El microrrelato:

LA NOCHE ABANDONADA, REVISITADA

#relatos

Alt...

Portada del libro Microterrores XIII, publicado por la editorial Diversidad Literaria

Conclusion: people will adapt to whatever timezone they like, as absurd as it may sound.

Today is Artificial Intelligence Appreciation Day for some reason, so everyone please celebrate appropriately.

Happy World Snake Day

Alt...

Kurt Russell as Snake Plisskin in Escape From New York (1981). He’s seated in a leather wingback chair wearing a very weathered leather jacket with his signature eye patch and fantastic hair saying ‘I don't give a fuck about your war or your president.’

CC: @bpl@snac.bsd.cafe

On 10 March 2021, I had only just fallen asleep when my phone started buzzing. Then another notification, and another. In a matter of minutes, 142 of my servers went up in the clouds. And not the cloud-computing kind.

Most of them were physically going up in a column of smoke in Strasbourg.

My wife looked at me and asked if I wanted a coffee. I nodded. It was going to be a very long day.

At EuroBSDCon 2026, I won't be giving a theoretical lecture on high availability. Instead, I’m going to tell the raw story of that night: the emergency recovery, the architectural choices that actually saved us, and the ones that crumbled under pressure (because we rarely talk about what fails).

Most of all, I’ll explain why that night changed my perspective, and why I’ve come to see BSD systems not just as operating systems, but as essential, practical tools for building simpler, more resilient infrastructure.

The official schedule is now live. If you want to hear a real-world post-mortem, join me on Saturday, 12 Sept at 11:15 (Room D.0.02).

EuroBSDCon Full schedule: https://events.eurobsdcon.org/2026/schedule/
See you there! ☕️

#FreeBSD #NetBSD #OpenBSD #DragonFlyBSD #RunBSD #EuroBSDCon #SysAdmin #SelfHosted #IT #EuroBSDCon2026 #BSDCon

Mister Mobilek Wallpaper MEGAPACK

#mobilek #phone_bad_book_good

Alt...

mister mobilek

Alt...

smiling mister mobilek

Alt...

happy mister mobilek

Alt...

sleepy mister mobilek

#artwork

Alt...

A drawing by Ángel Ortega of falling, decomposing objects and body parts and the text above

How many instances must an admin spin up before you can call it a fediverse?

I Did Not Kill Stanley Lieber: How to draw (with 9front)

The penultimate paper on paint(1) and the 9front art machine.

https://triapul.cz/automa/i_did_not_kill_stanley_lieber

#unix_surrealism #plan9 #9front #art #guide #computers #oldcomputerchallenge

Alt...

poster for "I Did Not Kill Stanley Lieber: How to draw (with 9front)" there's some characters or something, I can't tell

A rough analogy:

Threads → Fox News
Bluesky → The Atlantic
The fediverse → zines stapled to a lamppost outside your favorite queer and/or communist bookstore

It’s not Tuesday yet, but it will be soon.
And I want to thank @grunfink for creating and maintaining snac. Tomorrow I’ll talk about FediMeteo at DevConf, and it would never have come to be if it weren’t for snac and for the help the author gave me in fixing some things to optimize its use.

True Open Source, made with passion, by people who do things for the love of the things themselves.

#ThankYouTuesday #snac #FediMeteo #Fediverse

CC: @gutenberg_org@mastodon.social

[MANGA][FREE DOWNLOAD] JAPANESE JESUS

https://triapul.cz/files/pmjv-japanese_jesus.cbz

I hereby announce the release of Japanese Jesus e-book. Enjoy!

