo mount /dev/sdc /mnt --options iocharset=utf8
sudo mount /path/to/device /path/to/mountpoint --options iocharset=utf8

If just mounting with iocharset=utf8 does not help and you want to actually find out the mount options you'll need a console for your ebook like PBterm or Konsole from vlasovsoft apps bundle (docs, downloads).

You can check current mount options with just mount command (search for your device and look at options in parenthesis). That's how I learned about wrong iocharset in the first place.

Bye!

Configs. Fix any vertical mouse

Kir Axanov — Fri, 19 Dec 2025 05:26:29 +0000

2025.12.19

Hi!

It's really dumb, but every vertical mouse I saw has one crucial mistake in its design - the sensor is misaligned and when you try to hold it the proper (ergonomic!) way and move horizontally, it also moves up / down...

But we can fix it with xinput!

Steps

Identify your fancy mouse. Run the following command with the mouse unplugged and then plugged again to see which device you need (get name after ↳ and before id=):
```
xinput list
```
Mine is called USB OPTICAL MOUSE.
Prepare the Python3 environment for script in next step. You'll need the scipy package.

For NixOS just replace the shebang in this script with this one:
```
#!/usr/bin/env nix-shell
#!nix-shell -i python3 -p python3 python313Packages.scipy
```

Use python script below to experiment with rotation angle:

#!/usr/bin/env python3
# Set rotation matrix for mouse.
# Original: https://luator.de/linux/2022/03/05/xinput-rotate-mouse-axes.html
#
# Usage example:
# python3 rotate-mouse.py DEVICE_NAME ANGLE
#
# See all devices with:
# xinput list
#
# The script also prints the command for selected angle, so you can add it to autostart.
#
# Positive values result in clock-wise rotation.
# The rotation is always relative to the original orientation,
# so you can easily reset by setting the angle to 0.

"""Use xinput to rotate the mouse axes by a given angle."""
import argparse
import os

from scipy.spatial.transform import Rotation

def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("device", type=str, help="Mouse name from `xinput list`.")
    parser.add_argument("angle", type=int, help="Rotation angle in degrees.")
    args = parser.parse_args()

    # Construct rotation matrix from given angle (xinput expects an affine 2d
    # transformation but since we are only rotating, this is equivalent to a
    # simple 3d rotation matrix around the z-axis).
    rot = Rotation.from_euler("z", args.angle, degrees=True).as_matrix()
    matrix = [str(x) for x in rot.flatten()]

    xinput_cmd = [
        "xinput",
        "set-prop",
        args.device,
        "Coordinate Transformation Matrix",
    ] + matrix

    xinput_str = f"xinput set-prop '{args.device}' 'Coordinate Transformation Matrix' {' '.join(matrix)}    # Rotates mouse by {args.angle}°"
    print(xinput_str)

    os.execvp("xinput", xinput_cmd)

if __name__ == "__main__":
    main()

Original script was taken from Luator's Blog.

The script above also prints applied xinput command, which you can add to your autostart scripts to make it persistent after reboot.
After finding the matrix, you can ditch created above python environment.

Bonus: InputLeap struggles

I use InputLeap to share my keyboard and mouse between my machines time to time, which apparently does not go well with such xinput changes (leave a comment if I miss something). On clients the mouse comes stuck at the top right corner.

So we need to reset our transformation matrix when we go to InputLeap client (and struggle with not-so-ergonomic-mouse-with-misaligned-sensor, alas!).

As it's mentioned in the script, you can reset the matrix by running it with zero angle, or straight with xinput:

xinput set-prop 'YOUR_MOUSE_NAME' 'Coordinate Transformation Matrix' 1.0 0.0 0.0 0.0 1.0 0.0 0.0 0.0 1.0

So we just need to run this reset command when we go to client and run the rotation command when we are back on server.

InputLeap has the --screen-change-script argument, which you can use... but somehow applying any arguments to input-leap on NixOS does nothing, it only respects the settings set up in its GUI.

Thus, here is a uniform way to catch when InputLeap changes screens via monitoring its log file:

Open InputLeap GUI, go to InputLeap top menu -> Change Settings -> Logging
- set Logging level to info
- check Log to file and choose the log file you want to use (i.e. /tmp/inputleap.log)
- hit OK and restart it

Save and edit script below:

change LOG_FILE variable to the log file path which you set in InputLeap GUI
change YOUR_MOUSE_NAME with, you guessed it, your mouse name from xinput list
change ROTATE_CMD and RESET_CMD with appropriate xinput commands found above
change SERVER_SCREEN to the name of InputLeap server's screen (it's in General -> Screen name of InputLeap GUI settings from previous step)
also, you can uncomment the line with notify-send to see the screen name when you move between them

#!/usr/bin/env bash
# Rotates mouse based on current InputLeap screen.

