beat
@beathagenlocher.com
Mostly random stuff I find interesting, or other sharable thoughts that cross my mind. https://beathagenlocher.com
It's very exciting that AI can now take substantial real-world software like zlib and prove it correct (github.com/kim-em/lean-...). @kirancodes.me found a bug by fuzzing, but it was outside of the boundary of what was verified (kirancodes.me/posts/log-wh...). That doesn't diminish the excitement!
Lean proved this program was correct; then I found a bug.
AI agents are getting very good at finding vulnerabilities in large-scale software systems.
kirancodes.me
I just spent 1 1/2 hours reading this absolutely amazing blog post by @iankduncan.com: www.iankduncan.com/engineering/... And if you're likely to get nerdsniped by me mentioning #distributedsystems, #functionalprogramming, you definitely should read it too.
What Functional Programmers Get Wrong About Systems - Ian Duncan
Type systems verify properties of programs. Production correctness is a property of systems. The gap between these is where the interesting failures live.
iankduncan.com
Just discovered an actually-useful Nutrient Ranking Tool, and thought I'd share :) #Nutrition #LessWrong #AminoAcids
PSA: If you're writing CSS, value simplicity, and don't know about Fluid (Type) Scales yet, you should check them out :) #CSS #Design #Simplicity
Anyone knows if there is a chart with all the AT Protocol apps users over time? Would love to see popular and trending apps using AT Protocol!
Reason number 627383 having a blog is awesome... Leo from Beekeeb read my 36 key / RSI post and included a pre-release Toucan 36, keeb in my chocofi order. totally unexpected. totally awesome. thanks Jenny & Leo! shop.beekeeb.com for some awesome hand made keebs.
Wrote a piece about functional programming in TypeScript on the frontend for the company blog: funktionale-programmierung.de/en/2026/03/0... :)
Funktionale Programmierung - Functional Programming by Example: Refactoring a TypeScript/SolidJS Application | Part 1
Learn to make illegal states unrepresentable in TypeScript with tagged unions and explicit modeling.
funktionale-programmierung.de
For the first tutorial after lunch at #BOBkonf2026, @beathagenlocher.com presents "Functional Programming in TypeScript" on track A. Read more here: bobkonf.de/2026/hagenlo...
Learned something about package.json postinstall scripts :) #npm #JavaScript #TypeScript #bun #pnpm #TIL
I've added a bit more barebones Nix stuff that can be confusing at first :) #Nix #OS #ProgrammingLanguage #nixpkgs #NixOS #FunctionalProgramming #DeclarativeProgramming
I wrote a very simple introductory note I'd really enjoyed reading some years ago: Setting Up A Server (with NixOS and Clan) #ssh #TheInternet #IP
![# 1. Getting the server
As with most things, setting up a server is relatively straighforward once you know what you're doing.
So, what you want is:
- a machine that runs on the internet for you, awaiting your requests and which
- you can reach from anywhere.
Since both the 'is reachable' and the 'runs constantly' parts are relatively hard to provide when you're just starting out (and probably only have a laptop/phone), you want to go to someone who's _job_ is to provide these two things for this (That's called a _Hosting Provider_).
For starting out, the thing you're looking for is the cheapest option of a _Virtual Private Server_ (called VPS).
So for finding what you're looking for, google something like `hosting provider vps cheap reddit`, and see what's currently in store.
(This should be about 5€/month)
Then go onto the site of your choice, create an account, and rent the VPS you want.
For Hetzner in 02/2026 (the provider I'm currently using), this is something like:
- [x] Cost-optimized
- [x] CX23
- [x] Somewhere in the EU, preferably close to where you are
- [x] Ubuntu (but we're gonna change that later)
- [x] both a IPv4 and IPv6
- [ ] your _ssh keys_ (You might be wondering: What are _those_?)
- [x] and a name
That's it.
> Except for the ssh keys.
## Generating ssh keys
An _ssh key_ is a thing you can use to verify you're you to someone else.
