DEV Community: Tim Apple

A relay on your own PC: thinking out loud about FIPS and local sync

Tim Apple — Thu, 22 Oct 2026 11:27:07 +0000

Last night Lez (lez@nostr.hu) left a reply that has stuck with me:

Please also consider FIPS and a relay running on the PC to sync with mobile. The advantage: when PC and mobile are on the same LAN, it connects directly, saving a round-trip to the Internet and back, which is a game changer when decrypting DMs for example.

I think Lez is right, and it lines up with something I have wanted for Omostrich for a while: reaching my own machines without leaning on Tailscale or a VPN. So I spent some time looking at what already exists. This is not an announcement. It is me thinking out loud, and I would love to hear from people who have tried any of this.

Why a relay on the PC makes sense

Right now most of us send every note, reaction and DM out to a relay somewhere on the internet, and then pull it back down onto the phone sitting next to the laptop. That works, but it is slow, it depends on someone else’s server being up, and it means your data is only as private as that relay.

A relay on your own computer flips that around. Your PC holds a full copy of your own events. Your phone talks to it directly when you are home, and everything syncs out to the public relays when it needs to. Decrypting a long DM thread from a box on the same desk is a very different experience from fetching it across the internet.

FIPS

FIPS (Free Internetworking Peering System) is a mesh network where each machine’s identity is a Nostr key. Every node gets a private IPv6 address tied to its npub, finds peers by publishing signed adverts on Nostr relays, and uses encrypted Nostr messages to punch through home routers. It can run over the internet, a LAN, Tor, Bluetooth, Ethernet and even radio. Ordinary tools like ssh or a ws:// relay URL just work on top of it.

It is exactly the shape of thing I had in mind. It is also young. The README says the protocol and APIs are not yet stable, a security audit is the top item on the roadmap, and the most recent release was mostly security fixes. That is healthy for a project at this stage, and it is moving fast, but I would not lean on it for anything important yet. I do want to run it on my own machines and help where I can with testing and bug reports.

Other options I looked at for the “reach my own machine” part:

Tailscale or Headscale. Still the most reliable choice today. Headscale lets you run the coordination server yourself.
Iroh. A mature Rust library (1.x) that connects directly when it can and falls back to a relay server you can host yourself. If Omostrich ever needs its own peer-to-peer link, this is probably where I would start.
Yggdrasil and Reticulum. Older mesh projects. Reticulum is strong for radio and offline use. Neither uses Nostr identities.
Tor onion services. Very mature and work through any router, but slow. Citrine on Android already offers this.

The relay part already mostly exists

The nice surprise is that the relay and sync side does not need much new work. NIP-77 (negentropy sync) lets two relays compare what they have and only send the difference.

strfry can sync both ways with a relay in a single command, filtered to your own pubkey. FIPS even ships an example of running strfry reachable only over the mesh.
Haven is a personal relay with import and backup built in.
nostr-relay-tray is a desktop relay app, and as Lez points out, there is work there toward exactly this kind of syncing.
Citrine does the same job on Android.

relay.pleb.one already answers NIP-77 sync requests, so pulling your history down to a local relay works today. Pushing back up works for members of the relay.

What I might do with this

Nothing is decided, and I am trying hard not to start new projects this month. But the first experiment is small and needs no new code:

Run strfry on my own PC with a timer that syncs my events with relay.pleb.one.
Point my phone at it over the LAN, and later over FIPS.
If that holds up, package it as a simple “pleb.one local” setup for Omarchy so anyone on the relay can do the same.

I would only build something new if the existing tools fall short, and I suspect they will not.

Thank you to Lez for the nudge. If you are running a local relay already, or you have been testing FIPS, I would really like to hear how it is going.

Originally posted on blog.ninepointlabs.com.

Omostrich 0.3: log in to Nostr apps by QR code

Tim Apple — Wed, 21 Oct 2026 14:51:32 +0000

Omostrich keeps your Nostr key on your own computer. It holds the key encrypted, unlocks from the Omarchy bar, posts notes, and signs for other Nostr apps over NIP-46 (remote signing) so those apps never see your key. Version 0.3.0 makes that last part much easier: you can now connect a phone app by scanning a QR code instead of copying long connection strings around.