LOG_FILE="/tmp/inputleap.log"

rm -f "$LOG_FILE"
touch "$LOG_FILE"

tail -f "$LOG_FILE" | grep "INFO: switch from" --line-buffered | while read -r line ; do
  SCREEN=$(echo "$line" | sed 's/.*to "\(.*\)".*/\1/g')
  # notify-send -a InputLeap "Switched to $SCREEN"
  case "$SCREEN" in
    "SERVER_SCREEN") ROTATE_CMD;;
    *) RESET_CMD;;
  esac
done

Run the script above (add to autostart if needed).

Bye!

Configs. Touchpad-like scroll with mouse

Kir Axanov — Fri, 19 Dec 2025 04:10:06 +0000

2025.12.19

Hi!

Tired of fixing / blowing / replacing mouse wheel every now and then? Lovin' middle-button scroll in your favourite firefox fork and wanna use it everywhere?

Let's make a touchpad-two-fingers-like-scrolling with a mouse!

(It works like this: you hold some button and drag the mouse up / down / left / right to scroll, the cursor remains in the same place.)

General GNU/Linux

Open / create /etc/X11/xorg.conf.d/99-mouse.conf and add those lines to it (this should work, but untested as I use NixOS):

Section "InputClass"
    Identifier "Mouse Defaults"
    MatchIsPointer "on"
    MatchDevicePath "/dev/input/event*"
    Driver "libinput"
    Option "ScrollMethod" "button"
    Option "ScrollButton" "button3"
EndSection

You can replace button3 (right button here) with the desired button to activate dragging scroll.
To find out the exact button I use xev util.

NixOS

These are the lines to add to your NixOS config:

services.libinput.mouse = {
  scrollMethod = "button";
  scrollButton = 3;
};

Bye!

Shorts. Extra clipboard buffer with CopyQ

Kir Axanov — Sat, 11 Oct 2025 04:01:17 +0000

2025.10.11

Hi!

Linux has two clipboard buffers: primary for mouse selection and clipboard for Ctrl+C / Ctrl+V.
But sometimes that's not enough and you want to keep some text around to paste later (like clipboard registers in Vim, but system-wide).
We can make this possible with CopyQ clipboard manager, which allows us to have multiple tabs for our copied data.

DISCLAIMER

I’m talking about text only, other media types won’t work with the script below.
In CopyQ settings check the (1) Store clipboard and (2) Store text selected using mouse.

Code

Here is a simple bash-script, that adds new tab and uses it as an extra clipboard buffer:

#!/usr/bin/env bash
# Allows to save text to extra buffer in CopyQ.
# Bind `copy()` to Alt+C, `paste()` to Alt+V.
# Alt+C copies selected text to extra buffer, current clipboard remains unchanged.
# Alt+V copies latest item in extra buffer to clipboard (you still have to paste it manually with Ctrl+V, `copyq paste` is laggy).
# If item in extra buffer is already in clipboard, then Alt+V removes it from clipboard (extra buffer still has it).

set -e

CMD="$1"  # One of: `copy`, `paste`
EXTRA_BUFFER="ExtraBuffer"

copy() {
  local selected=$(copyq selection)
  local old=$(copyq read -1)
  copyq tab "$EXTRA_BUFFER" add "$selected"
  copyq remove 0
  copyq copy "$old"
}

paste() {
  local clipboard=$(copyq read 0)
  local extra=$(copyq tab "$EXTRA_BUFFER" read 0)

  if [[ "$clipboard" == "$extra" ]]; then  # Restoring old copied item from clipboard.
    copyq remove 0
    local old=$(copyq read 0)
    copyq copy "$old"
  else  # Adding item from extra buffer to clipboard.
    local extra=$(copyq tab "$EXTRA_BUFFER" read 0)
    copyq write 0 "$extra"
    copyq copy "$extra"
  fi
}

case "$CMD" in
  copy) copy;;
  paste) paste;;
  *) ;;
esac

You can bind it in i3wm like so (replace SCRIPT_PATH):

set $alt Mod1
bindsym $alt+C exec "bash SCRIPT_PATH copy"
bindsym $alt+V exec "bash SCRIPT_PATH paste"

Bye!

Code. Gleam, SQLite and concurrent transactions walked to a bar

Kir Axanov — Sat, 04 Oct 2025 11:10:16 +0000

2025.10.04

Hi!

Gleam + SQLite is a nice choice for a side-project.
But when this project grows and demands parallel writes into the same DB, we can get stuck as SQLite does not support this out of the box.
Nevertheless, we can achieve trully concurrent (espetially write) transactions in SQLite if we:

use SQLite compiled from begin-concurrent branch
use WAL-mode
use own connection for each writer
wrap the query into begin concurrent transaction; - commit; block

DISCLAIMER

The actions below are semi-manual and require automation. Feel free to participate!

Replace SQLite in project

I use SQLite via the sqlight Gleam package, which uses esqlite Erlang library under the hood, which has the SQLite embedded into it.
So, all we have to do is to replace the embedded SQLite in esqlite build directory.

Find out the needed SQLite revision on begin-concurrent branch here.
Download the archive from Overview -> Downloads -> Tarball.

