@moon

in the end i gave up in the design or well… can you even call it “design” when it was ugly even at teh start? yes, i tried my best at making it look “good” in my own eyes but i could not for the love of birds. it was bad anyways, like actually bad. I, to make it easy for my self and be able to copy how other people do it because i am a lazy bastard (stupid space birb that klanks its keyboard for nothing), will be using the typical two columns for each section. One for “what the heck is this section for” and the other for the actual content (wow).

man, i hate how the frontend is where i struggle the most when the backend should be where i should have struggled the most, not with this dude. agh. I also hate HOW i thought the layout i wanted initially was the best one and that i look great when in reality it was an aberration that didnt even look good and it really threw to the trash the unused space bruh. it just wasnt for this job, maybe for something else.. idk haha, what I know is that I think it already looks better with the simple sutff ive done lol [that’s sad btw :)].

as you may see int eh screen shooting, the audit log section instead of having a table it uses a… placeholder for a button with the same content it has currently because I frankly i am scared of making tables because of the probable difficulty i will have (because I am already struggling with teh simplest of things!).

ALSO, i need to stop making .scss files, compounded into a single css file using @layer and @use, to just use svelte components that use the style tag. it really doesnt change anything, but atleast i wont be doing “class=‘meow’” each time i want something, just using “” is half better lol (doesnt really fix anything, I just want to give use the svelte components).

finally, i am planning to use “services”.. they arent really services but more about wrappers around the openapi client. less manual labor for some shitty stuff that i wont need to do anymore. Still, its just a wrapper with nicer method names and namespaces.

(also, ill be adding profile pictures. didnt think i would be adding them tho)

here’s the typical dumb screenshot of what i think that looks “good” without doing that much work:

i am ashamed. i am that bad or… well ive gotten to the point of real badness and what some call “skill issue” because I CANT make this hecking frontend.

its just too hard, i am just way more slower than before and what i though i was. i hate that i am not usign tailwindcss and isntead I am building my own scss styles IN @layer when i could have been using svelte components with the style tag but ugh bad decisions that can be still reverted i guess. For the layout of the settings, i even tried copying how I did it in the last iteration of this frontend (past server, not named meow auth).. i just did not like it because using a sidebar for this teeny tiny amount of information is wasteful (like this tiny [not really tiny] space birb).

Like the content is just the typical name, email, auditlog, 2fa, passkeys, sessions, oauth authorizations and user created oauth apps AND lets not forget about the admin panel. i am practically suffering with mundane crap that anyone can have done in probably 10 minutes by asking mr claude or even chatgpt OR even just copying an already made layout, but here i am suffering trying to make stuff my own way, telling my self that this was the worst decision i’ve made goddamit… at this point i will really become a hotpot space birb soup..

i just need one layout made and then it should be an easy job to then copy and paste to other tabs. then the enxt step is to wire it up the forms and have it communicate to the backend which should be an easy task (i think [… oh god please be easy])… i know this entries of the frontend will make my project go into deflation mode and stuff, and i even broken a promise that ive made my self to not make devlogs that are more than 5h long because of a review someone made of my project when i submitted it unfinished to flavourtown (yes, flavortown) which is sad but it is what is. you cant be perfect, that’s why i have a shit hecking design. i am just bad, a bad space bird i guess.

i already rambled too much in this suppossedly simple devlog. here’s your half crap “inspiration” that I used to (quite literally did a C&P of the page) of my past proyect using a sidebar (not what i want with this iteration) and the current state of art of my REALLY REALLY SHITTY curernt state page:

hi hello. oh, ive been 10 hours doing the same thing!!1 god. So, I was doing the frontend design without using figma and uhh yes. And also removed the ability to use your login to.. login to the app. You just use your email (otp, and passkeys).

First, I forgot how to use figma, I only remember some shortcuts. I was going to use it (for frontend and logos) but seeing how struggled to make simple things, I only used it to swap the colors of the logo of MEOW AUTH, hmm yes, very meow. .