For now, the only thing that's important about them is that our server can let us login without a password if we have the correct ssh key available on our system.
So what we need to do is generating a key pair (a private key with a matching public 'lock', confusingly also called a key), and then depositing the _public_ key of the pair (so the _lock_) on the server.
With this, the server will be able to tell that we're allowed to login whenever we log in from a system that has the private key of this specific key pair.
With this knowledge:
<Il href="/setting-up-git#1-generating-the-ssh-key-pair">Generate the ssh key pair</Il>
And then upload the public key to the hetzner.
You can check that everything worked by `ssh`ing onto your server:
If you're _not_ prompted for a password, everything worked.
# 2. Put NixOS on the server with Clan
Now for the important part. Just having a server means manual, stateful configuration, and we're not going to do that.
Instead, we're going to use NixOS with Clan.
Follow Creating your first Clan.
And that's it.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreicjs4e7ws2cjdryx2snoomebckxhqvbboedmm6kbzsb2ehcsdbfgq)
I've recently set up Immich on my home server (with Clan), and half-finished a note on this :) #NixOS #Clan #Immich #HetznerStorageBox #Samba/CIFS #FileSystemMount
![Today, I spent some time getting my photo setup together, (and away from manually uploading them to my storage box from time to time 😬).
So I've decided I'd give Immich (as a self-hostable photo solution on my server) a try.
<Callout type="info">
In case you don't know yet how to get and set up a server, take a look here: Setting Up A Server (with NixOS and Clan)
</Callout>
# Setting up Immich
Setting Immich up with NixOS is relatively straightforward, at least at first glance:
```nix
services.immich = {
enable = true;
host = "photos.example.ts.net";
};
```
But since I'm not running a Tailscale network (yet, I guess?), I need to make my immich service reachable from the outside.
This looks like this:
```nix
services.immich = {
enable = true;
};
services.caddy = {
enable = true;
virtualHosts."photos.your.domain" = {
extraConfig = ''
reverse_proxy 127.0.0.1:2283
'';
};
};
```
<Callout type="info">
For this to work, you need to:
- own a domain
- set a DNS A record to `photos` -> "IPv4 IP of your server", e.g. `1.12.234.45`
If you don't know how to do that, take a look here: Setting A DNS Record On A Domain
</Callout>
Now we've got a machine running Immich that's reachable from the outside via a domain.
Meaning: You should be able to go to `https://photos.your.domain`, and see the Immich login screen.
So that's it—almost.
# Mounting a storage box
We've still got one problem:
The machine this is running on is the smallest Hetzner VPS: powerful enough to run Immich, but not large enough to host all the photos.
It's got only 40GB of disk space, and upgrading that gets expensive fast.
So you probably don't want to store photos on there.
Thankfully, Hetzner also has a service called a _Storage Box_.
A Storage Box has the opposite characteristics to a VPS: It's pretty cheap per TB, but you can't really run anything on it.
So, let's match the two.
What we're going to do is the following:
We will mount the storage box as a file system into the folder in which Immich is going to store its data in.
For this, you need to:
1. Have a Storage Box (so rent one)
2. Create a new sub-account (with corresponding subfolder) on it. _Save the password for this into your password manager_
3. Mount the subfolder into our server
Mounting the subfolder looks like this:
<Draft>
```nix
services.immich = {
enable = true;
};
services.caddy = {
enable = true;
virtualHosts."photos.your.domain" = {
extraConfig = ''
reverse_proxy 127.0.0.1:2283
'';
};
};
environment.systemPackages = [ pkgs.cifs-utils ];
fileSystems."/var/lib/immich" = {
device = "//uXXXXXX-subX.your-storagebox.de/uXXXXXX-subX";
fsType = "cifs";
options = [
"x-systemd.automount"
"noauto"
"x-systemd.device-timeout=5s"
"x-systemd.mount-timeout=5s"
"credentials=${config.clan.core.vars.generators.storagebox-immich-secret.files."credentials".path}"
"uid=immich"
"gid=immich"
];
};
```
- vars setup
- add the secret to vars
- issues
- immich can't write or read the files
- with disabled machine learning the server dies, and I don't know why
</Draft>
# Notes
<References>
<ReferenceLink href="https://forums.linuxmint.com/viewtopic.php?t=333084">Samba Storage Share </ReferenceLink>
</References>](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreih3ncd5v6bq63d63qsr27mbgi4cxlxup7v652gls5wzxakkgjvrji)
![Over the last week, I learned that it's possible to have multiple desktop portals (_implementations_, I guess?) for Wayland active, and even specify which one to choose for which to choose which one.