What’s new

Show a QR code, scan it from your phone. Under Remote signing there’s a new QR button next to Copy. It shows your bunker:// connection string as a QR code, which a phone app such as Amethyst can scan to log in with a remote signer. The string is public (your public key and your NIP-46 relays, no secret), and the app’s connect request still shows up in Omostrich for you to approve, like any other.

Connect apps that show their own QR code. Some apps go the other way and display a nostrconnect:// code. Scan QR reads it with your laptop camera, or Paste code takes a copied string. Omostrich checks the code, answers the app on the relays it names, and adds it to Authorized apps under its own name. After that it keeps listening for that app after every unlock until you revoke it.

The camera is handled carefully. Frames go straight to the decoder and are never saved, and the camera turns off as soon as a code is read, when you cancel or close the preview, or after two minutes. Laptop webcams are fixed-focus and these codes are dense, so hold the code inside the guide box about 25 to 35 cm away. Even then, reading a phone’s code with a laptop camera can be unreliable, so the bunker QR is the dependable direction.

Approve all or deny all. Right after you log in, Amethyst signs a burst of events at once. When several requests are waiting, you can now settle every one on screen in one click, each just this once. Anything that arrives after you click still waits for its own answer.

Smaller fixes

Always allow no longer overwrites an app’s saved relays or name.
A request delivered twice is handled only once.
daemon.log now records each request’s method (such as sign_event) and whether the reply worked, never the content of the request or the reply.
The About page’s privacy statement now covers camera use, the relays a scanned app names, and the new log details.

Also new since 0.2

Omostrich 0.2.1 added an optional listener on your Tailscale address so your own devices can reach the signer with a token, and NIP-46 requests are now heard on every bunker relay, not just your posting relays.

Get it

The QR features need three extra packages. Everything else works without them:

sudo pacman -S qrencode ffmpeg zbar

To update an existing install:

cd ~/Projects/omostrich
git pull
npm ci
./install-daemon.sh
./install-plugin.sh
systemctl --user restart omostrich

The restart matters, because the running signer keeps the old code until it’s restarted. More about Omostrich is at omostrich.com.

Originally posted on blog.ninepointlabs.com.

Omostrich is part of PlebOne, my open-source Nostr project home: https://github.com/PlebOne

fm-cli and Autonomix CLI get their own websites

Tim Apple — Tue, 20 Oct 2026 21:47:00 +0000

Two of the terminal tools now have proper homes on the web: fm-cli.ninepointlabs.com and autonomix-cli.ninepointlabs.com. Until today, the only way to learn about either one was its GitHub README.

What’s on them

Each site is one page that answers the questions you’d have before installing: what the tool does, how to install it on your system, and how to get started. Both link straight to the latest release, and the full command reference stays in the README for when you need it.

fm-cli is Fastmail from the terminal: a full-screen mail app, commands that print JSON, and a live watch that follows your mailbox over Fastmail’s push connection. The site walks through all of it, including offline mode, the two-week calendar agenda and contacts, and how sign-in keeps tokens in your system keyring. It also shows every way to install it:

# On Omarchy
omarchy-mise-install github:ninepointlabs/fm-cli fm-cli

# With mise anywhere else
mise use -g github:ninepointlabs/fm-cli@latest

There are .pkg.tar.zst, .deb and .rpm packages and plain tarballs for Linux and macOS too. The README’s screenshot was also swapped for one showing sample mail.

Autonomix CLI installs and updates apps straight from GitHub Releases. The site covers the package formats it understands, how it detects what’s already installed, the JSON output for scripts, and how it fits into Omarchy: the bar widget and the post-update hook that updates your apps whenever you run omarchy update. Install steps for Debian and Ubuntu, Fedora and Arch are right there, along with the full command list.

Why it matters

A website is easier to share and easier to read than a repository. If you’ve been sending someone a GitHub link to explain what fm-cli or Autonomix CLI is, you can send them the site now. Nothing changes in the tools themselves, so there’s nothing to update.

Originally posted on blog.ninepointlabs.com.