The frontend stuff… I frankly ALSO do not remember anything.. or well I do now remember some things thanks to me fighting to uncenter a div hah. The stack is practically svelte, as always, client rendered and scss (sassy :o) for the styling. In the start I was just going to use the same styling and structure of my first iteration of this project, beepauth (ew), and after doing all of that I thought “god, this looks pretty bad”, soo I then tried to make it look a bit better WITHOUT starting from zero again. And I did style it a bit better but I didn’t even like it. Like it felt like I hadnt even advanced at all, like if the same shitty fricking backend was the same from the past (probably noone would care because probably uhh noone cares.) [brains a weired and even more mine i guess, wawa].

So, naturally, i did the less sane thing, REDOING EVERYTHING again. Had to watch tutorials to relearn how use sass and picked up also some new css stuff that I wont even use (minus the layers! that pretty cool!!). And from that css stuff I discovered Oklch.. yes i swapped my whole color palette to that using their harmonizer that uses the equivalent of WCAG, APCA (contrast bg to text!).

At least the frontend now looks decent (or the first blocks fo the website). sadly the only frcking shitting heckign parts ive made are the login (and register BUT THATS THE SAME).

AWIT WAIT WAWA, I also swapped some gears in the BACKEND! I removed the login (username) entirely, now its just demoted to a non unique display name (for openid!). you must be asking why, because I changed it to use the login not long ago. Well, because I don’t have to force a user to give me a username AND their email on signup. Its easier to just give the email. And if you already have an account and hit, without knowing (our typical autopilot mode), the signup page, I can silently make a AuthChallenge for login instead of signup because both handlers return the same result. Then, after registering, I just force you to set a display name (by default its just the email, i could leave it like that but currently I want it to force you set a custom display name for OPENID).

By doing that, I practically removed the “vectors” (ooh hackiry stuffiry) for user enumeration [those vectors were the endpoints to see if a login (username) or email was already taken] (I also made so the login endpoint gives you a fake challenge id when the email doesnt exist {This works thanks to having the auth exchange handlers return “invalid code” even if the challenge doesnt even exist}).

here’s your screenshot of a login page that looks exactly like very other login page, maybe even shittier (sorry i am bad doing these kinds of things.) [also you have the logo colors, i went with purple because it looks cool and its a cool color] {the “Psst, over here” its just a random greeting, just like the ones i have in the emails} [[sorry for wasting 10 hours doing nothing]]:

a. hi there mr svelte! I was wondering if I should be drafting first a design in figma but meh. I like to suffer and make bad designs that progress very slowly to look mediocre at best! yay!1!!

anyways, ill be using scss as always (i frankly done even remember anything about it lol) and sveltekit. HERE’S YOUR stupid “hello world” from slevetkt (reaaly useful devlog):

oopsy. shoooort one, sorry. I added the forgotten oauth error StatusCodes and Descriptions.

there’s not much to it lol, I just forgot about it.
as always, here’s your even uselesser screenshot with code taht you can already see in the guthub:

right, its a me! the teeny tiny waist sized space birb that is here to tell you that I added the ratelimiter!

It works just as i’ve explained in the last entry, it uses the IP of the user to limit the amount of requests via a ticket bucket. THe bucket is stored in memory, as again said before, so if the instance is restarted, goodbye ratelimits. EAch request eats 1 ticket AND the bucket tickets and refill rate can be set via the… middleware. who would have known wow. It always adds the typical “x-ratelimit-limit” bleh bleh bleh with all the info you can like that is useless BUT hey, its there for you.

I like making my own stuffies because its cool. THe root has a limit of 500 requests, refilling after 1 second. While the auth routes have a limit of 10 (sudo) and 20 (auth flows) requests, refilling after 1 minute. The other routes are just uhh protected under the umbrella of the root ratelimiter lol, no need for having to add a ratelimiter to every single route (god).

that’s it. there’s no more devlog. Now what i gotta start doing is the frontend. I will cry a bit because I am VERY very VEEERY rustified in the typescript department like I never touch it but meh I MUST do a frontend or else this is incomplete… and i will do be crying if i send it off in a incomplete state. THE frontend will be in svelte kit, because its cool and ive already used it in the last iteration and it left me with a good taste in my forked tongue (hahaha, i am space birb) AND thanks that Ive been using from the start utoipa to add an openapi schema, I can use it easily to make requests from the frontend! and i didnt need to suffer adding them after everything was done just like in the past iteration!

here’s your useless screenshot showing teh ratelimiter working and the headers and stuffies… god i am a mediocre at best writting long hecking devlogs for nothing:

wow. that’s a long time doing nothing. I just updated the deps, tera had a change on its templating because it was rewritten from the ground up. pretty cool, now it kinda looks like jsx and at the same time not.