Unpack the archive (replace the REVISION):

gzip -d SQLite-REVISION.tar.gz
tar xvf SQLite-REVISION.tar
cd SQLite-REVISION

Build the amalgamation (needs gnumake package installed):
```
./configure && make sqlite3.c
```
Build the project:
```
gleam build
```

Place generated sqlite3.c and sqlite3.h to esqlite package directory (replace PROJECT_ROOT):

cp sqlite3.c PROJECT_ROOT/build/packages/esqlite/c_src/sqlite3/
cp sqlite3.h PROJECT_ROOT/build/packages/esqlite/c_src/sqlite3/

Remove previous build artifacts and rebuild (replace PROJECT_ROOT):
```
rm -rf PROJECT_ROOT/build/dev
gleam build
```
Now SQLite should be compiled to PROJECT_ROOT/build/dev/erlang/esqlite/priv/esqlite3_nif.so (I like to put it into project's git too, you do you).

Verify installed version

We can check the version of SQLite, which is used for the connection to DB, with a query:

SELECT sqlite_version();

Here is a simple PoC:

import gleam/dynamic/decode
import sqlight


pub fn main() {
  use conn <- with_db("my-test-db.sqlite")

  "SELECT sqlite_version();"
  |> sqlight.query(on: conn, with: [], expecting: decode.dynamic)
  |> echo
}

fn with_db(
  db_path: String,
  do_something: fn(sqlight.Connection) -> Result(a, sqlight.Error),
) -> Result(a, sqlight.Error) {
  { "file:" <> db_path <> "?mode=rwc" }
  |> sqlight.open()
  |> try(fn(conn) {
    let result = do_something(conn)
    let _ = sqlight.close(conn)
    result
  })
}

Enable WAL-mode

To enable the WAL-mode for the entire DB we use this pragma:

PRAGMA journal_mode = WAL;

You can use the code from previous part, just replace the query.

If you want to return to a default journal mode, then use those queries (although I'm not sure you necessary need the wal_checkpoint pragma here too):

PRAGMA wal_checkpoint;
PRAGMA journal_mode = DELETE;

Considerations

Keep in mind the following:

writing to a table in one job will break the other job reading the same table - use intermediate tables to update data
CREATE and DELETE queries lock the DB, so if you need some intermediate tables - create them before starting concurrent jobs
single connection executes all queries in sequential order - use multiple connections for concurrent jobs
long-running queries can cause BusySnapshot error - try to split them to smaller operations / datasets

Replace SQLite in NixOS

It's a good idea to use the same SQLite system-wide, so here are the steps to install it from the same revision.

Clone nixpkgs repo:

git clone --depth=1 https://github.com/NixOS/nixpkgs.git

Find out the needed SQLite revision on begin-concurrent branch here.
Download the archive from Overview -> Downloads -> Tarball. Place it to nixpkgs/pkgs/development/libraries/sqlite for convenience.

Edit nixpkgs/pkgs/development/libraries/sqlite/default.nix to point to the downloaded archive (replace REVISION, exact url and hash values may vary):

- src = fetchurl {
-   url = "https://sqlite.org/2025/sqlite-autoconf-${archiveVersion version}.tar.gz";
-   hash = "sha256-hKYW/9MXOORZC2W6uzqeHvk3DzY4422yIO4Oc/itIVY=";
- };
+ src = ./SQLite-REVISION.tar.gz;

Build and install the package:

nix-build . -A sqlite
nix-env -i ./result-bin/

Check the installed version:

nix-env -q  # should list the sqlite package with the version from nixpkgs repo as we didn't change it
sqlite3 --version  # should print the exact version which we downloaded

Bye!

Code. Gleam. Parallel tasks from pool

Kir Axanov — Tue, 30 Sep 2025 13:55:26 +0000

2025.09.30

Hi!

Usecase and terms

Sometimes you want to split a heavy job into multiple pieces to run in parallel, but you cannot predict the amount of such smaller jobs.
So, we need a function, that will tell when to stop spawning new jobs.
Also, we will stop spawning new jobs if we got any error (already running jobs will continue until finished).

job is something, that you want to execute in parallel (the smaller pieces)
task is any data, which is passed as argument to a job

As an example, imagine that you need to import some huge amount of (unlinked) time-based data. We can run, say, 20 parallel processes at once. Each process will take a time window for a day - that day's start timestamp is a task for those processes (jobs). We run those jobs until we import all the data or encounter any errors.

Code

We will use a OTP-actor, which I named ParaWorker (parallel worker).