If you want, you can buy something or put a dollar in the hat.
https://analognowhere.com/support

stay prayed up

https://analognowhere.com/jj

#unix_surrealism #comic #japanese_jesus #art #foss #linux

Alt...

japanese jesus

wireguard for 9front in ~1300 lines of C

LittleFedi: light, yet complete

I'm writing this post from a Raspberry Pi Zero W - 512 MB RAM, single-core ARMv6 - running NetBSD, powered by littleFedi. The process sits at 33 MB RSS, CPU basically asleep:

load averages:  0.05,  0.08,  0.09
CPU states:  0.0% user,  0.0% nice,  0.0% system,  1.0% interrupt, 99.0% idle
Memory: 301M Free
  PID COMMAND             RES STATE
 2082 littlefedi-armv6    33M kqueue

No Redis. No PostgreSQL (but optional). No Sidekiq. No Node.js build pipeline. One statically-linked binary, one SQLite file, and the full fediverse experience. And this is the part people tend to miss: the same binary that runs happily on a Pi Zero scales, on the right hardware, to numbers that have nothing to do with "lightweight". It's not a toy that stays a toy. It's built to grow when you need it to.

What LittleFedi actually ships

Federation - Full ActivityPub S2S: WebFinger, NodeInfo 2.1, host-meta, HTTP Signatures with anti-impersonation checks. Per-user and shared inboxes, outbox, followers, following, featured collections. Thread completion with bounded on-demand fetching of missing ancestors/replies (separate sync and background budgets, all hard-capped). Quote posts via FEP-044f with the full approval handshake (QuoteRequest -> QuoteAuthorization), matching Mastodon 4.4 semantics, plus _misskey_quote and Fedibird quoteUri aliases. Account migration (Move), both outgoing and incoming, with alsoKnownAs linking, automatic follower migration, follow import from AP collections, and CSV export/import. Remote interaction discovery - async like/boost resolution from origin servers with REST fallback.

Mastodon API - Broad coverage: timelines (home, public, local, hashtag, bubble, direct), status CRUD with edits, scheduled posts, polls, bookmarks, lists (with replies_policy and exclusive), filters v2 (keyword CRUD), featured tags, followed hashtags (posts appear in home), markers, conversations, notifications with type exclusion, follow requests, blocks (federated Block/Undo), mutes with duration/expiry and hide_notifications, per-user domain blocks. OAuth2 with app registration, authorization code, client credentials and refresh_token flows, PKCE, consent screen, and scope enforcement (read/write/admin:read/admin:write). It talks fine to Elk, Tusky, Ivory, Phanpy, Semaphore and MastoBlaster.

Streaming - WebSocket and SSE. In-process pub/sub hub with per-connection send buffers, zero cost when no client is connected. Broadcast streams for public, local, remote, hashtags and lists. Per-account streams for user timeline, notifications and direct messages. Optional PostgreSQL LISTEN/NOTIFY backend for cross-process fan-out. Mastodon-compatible event serialization.

Push notifications - Full Web Push / VAPID (RFC 8030/8291) with aes128gcm encryption. Per-type alert toggles (mention, follow, reblog, favourite, poll, follow_request, status). Notify-bell support on followed accounts. Subscription expiry detection, rate-limit handling, 5-retry delivery.

Media pipeline - Upload processing: thumbnail generation (600x600), blurhash computation, EXIF stripping, magic-byte validation, SVG rejection, MIME mismatch detection, UUID-based file renaming. Size limits (40 MB default), pixel caps (16 MP default, tunable down to 4 MP for SBCs).

Media privacy proxy - This is the part I actually care about most. All remote media streams through the instance via HMAC-signed URLs (/proxy/media?url=...&sig=...), so local users never expose their IP address to remote servers. SSRF-guarded: DNS resolution check, private/CGNAT IP rejection, redirect re-validation. Pure io.Copy pass-through, no disk, no decode, ~32 KB buffer. Forwards HTTP Range requests for audio/video seeking. Configure a proxy_secret for stable URLs across restarts. On low-RAM devices, set cache_remote = "off" and you still see every image on the fediverse, the instance just doesn't store or process them.

Remote media caching - Three modes: off, eager (background sweep caches all remote attachments, avatars, headers and emoji, backfills existing on mode switch), lazy (cache on first access). Content-addressed, deduplicated by origin URL. Age-based pruning with file GC. Negative-cache for permanently dead URLs. Transparent origin fallback on cache miss. Open Graph preview cards stored durably with posts.