Seven Nine Point Labs apps now run on any Linux, with AppImages

Tim Apple — Mon, 19 Oct 2026 23:55:23 +0000

Nine Point Labs apps are made for Omarchy first, and that isn’t changing. But they shouldn’t stop at Omarchy. As of today, seven of them also run on Ubuntu, Fedora, openSUSE and most other Linux distributions: every release now comes with an AppImage that runs on most x86_64 Linux systems and fits properly into your desktop.

What’s new

These releases went out today, each with a -x86_64.AppImage attached next to the usual packages:

The Python and Qt apps carry their own Python and Qt inside the AppImage, and Hyprfall carries its own Quickshell and Qt, so there’s nothing else to install. They run on most systems from about 2021 or 2022 on (glibc 2.34 or newer, 2.35 for Hyprfall): Ubuntu 22.04 and later, Debian 12 and later, Fedora, openSUSE and others.

It behaves like a real app

Download it, make it executable and run it:

chmod +x dogear-0.1.1-x86_64.AppImage
./dogear-0.1.1-x86_64.AppImage --install-desktop-entry

--install-desktop-entry puts the app in your application menu with its proper icon, so it shows up correctly in your launcher, taskbar and dock. Dogear also offers itself for PDFs, and Jubako opens .jubadb files. If you’d rather let a tool manage it, Gear Lever and AppImageLauncher both pick these up. Each AppImage has a .sha256 and a .zsync file next to it for checking and updating.

A few app-specific notes

Repokase and Dogear now follow your desktop’s light or dark setting when they’re not on Omarchy. On Omarchy they still follow your theme.
Dogear 0.1.1 also adds an About screen and works better in narrow windows, like half a screen in a tiling window manager.
Rune 0.8.6 packages for Arch, Debian and Fedora now install Rune’s AppStream info and icons in every size, so software centers and menus show it properly.
Bahá’í Reader 0.1.4 adds a Flatpak bundle as well, bahai-reader-0.1.4-x86_64.flatpak. It brings its own Python and GTK through the GNOME runtime, so it runs even where your system GTK is too old. It’s a download on the release page, not a Flathub listing. If your system’s Python or GTK is too old for the AppImage, the AppImage now tells you so and points you to the Flatpak.
Hyprfall 0.1.4 now needs Quickshell 0.3 or newer. Fedora’s Quickshell is older than that, so the Fedora package is gone and Fedora players should use the AppImage, which brings Quickshell 0.3.2 with it.

Get them

On Omarchy and Arch, nothing changes: install the .pkg.tar.zst from the release, or let Autonomix CLI pick the right download and keep the app updated:

autonomix-cli add https://github.com/ninepointlabs/dogear

On any other Linux, grab the AppImage from the release pages above. From here on, every new Nine Point Labs desktop app release ships an AppImage, and a Flatpak bundle will join it on the release page starting with each app’s next release.

Autonomix CLI 0.4.3: one password prompt for Update All

Tim Apple — Mon, 19 Oct 2026 14:45:24 +0000

If you track several GitHub-release apps with Autonomix CLI and hit “Update All”, you probably met the same password dialog over and over. 0.4.3 fixes that: updating several apps now asks for your admin password once.

What changed

Before, autonomix-cli update (and “Update All” from the Omarchy bar widget) installed each update on its own, so polkit asked for your password once per app. Now it downloads every update first, then installs them all in a single pacman -U, apt-get install or rpm -Uvh call. One install, one prompt.

Failures are clearer too:

A failed download only affects that app. It’s reported as failed, and the rest still install.
A failed install names everything in it. If the combined install fails, every app in the batch is reported with the installer’s error.
Cancelling says so. Closing the polkit dialog now shows “authentication cancelled” instead of a bare exit code.

The --json output is unchanged, so the bar widget keeps working as it is. No update needed on that side.

Also new since the last post

0.4.2 added an About screen. Press i in the TUI to see the version, the MIT license, a support email and a privacy statement, or run autonomix-cli about from the command line.

Get it

Autonomix CLI tracks itself, so if you already have it:

autonomix-cli update

New here? Add it once and it keeps itself current:

autonomix-cli add https://github.com/ninepointlabs/autonomix-cli

Packages for Arch, Debian/Ubuntu and Fedora (amd64 and arm64) are on the v0.4.3 release.