I also tried or well… I am thinking about making my own ratelimiter but was like, ugh. I was practically mega blocked on the idea of wanting a ratelimiter that used the IP + UserId. Both are easy but for some goddamn reason I kept going circles and circles and honestly I dont even remember why anymore, like huh!? In the end I will only be doing ratelimits via IP because they are the easiest AND THEY DO NOT NEED TO be stored in the database. yes database, you read it right. IN this version of my backend I wanted to use the least things AAANd the oNly thing required is just the database to make everything. Adding redis would be waste (and waste of ram) for just storing the ratelimiter.

Redis would be required if I wanted to run more than 1 instance of my application AND IF i wanted to distribute the info about “oh this guy is grounded, no entering the meow auth realm for 5 minutes” to all other running instances. BUTTT, as you might not see, I dont want to run more than instance nor want to distribute it to more instances if it were the case that I wnted to run more than 1 instance.

Soo, I went in circles in my crapppy bird brain because to add ratelimits via the user id I would have to store the info somewhere that wouldnt be erased (like in the in-memmory storing that i will be using) or else the ratelimits would be useless because… THEY WOULD BE ERASED from this whole realm when the instance is restarted (memory goes boom to the void, so does the ratelimiter).

That’s why I want to just implement the Ip based one, its the easiest one and the only one that I don’t care about loosing the information about the ratelimits when the instance is restarted. Also, i need to implement it yet lol i was just scrambling my head nuts and bolts hearing them clank while trying to ratchet them.

ALSO², i need to redo the email stuff because my brain has came up with a cool design lol but first gotta do the frontend to make it uhh look good before suffering making the email components.

I also started to hate the tera zed language extension. its crap. bad crap the worst one. ALSO, here’s your really useless screenshot this time showing code that you can already see on the github page (yay!1):

hello again, its a me, a random space birb that is here to tell you that I completly forgot about the ratelimiting stuff. BUUT, I added the admin methods and UserFlags to be able to set… flags. not much rodeo this time.

had to think how i wanted the audit logs to work for the admin stuff. I first though about just having a bool saying “ah yeah admin” but meh, I think its better to have also an “actor_id”, the who did it user id, and boom. In the user side handlers for the audit log I just return the typical plain response of “yeah this was changed” (not sql joins, cheaper [?]) but in the admin side, I return the actor_id with some other things like the user login of the actor AND the user login of the user that was changed (cause why not!? its jsut another join statement in sql). Works wonderfully and even better now because before I had setup the user audit log to fetch AAAL the entries form the db and pee pee poo poo no, now that i have my paginated stuff, no way!

SOO, the admin methods are just the typical ones, see what the user has changed or an admin changed from an user via its audit logs, the oauth applications and authorizations management and that’s it. I will probably also add a way to know globally what the heck is being changed but idk about that, seems a big sql query (that is tiny but very costly in db terms) and I frankly want to avoid that… and even more avoid using redis because i hate it and that SOMEHOW i have better some beautiful organized code vs the first version of this backend where I used the typical DB+redis aaand it was ugly. i hate that.

I also added the UserFlags to be able to set flags like “is the user an admin?” or “is this user allowed to manage its oauth applications?” and so on. Pretty cool.

BUUT as always, I had to C&P some code (almost all of it) from past handlers to make the admin handlers work lol. I would really want to make a central place to put all the common handler code but meh. IT WORKS! and that’s what matters.

THe next things are just making the ratelimiting WHICCHC probably will be only inside the instance the user is reaching and that’s it. I would like to have global ratelimiting using the IP of the user or its account id but that would (i think) require redis… I really need to think about this because someone with a crappy toaster can make explode my poor baby vps.

ps. god do I really take that much time doing stuff? god i am slow at coding. i am bad goddamit.

that’s it. shallllll you see my shiitty api docs with the admin stuff and admin auditlogs becuase why not:

hi and welcome to my unreadable journals. I added those oauth authorized applications management handlers that I forgot to add yesterday, like the typical “oh let me see what scopes does this thing use… OH GOD IT CAN SEE MY fur color I MUST revoke it NOW!11”.