Here are the types in types.gleam:

import gleam/option.{ type Option }
import gleam/erlang/process


pub type ParaWorkerMsg(err) {
  TaskEnqueued
  TaskCompleted
  TaskFailed(error: err)
}

pub type ParaWorkerState(task, err) {
  ParaWorkerState(
    worker_name: process.Name(ParaWorkerMsg(err)),
    running_jobs: Int,
    next_task: Option(task),
    new_task: fn(task) -> Option(task),
    handle_task: fn(task) -> Result(Nil, err),
    errors: List(err),
    finish_subject: process.Subject(Result(Nil, List(err))),  // Where ParaWorker should send the results of handling all tasks.
  )
}

And here is the ParaWorker in paraworker.gleam:

import gleam/string
import gleam/io
import gleam/otp/actor
import gleam/erlang/process
import gleam/result.{ try }
import gleam/option.{ type Option, Some, None }

import types as t


pub fn start(
  first_task: task,
  note: String,
  max_jobs: Int,
  new_task: fn(task) -> Option(task),
  handle_task: fn(task) -> Result(Nil, err),
) -> Result(Nil, List(err)) {
  case max_jobs {
    max_jobs if max_jobs <= 0 -> panic as "To start ParaWorker, `max_jobs` should be greater than 0!"
    _ -> Nil
  }

  let worker_name = process.new_name("parallel_worker")
  let finish_subject = process.new_subject()

  let _ = t.ParaWorkerState(
    worker_name:,
    running_jobs: 0,
    next_task: Some(first_task),
    new_task:,
    handle_task:,
    errors: [],
    finish_subject:,
  )
  |> actor.new()
  |> actor.on_message(handle_msg)
  |> actor.named(worker_name)
  |> actor.start()
  |> try(fn(_) { io.println("Started `" <> note <> "` ParaWorker.") |> Ok() })
  |> result.try_recover(fn(error) {
    io.println("Failed to start `" <> note <> "` ParaWorker.")
    Error(error)
  })

  start_handling(worker_name, max_jobs)
  let results = process.receive_forever(finish_subject)  // Waiting until all tasks are handled.

  io.println("Finished `" <> note <> "` ParaWorker with: `" <> string.inspect(results) <> "`.")
  results
}

fn start_handling(
  actor_name: process.Name(t.ParaWorkerMsg(err)),
  count: Int,
) -> Nil {
  actor_name
  |> process.named_subject()
  |> enqueue__loop(count)
}

fn enqueue__loop(
  subject: process.Subject(t.ParaWorkerMsg(err)),
  count: Int,
) -> Nil {
  case count {
    0 -> Nil
    count -> {
      process.send(subject, t.TaskEnqueued)
      enqueue__loop(subject, count - 1)
    }
  }
}

fn handle_msg(
  actor_state: t.ParaWorkerState(task, err),
  msg: t.ParaWorkerMsg(err),
) -> actor.Next(t.ParaWorkerState(task, err), t.ParaWorkerMsg(err)) {
  let t.ParaWorkerState(running_jobs:, next_task:, errors:, finish_subject:, ..) = actor_state

  case msg, running_jobs, next_task, errors {
    // New task is added for handling (during worker starting) - spawn new job and continue handling.
    t.TaskEnqueued, _, _, _ -> {
      start_job(actor_state)
      |> actor.continue()
    }

    // Finished the last job - stop and return errors if any.
    // `running_jobs` can't be 0, cause `first_task` is always `Some()`.
    _, 1, None, _ |  // No more tasks.
    t.TaskFailed(_), 1, _, _ |  // Got new error.
    _, 1, _, [_h, .._t] -> {  // Have any error.
      let results = case msg, errors {
        t.TaskFailed(error), errors -> Error([error, ..errors])
        _, [] -> Ok(Nil)
        _, errors -> Error(errors)
      }

      process.send(finish_subject, results)
      actor.stop()
    }

    // No errors found and have the next task - spawn new job and continue handling.
    t.TaskCompleted, _, Some(_), [] -> {
      t.ParaWorkerState(..actor_state, running_jobs: running_jobs - 1)
      |> start_job()
      |> actor.continue()
    }

    // A job returned error - wait till all running jobs finish.
    t.TaskFailed(error), running_jobs, _, errors -> {
      t.ParaWorkerState(..actor_state, running_jobs: running_jobs - 1, errors: [error, ..errors])
      |> actor.continue()
    }

    // No next task - wait till all running jobs finish.
    _, running_jobs, None, _ -> {
      t.ParaWorkerState(..actor_state, running_jobs: running_jobs - 1)
      |> actor.continue()
    }

    // Have some errors - wait till all running jobs finish.
    _, running_jobs, _, [_h, .._t] -> {
      t.ParaWorkerState(..actor_state, running_jobs: running_jobs - 1)
      |> actor.continue()
    }
  }
}

fn start_job(
  actor_state: t.ParaWorkerState(task, err),
) -> t.ParaWorkerState(task, err) {
  let t.ParaWorkerState(running_jobs:, next_task: task, new_task:, handle_task:, ..) = actor_state

  case task {
    Some(task) -> {
      let next_task = new_task(task)

      process.spawn(fn() {
        let msg = case handle_task(task) {
          Ok(_) -> t.TaskCompleted
          Error(error) -> t.TaskFailed(error)
        }

        actor_state.worker_name
        |> process.named_subject()
        |> process.send(msg)
      })

      t.ParaWorkerState(..actor_state, running_jobs: running_jobs + 1, next_task:)
    }
    None -> actor_state
  }
}