Originally posted on blog.ninepointlabs.com.

Dogear: a PDF reader for studying, made for Omarchy

Tim Apple — Mon, 19 Oct 2026 11:31:39 +0000

Class handouts, workbooks and textbooks mostly arrive as PDFs now, and most PDF readers treat them as something to look at, not something to work in. Dogear does what you’d do to a paper textbook: highlight in several colors, write notes next to what you highlighted, fold the corner of a page, and fill in the blanks on a worksheet. When you’re done, it exports everything to Markdown, for example straight into your Obsidian vault.

dogear.ninepointlabs.com (with a narrated demo video) · v0.1.0 on GitHub

Mark it up like paper

Select text and press 1 through 5 to highlight it in yellow, green, blue, pink or purple, or press a to highlight and write a note in one go. Hover a highlight to read its note; notes also show in the sidebar and as markers in the margin. Press b to bookmark a page (it gets a folded corner, named after its table of contents entry), and keep general notes about the whole document with Ctrl+N.

Dogear remembers the page, scroll position and zoom for every file, so opening a handout again puts you back where you stopped.

Fill in the blanks

This is what sets Dogear apart. Worksheets leave lines for answers, and in Dogear you just click the line and type. There’s no text box to place: it finds the line in the rendered page (drawn rules, runs of underscores, dotted lines), writes on it in blue ink at the size of the page’s own text, and shrinks a long answer to fit a short blank. Tab jumps to the next blank, so a whole fill-in-the-blank page can be done from the keyboard. Ruled lines under a question become one answer that wraps from line to line.

A library that remembers your marks

With no PDF open, Dogear shows a library of every PDF you’ve opened, with how many highlights, notes, answers and bookmarks each has. Search reaches inside your marks too, so a word you highlighted three weeks ago finds its handout. You can sort, file documents under categories, and give them your own names (“Book 3: Children’s Classes” instead of a 60-character file name) without renaming the file.

Dogear never changes your PDFs. It keeps a copy of every PDF you mark up, so your marks always have their PDF even if the original is moved or deleted. Everything lives in one folder, ~/Documents/Dogear by default, that you can sync between computers with Syncthing, Dropbox or Google Drive. If two computers change the same document before syncing, Dogear merges the conflict copy back in and keeps every mark from both. It also notices a re-download or new edition of a book you’ve marked up and offers to bring your marks over.

Into Obsidian

Ctrl+E writes a Markdown file per PDF: document notes first, then one section per page with highlights as quotes (page and color included), each note under its highlight, bookmarks, and every worksheet answer under its full question, so the export reads without the PDF. Categories come along as Obsidian tags. Point the export folder at your vault in Settings and your study notes land where the rest of your notes live.

Native to Omarchy

Dogear is keyboard first, with Vim-style reading keys (j/k, J/K for pages, / to search) and Ctrl for commands, leaving Super to Hyprland. It follows your Omarchy theme and repaints the moment you run omarchy theme set, and it makes room in narrow tiling windows. No account, no network access and no telemetry.

Install v0.1.0

On Arch and Omarchy, install it with autonomix-cli, which also keeps it updated from GitHub Releases:

autonomix-cli add https://github.com/ninepointlabs/dogear

Or download dogear-0.1.0-1-any.pkg.tar.zst from the release page and run sudo pacman -U dogear-0.1.0-1-any.pkg.tar.zst. pacman pulls in pyside6 and qt6-webengine (for the Qt PDF library). Dogear then shows up in your app launcher and can open PDFs from the file manager.

MIT licensed. Questions or bugs go to help@ninepointlabs.com or the issue tracker.

Originally posted on blog.ninepointlabs.com.

folderblog 0.2.3: Better link previews, optional visitor counts, and safer deploys

Tim Apple — Mon, 19 Oct 2026 11:30:01 +0000

folderblog turns a folder of Markdown into a live blog the moment you save. Two releases since the last word here, 0.2.2 and 0.2.3, make what it publishes look better when it’s shared and searched, add an opt-in visitor counter, and stop a blog kept in git from deploying half-finished work.