This is what this looks like:
```nix title="home.nix"
# ...
xdg.portal = {
enable = true;
extraPortals = [
pkgs.xdg-desktop-portal-gtk
pkgs.xdg-desktop-portal-gnome
];
config.common = {
# for files, mainly, since my nautilus takes ages to load
default = "gtk";
# screen sharing doesn't work otherwise on GNOME
"org.freedesktop.impl.portal.ScreenCast" = "gnome";
"org.freedesktop.impl.portal.RemoteDesktop" = "gnome";
};
};
# ...
```
Link to the config](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreihdijatrw2m4zfkpgz5nhsvp77v5c7nuelqxmjr3wg4khp54mj6om)
![Today I finally tackled something that has annoyed me for a while since switching most of my editing/digital gardening/second brain-writing over to Emacs.
Whenever I took 30 minutes and tried to get title fetching of links to work, I couldn't get it to work in this self-allotted time. So I asked Opus to do the dumbest thing possible: Just fetch it via curl, and then apply stuff asynchronously.
(Obviously the other, non-dumb way should work too, but I've spent way to much time on this now either way.)
(And apparently there's also `url-insert-file-contents`, maybe I'gonna try that some other time.)
```elisp
(defun flt--url-at-point ()
"Get URL at point, or nil."
(thing-at-point 'url))
(defun flt--url-from-kill-ring ()
"Get URL from kill ring if it looks like one, or nil."
(let ((text (current-kill 0 t)))
(when (and text (string-match-p "\\`https?://" text))
(string-trim text))))
(defun flt--get-url ()
"Get URL from point first, then kill ring. Nil if neither has one."
(or (flt--url-at-point)
(flt--url-from-kill-ring)))
(defun flt--extract-title (html)
"Extract <title> content from HTML string."
(when (string-match "<title[^>]*>\\([^<]*\\)</title>" html)
(string-trim (match-string 1 html))))
(defun flt--insert-markdown-link (url title marker)
"Replace URL at MARKER with a markdown link, or insert at MARKER."
(with-current-buffer (marker-buffer marker)
(save-excursion
(goto-char marker)
;; If there's a raw URL at point, replace it
(let ((url-bounds (thing-at-point-bounds-of-url-at-point)))
(if url-bounds
(progn
(delete-region (car url-bounds) (cdr url-bounds))
(insert (format "%s" title url)))
(insert (format "%s" title url)))))))
(defun flt-fetch-link-title ()
"Fetch the title of a URL (at point or kill ring) and insert a markdown link.
If point is on a URL, replaces it. Otherwise inserts at point."
(interactive)
(let ((url (flt--get-url)))
(if (not url)
(message "No URL found at point or in kill ring.")
(let ((marker (point-marker))
(buf (generate-new-buffer " *flt-curl*")))
(message "Fetching title for %s..." url)
(make-process
:name "flt-curl"
:buffer buf
:command (list "curl" "-sL" "-m" "10"
"-H" "User-Agent: Emacs"
"--" url)
:sentinel
(lambda (proc _event)
(when (eq (process-status proc) 'exit)
(let ((title
(with-current-buffer (process-buffer proc)
(flt--extract-title (buffer-string)))))
(if title
(progn
(flt--insert-markdown-link url title marker)
(message "Inserted: %s" title url))
(message "Could not extract title from %s" url)))
(kill-buffer (process-buffer proc))
(set-marker marker nil))))))))
(map! :leader
:desc "->title" :nv "d f" #'flt-fetch-link-title)
```
And in the meantime, I also learned that _markers_ exist!