Then I moved AAAL the handlers that touched ME user data to the.. obvious /me route so its prettier and doesnt pollute the air of the real auth related things. and did some cleanup in the http error department by merging some repeated errors.

god this is one of the shorter entries i’ve made i think. next up is doing ratelimting, probably roles or just an admin api and the “hey your account has been locked because of repeated tries to login”. i dont even know what will it take to make tests work god.

here’s your shitty screenshot showing my only progress, the oauth management bleh bleh bleh:

hi, hello i am space birb in the sad corner and i am here to tell you that i added the the typical oauth management handlers that everything has. I also added a generic paginated database thingy to be able to make… pages when there’s more than 20 items (rows).

firstly, everything was easy. yes, no rocks not nothing that could set me on fire… minus that I HAD TO MAKE a paginated database thingy. WHY did i make it? idk man, i wanted because my bad coder brain thought that maybe someone could have more than 1 oauth application created (like a thousand) and that’s pretty bad for mr blue elephant database becuase that means eating 1000 rows in one go (and blue elephant doesnt like that, AND EVEN less if my vps has 1vcore and not really that much ram). SO, the best course of action was to make pagination to be able to cut in pieces the data and make it easier to load and handle.. even though the loaded rows are hardcoded (its 20 plus 1).

The pagination practically works by seeing if there’s more data after 20 items (that’s why it has a “plus 1”!), if so, we take the LAST item’s id (using a trait to access it, because you can’t really know in what form or what id will be used in any database model) in those same 20 items to set the ‘next’ param. That ‘next’ param is used to.. quite literally say “hi, uh could you give me the next rows after this id pretty please?” and boom works and i didnt set my self on fire but i did ruffle my feathers a bit because of.

Ill probably implement it to more places because the only places that use it are the oauth applications and user sessions because i am a bit lazy haha (i mean, its just C&P the current find_many* and use the pagination stuff and caboosh).

oh god, i forgot about the oauth consent management. great job me, NOW IT ISNT COMPLETE “everything” great coder i am great big bird brain.

My next plans are just to do some general cleanup with the openapi schema, add comments to the code and then start doing the frontend in mr sveltekit.. although i am too rusty in ts land and i will have to learn some stuff again and touch again scss and stuffies and god, i am going to get cooked in the sun and roasted like the space birb i am because of me no longer touching anything javascript.

here’s your really useless screenshots showing the INCOMPLETE oauth management handlers and the pagination thingy working:

I made the User Info handler for the open id stuff. that’s the end of it. It works, wahoo my self yay good job, even though you had pretty much bad scrambled code, you did it hahaha.

It practically, as the openid spec says, returns the claims used also on the id_token. Soo, because its sooo close to the id_token, i’ve decided to just eat the that same id_token but spit out a converted version with things I want.

I also added the typical OauthManager and RequiresOauth. the latter one not having a param to decide what scopes you want because, whhy would you want that?! its just a one liner and it may change for each hecking endpoint or even the data the endpoint returns. its just over complicating it with wrapped trash.

… and about my devlogs, i realized that mine are pretty bad and not interesting like other people’s devlogs. i simply write weird and long ones. but i don’t want to write a simple “I did this, commits, hardness of implementing, whatever” in bullet points like other people do. i dunno it feels flat like this devlog.

Here’s you typical SINGLE screenshot showing that the user info works, that’s it:

oh hi, did not know that you are really reading this. I added the openid stuff! Well not all of it, I still need to do the ‘userinfo’ endpoint but meh, it works as it should.

I also added the cool JWK (the secret key [ES256] that is used to sign the JWTs) rotation stuff, which I can say that I tried at first over complicating it to then end up simplifying it because it was A HELL to use like you had to call a thousand hecking things or in one method give a thousand arguments (its an overestimation, probs not real [shy of 5, it wasnt generic, it was attached to the token flow] :3), it was a pain to use and IT EVEN GAVE ME a burn mark. As I said, I just redo’d everything and boom, simplified thigny you just call from the global state and boom, we do be working!