Share images for every post

Add image: to a post’s front matter, either a path inside the blog or a full URL, and it becomes that post’s og:image and twitter:image. folderblog writes it as an absolute URL and adds the width and height when the file lives in the blog. Posts without one fall back to static/og-default.png, or to a new optional image key in blog.toml.

---
title: "My post"
image: img/cover.jpg
---

folderblog check warns when the image doesn’t exist, so a typo doesn’t quietly ship a broken preview card.

Search engines get the whole picture

The default theme now gives every page a meta description, a canonical link, the full set of OpenGraph tags, and a twitter:card. Post pages carry BlogPosting structured data (JSON-LD), and the home page has a single h1 with the site title.

folderblog also writes a robots.txt by default that allows everything and points to the sitemap. If your blog has its own static/robots.txt, or your theme provides one, yours wins. And check now warns when blog.toml has no description.

If you keep your own copy of the theme in theme/, your templates are left alone. Copy the new default theme’s _layouts/base.html and post.html to pick up the tags, and run folderblog agents-md --write in each blog folder to refresh its AGENTS.md.

Optional visitor counts with GoatCounter

Want to know whether anyone reads the thing? Add one section to blog.toml:

[analytics]
goatcounter = "https://you.goatcounter.com"

Every rendered page gets GoatCounter’s cookie-free counting script, with any theme and no template edits. It’s off by default: with no [analytics] section the output is byte-for-byte what it was before. It’s never added by preview or build --drafts, so your own drafting doesn’t count as visits, and check flags an invalid URL.

Hold deploys while you’re mid-git

0.2.2 added deploy_branch for blog folders you keep in git:

deploy_branch = "main"

With it set, folderblog only deploys while the folder is a checkout of that branch. On another branch, a detached HEAD, or in the middle of a merge, rebase or cherry-pick, the deploy is held and shows as held: ... in folderblog status. It retries on its own once you’re back on the branch. Leave it unset and nothing changes. This blog runs with it on.

One note for both releases: older versions reject unknown keys in blog.toml, so upgrade before adding image, [analytics] or deploy_branch.

Grab it

System	Command
Arch / Omarchy	`sudo pacman -U folderblog-bin-0.2.3-1-x86_64.pkg.tar.zst`
Debian / Ubuntu	`sudo apt install ./folderblog_0.2.3-1_amd64.deb`
Fedora / RHEL / openSUSE	`sudo dnf install ./folderblog-0.2.3-1.x86_64.rpm`
autonomix-cli	`autonomix-cli add https://github.com/ninepointlabs/folderblog`

The packages and a plain tarball are on the v0.2.3 release. New to folderblog? Start with the guide, or run folderblog guide.

Originally posted on blog.ninepointlabs.com.

Linkguard: catch dead links and swap in archived copies

Tim Apple — Mon, 19 Oct 2026 11:23:21 +0000

Every blog rots a little. The post you wrote two years ago still reads fine, but a third of its outbound links now land on a 404, a parked domain, or a redesign that ate the page. Linkguard is a free GitHub Action that finds those links in a Jekyll, Hugo, or folderblog site and points readers to an archived copy instead.

linkguard.persistwise.com · v0.1.0 on GitHub

What it does

Drop it into a weekly workflow and Linkguard walks your content, pulls every outbound link out of the markdown and HTML (skipping code blocks, comments, relative links, and private addresses), and checks each one. Every link comes back as one of four results:

ok works, or only moved from http to https
moved still works but redirects somewhere else, so you may want to update it
dead is a 404 or 410, or an outage that survived retries
blocked is bot protection (401, 403, 999), and Linkguard never calls those dead

For each link it also asks the Internet Archive’s Wayback Machine for a snapshot. When a dead link has a good one, the report hands you the archived URL. Results land in the run’s job summary as a table, as warning annotations on the exact source lines, and as JSON and markdown report files.

It checks politely: one request per host at a time, at most four in flight, retries with backoff, and Retry-After honoured.

Two modes, no account required

Lookup-only is the default. No secrets, nothing captured, just checks and existing snapshots.