S3-compatible storage - A separate build tag (-tags s3), deliberately excluded from the default binary to keep it small. Supports AWS S3, MinIO, SeaweedFS, Ceph, Backblaze B2, Wasabi, DigitalOcean Spaces. Native media migration CLI: littlefedi admin media storage-migrate between local and S3 (DB-queue-backed, resumable, bounded batches). storage-status, storage-cancel, storage-resume commands. storage-manifest for rclone JSONL integration.

Markdown posts - Powered by goldmark with GFM extensions: tables, strikethrough, bare URL autolinking, hard wraps. Raw HTML deliberately not rendered. Output sanitized through bluemonday (defense-in-depth). Composer toggle in the web UI. Federates source.mediaType: text/markdown (Pleroma/GTS convention). Inbound Markdown source is rendered to HTML.

Visibility modes - The standard four (public, unlisted, private, direct) plus local-only (local, instance timeline only, never federates) and local unlisted (local_unlisted, followers only, no federation). Useful for notes to your own instance community.

Bubble timeline - Curated set of instances whose posts appear alongside local posts in a special timeline. Akkoma-compatible extension. Admin panel for adding/removing bubble instances. API endpoint at /api/v1/timelines/bubble.

Moderation - Account states: suspended (tombstone, federates Delete(Person)), silenced (visible to followers only, dropped from public timelines), quiet (like silenced plus it downgrades federation to followers-only, a middle ground I haven't seen anywhere else), disabled (cannot log in, content stays visible). Self-suspend prevention, last-admin-demotion guard. Blocks (bidirectional, federated), mutes (local-only, with duration and hide_notifications), per-user domain blocks (distinct from admin instance-wide blocks). Reports pipeline: user submissions plus inbound/forwarded Flag into an admin triage UI with resolution actions. Admin notification on new reports. Domain blocks with severity (noop/silence/suspend) plus Mastodon-parity options (reject_media enforced in the proxy, reject_reports, obfuscate, public). A moderation audit log records every admin action.

Web UI - Server-rendered HTML with html/template, templates embedded via //go:embed. Inline CSS (dark mode, Inter font, gradients). htmx 2.x and Alpine.js for progressive enhancement. No build step, no Webpack, no Tailwind, no npm. Every action works as a plain form POST without JavaScript. Works in Lynx, eLinks, text-only browsers, and on mobile.

Full feature set: home/public/local/bubble timelines with infinite scroll, profile pages with follow/unfollow/bell toggle, status threads with reply composer and background thread completion, post creation with CW, visibility selector (6 modes), media upload with alt text, Markdown toggle, quote posts (pre-loads composer with the quoted post as an inline card), post editing, composer autocomplete for @mentions and #hashtags, settings (display name, bio, password, sessions, moderation, pruning, account move, timeline preferences), report form, search page, tag management.

Admin panel - Dashboard (user counts, pending approvals, unreachable instances, open reports), accounts (with suspend/silence/quiet/disable/approve/reject actions), invites (CRUD), domain blocks (with severity and options), reports (triage and resolution), audit log, instance health (per-instance status with follower/following counts, reachability tracking, purge with typed-domain confirmation), bubble instances, settings, housekeeping (on-demand pruning), queue console (ready/scheduled/running/failed by job kind), media storage (S3 migration controls in S3 builds).

Background jobs - DB-backed queue that survives restarts, 8 job kinds: inbox, delivery (16 attempts over roughly 26h with capped exponential backoff and equal jitter), push_notification, actor_refresh, poll_close, scheduled_status, media_cache, media_migration. Per-instance circuit breaker suspends delivery at backoff_count >= 10. Actor refresh dispatcher with stale-while-revalidate, crash-safe leases, and per-actor exponential backoff.

Backups - Periodic or on-demand, server-side, no external tooling required. Each run produces a timestamped directory with config.toml, a portable database dump (VACUUM INTO for SQLite, pg_dump for PostgreSQL), an optional copy of owned media, and a manifest. Toggle it on, set an interval (24h, 7d, whatever fits), decide whether to include owned media (the remote cache is always excluded, no point backing up other people's content), and set a retention count so old backups get pruned automatically. Off by default, one line to turn on.