The JWKs are rotated every 2 months, and the old one is retired at the same time. After 1 month, the retired one is deleted. So, at any given time, there’s a maximum of 2 keys, the current one and the retired one. The retired one, as the name implies, is not used to sign new tokens but is still valid to verify old token. And all of this is fetched at startup and then via a scheduled job it is updated. AND as you might have (NOT) guessed the JWKs are stored in the database, so if you have multiple instances of mah meow meow server running, they all share the same JWKs and rotate… OH GOD THEY DO NOT ROTATE THEM AT THE SAME TIME GODDAMIT AAAGH.. the intention was there okay? I did that to, in one part, give more use to my job manager and, to let all isntances update at the same time but big brain me did not think that a job is always locked to the instance that picks it up.

also the token endpoint now supports using openid and spitting out a ‘id_token’ with the user info (some claims are gatekeept behind the scopes [like ‘profile’ or ‘email’ duh]).

that’s it actually, like i started really pulling my hair, fluff, feathers whatever because I was trying to overcomplicate it a lot and i really dunno why. like, for another example, i kept swapping from the ‘jsonwebtokens’ and ‘compact_jwt’ crates because I wanted to use ES256 but didnt want the other because i never used it but then ended up using the latter because it was easier, and then that I wanted to use EC25519 which is apparently not really talked about in the rfcs (that’s why i ended up with ES256! [also supported on compact_jwt]). AH! and also in the job queue, for the JWK rotation, I wanted first to add cron job for that but… why tho, I don’t really need it, I just need a way to NOT run a job until a specific time and then reschedule it inside the same worker.

here’s the shitty screenshots showing the oh wow ‘openid configuration’, oh wowie ‘it does output tokens and id_token’, oh thats nice ‘it does give out a valid jwt with valid claims that the programmer didn’t even do themselves because they used a library called compact_jwt’ and wow ‘it does have a job that tries to autorotate if the current key is older than two months’:

you know? i love debugging my code when the error was the entire time in the db. great job me!!!! I’ve made the token handler.

again, as other devlogs, that’s all folks. Stupid me couldnt figure out why client secret was always bad, why the mr code verifier was always bad when it was the same as the stored one aaand why the heck scopes werent showing.

i really do love that my code, practically, worked first try (MY CODE >:3). But did NOT love that i am still stupid and forgot that i had a database that works as the house for the data that my app ingests. god i am smart.

time to go suffer with openid i guess. i have to touch jwt and stuff, eugh.. i like my opaque tokens more than jwts, because IF you want to revoke one of them you still HAVE TO STORE A LIST OF IDS… that defeats the whole hecking purpose dude, not worth it (or that’s what i think for now, smh i am just a space birb claking at keys).

here’s your video that shows that it does work and gives the bearer opaque token and creates the db entry:

yayy! the first step of making oauth2 alive has been made. I rewrote the tiny part of the authorization handler of the oauth2 flow… there’s not much to it!

It did took a while to reunderstand it because of how long I wrote it (2 months ago) and that I wrote it in a rush (and didn’t even make it work). Basically, the same as always, traceback to try to understand what past me wanted to do, to then rework everything (or at least try) to unspaghettify those radiative peaces of code. So, practically it only the authorization method was half done and ugly, it was a big BIG monolithic method that did everything in a way that either past me or current me like at all because it takes a whole lotta things to work (8 to 9 argumentos lol).

In the end i just splitted the big MONOLITHIC (thick) method into two of the same kind but with at least clear and defined and bleh jobs. One when the user has already authorized the client and the other when he has never touched it in its life.

I also did some qol for my self (or i think i did, probs not because it was already bad and rushed and stuff… i already said it at the start) with the oauth helpers and stuff by also prettifying them and simplying parts that I really don’t know why I added. Like I added mr “OauthResponse” which, as the name implies, makes the oauth response (redirect, plain error, error with redirect) instead of the 3 different methods I had to use to do the same thing, easier is better (and even understandable!).