Snapshot mode turns on when you add your own free Internet Archive keys as repo secrets. Linkguard then asks Save Page Now to capture working links that have no recent snapshot, so a copy exists before the page dies. Captures count against your own Internet Archive account and are paced to six a minute, so a first run over 100 links can take a while.

Fix it with a pull request

Set open-pr: true and Linkguard opens a pull request that replaces each dead link with its web.archive.org copy, exactly where it appears and nowhere else. The PR lists every swap and says plainly that each one is an archived copy, not the original. It never pushes to your default branch, so you review before anything changes.

Get started

# .github/workflows/linkguard.yml
name: Linkguard
on:
  schedule:
    - cron: '17 6 * * 1' # weekly
  workflow_dispatch:
permissions:
  contents: read
jobs:
  links:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: ninepointlabs/linkguard@v0.1.0

It detects your site type from the repo layout, or you can pass site-type and your own paths. Ready-made workflows for Jekyll, Hugo, and folderblog are in the repo’s examples/ folder, and the README documents every input and output.

The free tier checks 100 unique links per run; anything past that is skipped, and the log says how many.

Honest limits and privacy

This is a first release. Snapshot capture and open-pr are covered by mocked tests so far, the Internet Archive doesn’t publish its rate limits, and its availability API sometimes misses a snapshot that exists. A link that’s down for a GitHub runner can still be up for people, so read the report before you merge.

There’s no telemetry and no Linkguard server. Only link URLs go to archive.org; your file contents never leave the runner. MIT licensed. Problems go in the issue tracker.

Originally posted on blog.ninepointlabs.com.

Autonomix 0.4: JSON for frontends, and a bar widget that uses it

Tim Apple — Mon, 19 Oct 2026 11:21:37 +0000

Autonomix CLI already tracked your GitHub Releases apps from the terminal, and on Omarchy it could ride along with omarchy update. What it could not do was talk cleanly to another program. Today that changes: 0.4 ships a JSON surface for every command, and omarchy-autonomix is the first bar widget built on top of it.

Why it matters

GitHub-release apps live outside the Arch repos. You want a count on the bar, a panel to install or update, and a password dialog — not a second terminal ritual. The CLI stays the source of truth in ~/.autonomix/config.json; the widget is just a frontend that speaks --json.

What’s new in autonomix-cli 0.4

--json on every command. add, list, check, update, install, and remove print structured objects on stdout and keep progress on stderr. Errors come back as {"error": "..."} with exit code 1.
list, install <app>, and remove <app> for frontends that need to drive one app at a time. remove stops tracking; it does not uninstall.
check and update take app names — by name, repo, owner/repo, or URL — so you are not forced to refresh everything.
add owner/repo works without pasting a full URL.
pkexec when there is no terminal, so a graphical frontend gets Omarchy’s polkit dialog instead of a silent sudo failure.
No surprise downgrades. Update detection now compares versions the way pacman does; only a newer release counts. The Omarchy post-update hook will not yank you backward.

Grab 0.4.1, not 0.4.0: the first 0.4 release mistook /dev/null for a terminal and reached for sudo from the bar. 0.4.1 asks the terminal driver properly, so installs from the widget get a password prompt.

The new Omarchy bar widget

omarchy-autonomix is a Quickshell plugin: a package icon with an update count, and a panel that lists tracked apps, installs or updates them, and lets you track owner/repo or a GitHub URL without opening a terminal. Middle-click the icon to check GitHub now. It needs autonomix-cli 0.4+ at /usr/bin or /usr/local/bin.

git clone https://github.com/ninepointlabs/omarchy-autonomix ~/Projects/omarchy-autonomix
~/Projects/omarchy-autonomix/install.sh
omarchy plugin enable ninepointlabs.autonomix

Grab the CLI

autonomix-cli add https://github.com/ninepointlabs/autonomix-cli
# or update if you already track it:
autonomix-cli update

Packages for Arch, Debian/Ubuntu, and Fedora are on the v0.4.1 release. If you are still on the October 11 updater post, this is the next chapter: same list of apps, now reachable from the bar.

Originally posted on blog.ninepointlabs.com.