Usage example

Here we count from 1 up to 10. First time without errors, second and third time with one error. Pay attention that already running jobs continue even after the error raised, but no new jobs started after. The third run shows that no new jobs started immediately after the error when we only use one job at a time:

import gleam/io
import gleam/int
import gleam/string
import gleam/erlang/process

import paraworker


pub fn main() {
  let new_task = fn(task: Int) {
    case task {
      task if task >= 10 -> None
      task -> Some(task + 1)
    }
  }

  let handle_task_ok = fn(task: Int) {
    io.println(timestamp() <> " Counted up to " <> int.to_string(task) <> ".")
    process.sleep(300)
    Ok(Nil)
  }

  let handle_task_err = fn(task: Int) {
    io.println(timestamp() <> " Counted up to " <> int.to_string(task) <> ".")
    process.sleep(300)
    case task {
      4 -> Error("1, 2, 3, 4... wait what... where is bleem?!")
      _ -> Ok(Nil)
    }
  }

  let _ = paraworker.start(1, "demo-ok", 3, new_task, handle_task_ok)
  io.println("")
  let _ = paraworker.start(1, "demo-error", 3, new_task, handle_task_err)
  io.println("")
  let _ = paraworker.start(1, "demo-error-single", 1, new_task, handle_task_err)
}

// Using erlang function for example's portability - replace by something like `birl` for convenience.
@external(erlang, "erlang", "timestamp")
fn erl_timestamp() -> #(Int, Int, Int)

fn timestamp() -> String {
  let erl_time = erl_timestamp()
  int.to_string(erl_time.0) <> int.to_string(erl_time.1) <> "." <> int.to_string(erl_time.2) |> string.slice(0, 3)
}

Bye!

Code. SQLite. Time tables with recursive CTE

Kir Axanov — Fri, 08 Aug 2025 15:19:30 +0000

2025.08.08

Hi!

Assuming you know what time tables are and you need to have them in SQLite, here's how we can generate one:

WITH RECURSIVE
  cnt(x) AS (
    VALUES(unixepoch('2025-01-01 00:00:00'))    --> Start datetime.
    UNION ALL
    SELECT x + 60                               --> Period duration, in seconds.
    FROM cnt
    WHERE x < unixepoch('2025-01-01 03:00:00')  --> End datetime.
  )

SELECT
  x AS start,
  x + 59 AS stop                                --> Also period duration, minus last second.
FROM cnt;

The code above will generate 181 rows of start - stop pairs since 2025-01-01 00:00:00 till 2025-01-01 03:00:00. Each pair represents a 1-minute interval (left end included, right end excluded). Obviously, you can change the interval to be anything, just don't forget to update it in both places.

Full example with saving to an actual time table:

CREATE TABLE periods_1m (start INTEGER PRIMARY KEY, stop INTEGER);

WITH RECURSIVE
  cnt(x) AS (
    VALUES(unixepoch('2025-01-01 00:00:00'))
    UNION ALL
    SELECT x + 60
    FROM cnt
    WHERE x < unixepoch('2025-01-01 03:00:00')
  )

INSERT INTO periods_1m (start, stop)
SELECT x, x + 59
FROM cnt;

Resources:

SQLite docs on WITH clause and recursive CTE
blog post by Brady Holt, which pushed me to finally read the SQLite docs above (:

Bye!

P.S.
Nice drawing canvas, Brady! Such touches make the web alive)

Configs. Keyboard LED as layout indicator

Kir Axanov — Wed, 12 Mar 2025 04:22:41 +0000

2025.03.12

Hi!

Using i3wm? Have a fancy keyboard with a nice CapsLock LED, but never actually press CapsLock (not as a remapped Ctrl)?

Me too! Let's convert it into a keyboard layout indicator then!

You can use method described below for things other than keyboard layout and for other LEDs. Happy hacking!

Requirements

i3 - targeted window manager, we will use its IPC to subscribe to window change event
perl with AnyEvent::I3 - to communicate with i3 IPC
bash with grep, sed and xargs utils
brightnessctl - to control LED
xkb-switch - to monitor keyboard layout change event
i3-subscribe.pl - perl script for i3 IPC (source)
toggle_capslock_led.sh - our bash script for toggling LED
i3ipc_capslock_led.sh - our bash script to start listening for window and layout changes

All scripts below are supposed to be put into ~/Scripts directory - change this path if you need to.

General method

We have a bash script, which checks current keyboard layout and turns the LED on when specified layout is active.

We call this script:

when the layout changes
when we go to other window (as each window has its own keyboard layout state)

This is the script (toggle_capslock_led.sh) with some comments inside:

#!/usr/bin/env bash
# Lights up capslock LED when specified layout is on.
# Works for LED on all connected keyboards (e.g. laptop's and external one).