Ah, and i even tried to use strum but nope, it do not cut the job (it tries to cut the wall instead of the thing i want). NOW, sHALl the work continue to make the token making handler and then the OpenID stuff that may be a bit difficult because, with my shitty reading, i think ill have to juggle making jwks and stuffies to server correctly the food for the picky openid.

here’s the video that shows, confusingly, that indeed the handler works (It does a “hi, oh you want to authenticate with ‘poop’, let me create a pending authentication. Oh! you accepted the consent, let me delete the pending one and create the actual lasting consent for ‘poop’.). god, i am so bad at coding or whatever the this is:

AAAH, sorry, did i startle you? I added audit logs, a health handler (a simple “OK YES i am alive) and a root info thingy that tells you “okay, so my name is this, mmh yes, and this is my version and my build stuffies…).

the audit log thing was not really a pain to add. At first i was thinking of using my job queue (because ITS only use is for emails… and i put my sweat and tears to making it pretty to then not being used lol) but.. why tho, like IF you see how was the code before the audit log adavancement (yes, cement) you can se HOW every action runs already a postgresql transaction. So, why not bundle the audit log adding magic into that same transaction? and so i did. Now, we don’t have to track our selves with pencil (i dont like pens) and paper the actions we do, we just let the application do it for us… leaving a paper trail of our desastrous actions. yay… now that i said that, i should add a random chance of also adding another audit log entry that is just a random “hi, i am your audit log talking”. hah that would be funny.

btw, strum is not cool. I thought i could use hte EnumString thingy to make it implement automagaicallytationally the Display trait to snake_case but NOPE, it is used backwards. You give it a string and it gives out the enum variant. what a pee pee poo poo dude, imagine having a big monstrous enum and having to implement Display for each variant… just like the monolithic error enum of the http site… ew.

to use it you just sprinkle the audit::log() and boom, done.

AAAAAAH, did i scare you again, no? yay. I almost forgot (<- totally) to say that… i think THIS IS really the last thingyes before the oauth stuff. i really think i am going to burst into flames and become a cooked space birb… kfa (i hope you get it [its a acronym of a whole word {also, hi and thank you for reading this long journals that may be very boring or unnecessary to read}])

ah, beautiful api docs. I reworked the api docs (because they were a messy mess because of my past laziness [not understandable!!]) and now they are organized in pretty folders (tags) with correct descriptions and titles. now its even helpful to read the api docs to understand how to use a api handler, not having to dig into the code [noone does that :(]

right, I DID THE EMAIL CHANGE THING and LOGIN tooo wohooo…. yeah it isn’t that amazing lol. at the start i was just thinking about using the typical chacha encryption that ive used for the TOTP stuff but for a random token nanoid’d… you just don’t, hMAc is fine. Ended up with a dual like verification flow where both the old email AND the new email get a token link (well, now it just the token string because, ahem, i dont have a frontend). both have to be verified before the change goes through. sooo, no more “oh noes, not again, someone got into my account and changed the mail to their own, smh”. then you just get the notif saying “hey, your email has been changed”.

SEEECOND, login (your username) changing magic that is way simpler because I just check if you have sudo enabled and that you havent changed it in the last 24 days (why not). Just like with the email stuff, you get a notification saying “yay, you changed it!”.

and I think that’s the last of the tiny stuff i wanted to do before the BIG and PAINFUL oauth stuff. i think i am going to burst into flames and go boom and the floor is covered with dust and feathers.

OH wait, i sitll need to do account deletion… whatever its just a simple “hya you need sudo”, “are you sure about this”, “ok, bye” flow. meh. i also need profile pictures… heh backblaze or maybe cloudflare idk i like backblaze more but uhh I GOTTA RESEARCH OKAY!?!

shall you see the probabaly useless screenshots that atleast show the tiny progress that i always do. great