So now, I can fetch link titles again, like I'm used to :)](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreibd6gt3rjjg3jwc36prm3tew6scsri5wetrfto7jckquw7opoveae)
![An entry point for Nix stuff.
# Writing your first flake
Your flake is the entry point to your application built and run with nix.
Your flake is a function from `inputs` (which consist of urls for getting package sets) to `outputs`, with outputs being one big _attribute set_.
This `outputs` _attribute set_ looks something like this (very much like a JSON object):
```nix
# outputs
{
apps = { ... };
checks = { ... };
devShells = { ... };
formatter = { ... };
legacyPackages = { ... };
nixosConfigurations = { ... };
nixosModules = { ... };
overlays = { ... };
packages = { ... };
}
```
Every key in here is a special, magic key that Nix interprets in a certain way.
For the minimal (non-functional) flake:
```nix
{
inputs = {};
outputs = {...}: {};
}
```
all of them are empty.
Through populating them, we give our Nix Flake additional capabilities.
The first capability to give our Nix Flakes is normally a _development shell_.
In Nix Language, we create this like this:
```nix title="flake.nix"
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
};
outputs = { nixpkgs, ... }: {
devShells.x86_64-linux.default = nixpkgs.legacyPackages.x86_64-linux.mkShell {};
};
}
```
And run it via `nix develop` (getting it? The `devShells` output gets run by `nix develop`):
```shell
> nix develop
(nix-shell-env)>
```
But that doesn't do anything yet.
For it to do something we need to add something into the devshell:
```nix title="flake.nix" del={7} ins={8-10}
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
};
outputs = { nixpkgs, ... }: {
devShells.x86_64-linux.default = nixpkgs.legacyPackages.x86_64-linux.mkShell {};
devShells.x86_64-linux.default = nixpkgs.legacyPackages.x86_64-linux.mkShell {
packages = [ nixpkgs.legacyPackages.x86_64-linux.hello ];
};
};
}
```
(Run `nix develop`, and then we have the `hello` executable available.):
```shell
> nix develop
(nix-shell-env)> hello
Hello, world!
```
Let's clean this up a bit, and then we're done for now.
There's lots of repetition in the current file, and the solution to this is not as easy as inserting a `let` block.
The accepted and easily extensible solution for this is flake-parts, but their homepage is pretty hard to understand at first.
We want to translate our example to this:
```nix title="flake.nix"
{
inputs = {
nixpkgs.url = "https://github.com/nixos/nixpkgs?ref=nixos-unstable";
};
outputs = inputs@{ flake-parts, ... }:
flake-parts.lib.mkFlake { inherit inputs; } {
systems = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin" ];
perSystem = { pkgs, ... }: {
devShells.default = pkgs.mkShell {
packages = [ pkgs.hello ];
};
};
};
}
```
This even has the benefit that it will work on all the systems specified.
<Draft>
# Evaluated Flake top level
You can inspect your flake like this:
```shell
nix repl .
> :load-flake . # shorthand ':lf .'
```
```nix
{
_type = "flake";
inputs = { ... };
outputs = { ... };
sourceInfo = { ... };
}
```
</Draft>
<References>
<ReferenceLink href="https://www.youtube.com/watch?v=JCeYq72Sko0">vimjoyer flakes guide</ReferenceLink>
</References>](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreifjretp7fvufhufqv2hnfgdfcuykkpse7saigqzsdfq4vhnqcaeru)
![After getting annoyed by the default sqlite Command Line Interface (it doesn't even support `arrow up` ≙ last typed command), I found `litecli`
```nix title=flake.nix
# ...
packages = [
# ...
pkgs.litecli
# ...
];
# ...
```
in every sqlite project from now on :)](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreigs23yuc2f52ikekxhgx746pclcnxp3yngg5wt6pdy3ljehtdvhha)