# You can also set this to your specific input name, which can be found with: brightnessctl --list
# LED_NAMES="input7::capslock"
LED_NAMES=$(brightnessctl --list | grep '::capslock' | sed 's/Device .\(.*\). of.*/\1/g')

# The layout on which we want LED to be on.
# Get available layout names with: xkb-switch -l
ON_LAYOUT="us"
CURRENT_LAYOUT=$(xkb-switch -p)

VALUE=0
if [[ "$CURRENT_LAYOUT" == "$ON_LAYOUT" ]]; then
  VALUE=1
fi

echo "$LED_NAMES" | while read name; do
  brightnessctl --device="$name" set $VALUE > /dev/null
done

Talking to i3 IPC

Below is the i3-subscribe.pl script for talking to i3 with perl.

To run it you will need to install AnyEvent::I3 for perl.

If you are on NixOS - leave script as it is (it uses nix-shell with perl540Packages.AnyEventI3).

If you aren't on NixOS - replace first two lines with this one: #!/usr/bin/env perl.

#!/usr/bin/env nix-shell
#!nix-shell -i perl -p perl perl540Packages.AnyEventI3
# Subscribe to i3wm events via i3ipc.
# Source: https://faq.i3wm.org/question/5721/how-do-i-subscribe-to-i3-events-using-bash-easily.1.html
#
# Usage example for bash:
# i3subscribe window workspace | while read -r event; do
# ...
# done

BEGIN { $| = 1 } # flush \n

use strict;
use warnings;
use Data::Dumper;
use AnyEvent::I3;
use v5.10;

my $i3 = i3();
$i3->connect->recv or die "Error connecting to i3";

sub subscribe {
    my $ev = $_[0];
    my $dump = $_[1];
    if($i3->subscribe({
        $ev => sub {
            my ($msg) = @_;
            say "$ev:$msg->{'change'}";
            if($dump) {
                print Dumper($msg);
            }
        }
    })->recv->{success}) {
        say "Successfully subscribed to $ev-event";
    }
}

my $nextArg = shift;
if(!$nextArg) {
    say "Subscribe to i3-events";
    say "Usage:   $0 workspace|output|mode|window|barconfig_update|binding [dump]";
    say "Example: $0 workspace dump window binding dump";
    exit 1;
}
while($nextArg) {
    my $arg = $nextArg;
    $nextArg = shift;
    my $dump = 0;
    if($nextArg and $nextArg eq "dump") {
        $dump = 1;
        $nextArg = shift;
    }
    subscribe("$arg", $dump);
}
AE::cv->recv;

Toggle LED

This is i3ipc_capslock_led.sh which starts needed listeners - add this script to autostart and that's it:

#!/usr/bin/env bash
# Executes `toggle_capslock_led.sh` script on window change.
# Source: https://faq.i3wm.org/question/5721/how-do-i-subscribe-to-i3-events-using-bash-easily.1.html

# Run LED switcher on layout change
xkb-switch -W | xargs -I{} ~/Scripts/toggle_capslock_led.sh &

# Run LED switcher on window or workspace change
~/Scripts/i3-subscribe.pl window workspace | while read -r event; do
  ~/Scripts/toggle_capslock_led.sh
done

Bye!

Code. Gleam. Named actors

Kir Axanov — Fri, 07 Mar 2025 15:06:13 +0000

2025.03.07

Hi!

DISCLAIMER

This is a workaround!
Totally not tested under any production load, you've been warned!

Problem

We cannot have a global state in such an FP language as Gleam.

So, when we want to send a message to some specific (singleton) actor, we need to pass the reference to it as an argument. Every. Time.

Workaround

Words

So. Erlang has the pool of named processes, which we can query to get a process by its assigned unique name...

But as of now it is not type-checked by Gleam:

There is no support for named processes. They are untyped global mutable variables which may be uninitialized, more research is needed to find a suitable type safe alternative.

And all we can get is a process ID (pid). Which is not what we need to send a message to our actor.

But! There is ~~hope~~ workaround! While we are waiting for proper implementation of named actors.

We can send our message as a string to any process by its pid! All we need is to... kill it!

Using abnormal exit we can send any string as an exit reason to our process. We trap[1][2] this exit in our singleton actor (as it is linked with the process we are killing) and parse received message from this string.

Diagrams

Code

Usage example:

import gleam/io
import gleam/erlang/process

import named_actor


pub fn main() {
  // Just echo the message
  let _ = named_actor.new("my_singleton_actor", fn(msg) {
    io.debug(msg)
    Nil
  })

  // Send a message to you actor only by its name! Waiting is optional, just for the demo.
  process.sleep(500)
  named_actor.send("my_singleton_actor", "YOLO!!!1!")

  // Send a new message, you got this.
  process.sleep(1500)
  named_actor.send("my_singleton_actor", "Hieee!!!")