I added what I always forget to do because I am lazy!!! A readme. That’s it. There’s not much to it, like I explain about the secret stuff and services AND how to deploy it. short short commit that make other people than me happy

okay so today was mostly “polish and quality of life” stuff… if you can call it that.
i added a proper nix dev shell so when i’m working on the config I just do nix develop and boom I have deploy-rs, agenix and nixos-anywhere all ready to go without installing anything globally. pretty neat (thanks you tube).
also added nixfmt-tree as the formatter so the nix files are all consistently formatted now, no more weird stuff i guess… i mean they ARE already correctly formatted (somehow) so this was useless.
fixed a stupid issue with mr home manager where it really wasnt homemanaging mr fish aliases because stupid me didnt know you had to set the fish shell to “enabled” to be able to use the aliases that i set on the home manager thingy when i already have IT enabled on the whole system (right?).
anddd added a motd when going into the vps with the name that i’ve give to the vps, it just shows disk usage, ram and swap usage, and uptime. now when i am bored i can ssh to my vps and see pretty stats and be again bored for the rest of the day and keep repeating the cycle until i am dust.
honestly the vps config feels pretty much done at this point. i think the service factory is working (gotta test it with my auth thingy), caddy with cloudflare is set up (don’t know if it really works yet), agenix for secrets, tailscale, postgres with per service users, deploy-rs for deploying… i just gotta deploy something to it so i can have something to actually show, like “oh yeah look at my auth server, its running my vps!11!1 woo… (silence)”. oh right, i also did “nix flake update”. what a useless devlog

okay, we got now what I call “the service factory” (wooo). Instead of C&P the same systemd boilerplate and caddy config, postgres user and database setup and agenix env loading every single time i want to slap a new service on the server. Sooo, I just call makeService (that’s the name I gave it) with a name, a flake, and then whatever config like domain or postgres config and boom works.

everything is nested underneath the “moonix” umbrella, which is neat. I set up options for the typical stuff like enabling or disabling the service and the other things i commented up there. I mean, it is a bit janky with me doing some stupid things but it works! And i even “hardened” the systemd service of the service, which i didn’t know even existed but okay lol.

AH, and i also fixed the stupid interactiveSudo annoying “hey it aint secure using a password, you should use a ssh key correctly setup, dummy.” by just setting the sudo security to none :D. I am using ssh keys anyway to connect to the vps, might have thrown to the trash the security but i dunno :3.

AND one of the cool hings about this factory thingy is that now each service gets its own postgres user and database automagically. Like, it creates its role and databases with the service being the owner without me doing anything… so no manual labor muahahahaahhahahahah.

I mean, this is pretty short and quick but GOD i take too much time trying to make stuff and then having to search and stuff because it aint working as I wanted lol, but still, I do be eating too much time for simple things like god. Even the commit changes are really tiny like gosh. the only great thing is that I am will no longer touch this hecking thing, I will JUST USE IT and boom deployment made.

oh god, nono, I just thought about automated deploys via github’s ci. i actually don’t even hecking know how would that even work agh, hecking hell.

pew pew. I added tailscale, happily learn that home manager and agenix exists and we got caddy with cloudflare dns working!!

why tailscale?… well, with it i don’t need to expose my machine to the outside world, i can just connect to it via tailscale and do the same stuff i would if i was connecting to it via its public ip. Now i can just firewall it and only let in cloudflare ips :D.

home manager to just give me the birb kisses (mwa :3), giving me the same stuff I already have on mah terminal in my arch laptop but on my vps AND it do be using some pretty syntax making me not juggle around config files for each hecking thing I want to add. and also it lets me install stuff for “my user” instead of the whole system, pretty neat.

AGENIX, ah, storing secrets havent been easier. I just have to do “agenix -e name.age” set the secrets in there and boom, i can use it in my config file without worrying about it being exposed because i somehow committed the .env file. It just decrypts it on the vps, i just followed the tutorial on the agenix repo and it really was straight forward. sadly i have to manually set the “where is this secret stored” to be able to really use it (i just use another .nix file to not make my main config file too cluttered with stuffies).

and finally, caddy with cloudflare dns. at first i was thinking about using cloudflared (cloudflare tunnels) but i indeed ended up not using it because I AM ALREADY PAYING FOR A ipv4 ADDRESS FOR GODS sake, soooo I just set up caddy with cloudflare dns, had some problemos because it didn’t like having “https://” on the url and that i needed a dummy hash so when building the flake (is that how its called?) it would give me the real hash. The idea is that i make something that lets me make new services, like a pretty template, setting up the caddy config, a systemd service and a user with a group for it.

oh and also, i enabled postgresql. there’s not much about, i just set it as an enabled service lol.