  // Keep the main process running
  process.sleep_forever()
}

The whole code in named_actor.gleam:

//// A workaround to have a named actor with disposable proxy process with abnormal exits.
//// This actor is implemented with a Nil-state.
import gleam/string
import gleam/function
import gleam/dynamic
import gleam/otp/actor
import gleam/erlang/atom.{ create_from_string as atom }
import gleam/erlang/process


//---------------------------------------------------------------------------//
// Constants.                                                                //
//---------------------------------------------------------------------------//
/// How much time is given to actor to start.
/// In milliseconds.
const init_timeout = 500

/// How much time to wait between tries of getting named process.
/// In milliseconds.
const send_timeout = 100


//---------------------------------------------------------------------------//
// Methods.                                                                  //
//---------------------------------------------------------------------------//
/// Creates an actor and a named proxy process to send messages to that actor.
pub fn new(
  name: String,
  handle_msg: fn(dynamic.Dynamic) -> Nil,
) -> Result(process.Subject(dynamic.Dynamic), actor.StartError) {
  actor.start_spec(actor.Spec(
    init: fn() { init_actor(name) },
    init_timeout:,
    loop: fn (msg: dynamic.Dynamic, state: Nil) {
      handle_msg(msg)
      actor.continue(state)
    },
  ))
}

fn init_actor(name: String) -> actor.InitResult(Nil, dynamic.Dynamic) {
  let subject = process.new_subject()

  let trap_proxy = fn(exit_msg: process.ExitMessage) -> dynamic.Dynamic {
    start_proxy(name)

    case exit_msg.reason {
      process.Abnormal(reason) -> {
        reason
        |> string.drop_left(10)  // cuts left from `Abnormal("MSG")`, where we need `MSG`
        |> string.drop_right(2)  // cuts right from `Abnormal("MSG")`, where we need `MSG`
        |> dynamic.from()
      }
      result -> dynamic.from(result)
    }
  }

  let selector = process.new_selector()
  |> process.selecting_trapped_exits(trap_proxy)
  |> process.selecting(subject, function.identity)

  process.trap_exits(True)
  start_proxy(name)

  actor.Ready(Nil, selector)
}

/// Starts a named process, which upon exiting sends the message to our actor.
fn start_proxy(name: String) -> Nil {
  let _ = process.start(process.sleep_forever, True)
  |> process.register(atom(name))
  Nil
}

/// Sends a message to the named actor (by killing it... that's rough).
/// Sending is done in a loop by a new process.
/// Loop does not end until succeeded.
/// Each iteration has a `sleep()` inside.
pub fn send(name: String, msg: String) -> Nil {
  process.start(fn() { send__loop(name, msg) }, True)
  Nil
}

fn send__loop(name: String, msg: String) -> Nil {
  case process.named(atom(name)) {
    Ok(pid) -> {
      case process.is_alive(pid) {
        True -> process.send_abnormal_exit(pid, msg)
        False -> {
          process.sleep(send_timeout)
          send__loop(name, msg)
        }
      }
    }
    _ -> {
      process.sleep(send_timeout)
      send__loop(name, msg)
    }
  }
}

Do let me know, if you have some other way of doing this!

Bye!

NixOS. Managing secrets with sops-nix

Kir Axanov — Fri, 21 Feb 2025 07:36:23 +0000

2025.02.21

Hi!

Here are some notes about how to use secrets in NixOS configuration securely. As of now I use sops-nix with simple age keys (not generated from ssh keys).

Concept

We will generate a file with all our secrets (e.g. secrets.yaml). For example:

my_secret_auth: <plain-text secret>

secrets.yaml is stored encrypted. We can edit it with sops secrets.yaml which decrypts it and opens your editor from the $EDITOR environment variable.

For this encryption / decryption sops uses an age public and private keys - we generate those too.

For those secrets to be picked up by nixos we register them in nixos config (we can set secret's owner to allow access for needed service):

sops.secrets = {
  my_secret_auth = {
    owner = "nginx";
  };
};

In the nixos configuration we now can use those secrets like so (an example for nginx basic auth):

basicAuthFile = config.sops.secrets.my_secret_auth.path;

That's basically it. Below are some details on how to setup all of this.

Local secrets with `nixos-rebuild`

For use on a local machine. We will use niv to install sops-nix.

1) Go to your configuration directory, init a niv project with sops-nix:

# where `configuration.nix` is located, adjust if needed
cd /etc/nixos

# init `niv` with `sops-nix` before installing anything
nix-shell -p niv --run "niv init && niv add Mic92/sops-nix"

2) Create the directory for age keys:

mkdir -p ~/.config/sops/age

3) Configure sops and other stuff in secrets.nix (you can choose another name, don't forget to import this file from your configuration), replace YOUR_USER:

{ pkgs, config, ... }:

{
  imports = [ "${(import ./nix/sources.nix).sops-nix}/modules/sops" ];

  environment.systemPackages = with pkgs; [
    age sops
  ];

  sops = {
    defaultSopsFile = ./secrets/secrets.yaml;
    defaultSopsFormat = "yaml";

    age.keyFile = "/home/${config.users.users.YOUR_USER.name}/.config/sops/age/keys.txt";
  };
}

4) Apply configuration above:

sudo nixos-rebuild switch

5) Generate an age key:

age-keygen -o ~/.config/sops/age/keys.txt

6) Create .sops.yaml and paste public key printed on the previous step (replace capslocked text), use arbitrarily username:

keys:
  - &USERNAME PUBLIC_KEY
creation_rules:
  - path_regex: secrets/secrets.yaml$
    key_groups:
    - age:
      - *USERNAME

7) Register secrets to secrets.nix from step 3:

...
sops = {
  # ...
  secrets = {
    my_secret_auth = {
      owner = "nginx";
    };
  };
}

8) Use your secrets in nixos configuration (where the option expects a file path to the secret):

# ...
basicAuthFile = config.sops.secrets.my_secret_auth.path;
# ...

Remote secrets with `flake`

For use on a remote machine.

DISCLAIMER: I keep remote's configs locally and send them via scp when updating it.

1) Add this to your flake:

{
  inputs = {
    # ...
    sops-nix.url = "github:Mic92/sops-nix";  # <--
  };

  outputs = {
    # ...
    sops-nix,  # <--
    ...
  }@inputs:  # <--
  {
    nixosConfigurations.your_flake_name = nixpkgs.lib.nixosSystem {
      # ...
      specialArgs = { inherit inputs; };  # <--
      modules = [
        # ...
        sops-nix.nixosModules.sops  # <--
      ];
    };
  };
}

2) Create the directory for age keys:

mkdir -p ~/.config/sops/age

3) Configure sops and other stuff in secrets.nix (you can choose another name, don't forget to import this file from your configuration), replace YOUR_USER:

{ pkgs, config, inputs, ... }:

{
  imports = [ inputs.sops-nix.nixosModules.sops ];  # <-- differs from the local setup

  environment.systemPackages = with pkgs; [
    age sops
  ];

  sops = {
    defaultSopsFile = ./secrets/secrets.yaml;
    defaultSopsFormat = "yaml";

    age.keyFile = "/home/${config.users.users.YOUR_USER.name}/.config/sops/age/keys.txt";
  };
}

4) Apply configuration above:

# I'm copying the configuration via ssh and running update on a remote - you do you
nixos-rebuild switch --flake .#update

5) Generate an age key:

age-keygen -o ~/.config/sops/age/keys.txt

6) Create .sops.yaml and paste public key printed on the previous step (replace capslocked text), use arbitrarily username:

keys:
  - &USERNAME PUBLIC_KEY
creation_rules:
  - path_regex: secrets/secrets.yaml$
    key_groups:
    - age:
      - *USERNAME

7) Register secrets to secrets.nix from step 3:

...
sops = {
  ...
  secrets = {
    my_secret_auth = {
      owner = "nginx";
    };
  };
  ...

8) Use your secrets in nixos configuration (where the option expects a file path to the secret):

...
basicAuthFile = config.sops.secrets.my_secret_auth.path;
...

9) If you use sops on both local and remote, it's useful to copy age private key from the remote machine to your home keys.txt (so you'll have two keys there) - this way you can edit remote's secrets.yaml locally.

Resources

sops-nix repo
short tutorial from vimjoyer
commands from tutorial above
nice article from dade about this topic and some more

Bye!

DEV Community: Kir Axanov

Android. Text-to-speech

Install apps

Get voice models

Copy voice models to device

Use via TTS Util

NixOS. Snikket. Self-host E2EE messenger with calls

DNS

NixOS and OCI containers

Configs

nginx.nix

snikket.nix

snikket/docker-compose.yml

snikket/snikket.conf

snikket/snikket.nix

snikket/copy-certs.sh

snikket/copy-certs-job.nix

Running

Certs

First admin user

Pain & suffering. Filenames on PocketBook

Configs. Fix any vertical mouse

Steps

Bonus: InputLeap struggles

Configs. Touchpad-like scroll with mouse

General GNU/Linux

NixOS

Shorts. Extra clipboard buffer with CopyQ

DISCLAIMER

Code

Code. Gleam, SQLite and concurrent transactions walked to a bar

DISCLAIMER

Replace SQLite in project

Verify installed version

Enable WAL-mode

Considerations

Replace SQLite in NixOS

Code. Gleam. Parallel tasks from pool

Usecase and terms

Code

Usage example

Code. SQLite. Time tables with recursive CTE

Configs. Keyboard LED as layout indicator

Requirements

General method

Talking to i3 IPC

Toggle LED

Code. Gleam. Named actors

DISCLAIMER

Problem

Workaround

Words

Diagrams

Code

NixOS. Managing secrets with sops-nix

Concept

Local secrets with nixos-rebuild

Remote secrets with flake

Resources

`nginx.nix`

`snikket.nix`

`snikket/docker-compose.yml`

`snikket/snikket.conf`

`snikket/snikket.nix`

`snikket/copy-certs.sh`

`snikket/copy-certs-job.nix`

Local secrets with `nixos-rebuild`

Remote secrets with `flake`