Housekeeping - Automated pruning: remote statuses by age, own low-interaction statuses (per-user or server thresholds, min likes/boosts caps), tombstones, expired mutes, stale media (>24h unattached), orphaned media (deleted posts), unreferenced media files (disk files with no DB record), cached media by age, cache file GC. On-demand controls in the admin UI.

Security - Token-bucket rate limiting per IP. Security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Strict-Transport-Security. Content-Security-Policy with nonce-based script/style. CORS. CSRF on all cookie-authenticated POSTs. Session fixation protection. Password reset token in a cookie, not the URL. OAuth consent screen (not auto-issuing). SSRF protection (DNS, IP and redirect re-validation) on all outbound HTTP. HTTP Signature algorithm enforcement (rsa-sha256 only). Inbox body size limit (1 MB). Backfill goroutine cap. Thread-fetch amplification limits. File upload validation (magic bytes, SVG rejection, MIME mismatch). Username enumeration hardening.

Operational - Prometheus metrics at /metrics (counters for API/inbox/fed/web requests, statuses, deliveries, thread fetches, queue depth; gauges for workers, pending follows, uptime). Health checks (/health, /readyz). CLI: admin create-user, admin set-admin, admin list-users, admin suspend/unsuspend, admin invite generate/list/revoke, admin media prune/prune-orphans/prune-files, admin media storage-migrate/status/cancel/resume/manifest, post (publish from stdin/file with Markdown, visibility, CW, media, reply, quote), migrate (run migrations only). SMTP for password reset and notifications (falls back to stdout). Config via TOML file plus environment variables (LITTLEFEDI_{SECTION}_{KEY}).

Platform support - CGO-free, compiles with CGO_ENABLED=0. 23+ GOOS/GOARCH combos via the modernc SQLite driver: macOS (amd64, arm64), Linux (386, amd64, arm, arm64, loong64, ppc64le, riscv64, s390x), FreeBSD (386, amd64, arm, arm64), Windows (386, amd64, arm64), OpenBSD (amd64, arm64). NetBSD (amd64, arm, arm64) via a WASM-based fallback SQLite driver, I don't think anything else in the fediverse space explicitly targets NetBSD. PostgreSQL is a separate build tag (-tags postgres), S3 is another (-tags s3). The default binary carries neither, keeping it small. ARMv6 (GOARM=6) gets special treatment in the release naming, that's the Pi Zero target.

Why it matters

The fediverse shouldn't demand a beefy VPS. It shouldn't require Docker, 2 GB of RAM, Redis, Sidekiq, or a JS toolchain that pulls in 800 packages. A 10 euro Raspberry Pi Zero W running NetBSD, sitting on a shelf, drawing less than 2 watts, can be a fully functional fediverse instance with a web UI, mobile app compatibility, streaming, push notifications, quote posts, account migration, and a moderation toolkit. That's not hypothetical, that's what this post is running on.

But don't mistake "runs on a Pi Zero" for "only runs on a Pi Zero". Point the same binary at real hardware and it scales to numbers that have nothing to do with hobby-instance territory. Low power is the floor, not the ceiling.

One binary, one config file, one SQLite database. Light, yet complete.

I've been involved in this project for a while now, though I can't say much more about it at the moment, there are other people involved besides me and it's not entirely my call to talk about it publicly yet.

#Fediverse #littleFedi #OwnYourData #NetBSD

examine the newly collected #phonebadbookgood series

https://triapul.cz/phone_bad_book_good

#comic #art #mastoart #fediart #mobilek #unix_surrealism

Alt...

phone bad book good poster chid and red surrounded by many mobileks

You know this, I know this, it's still nice to have a comic about it.

#AI

Alt...

A black and white comic in 4 panels : - a man standing to a large machine twice his size, announcing in a microphone : "My GENIUS machine will find SOLUTIONS to ALL the world's PROBLEMS !" - the machine starts slightly vibrating while the man looks at it : "Thinking", says the machine in a different font. - The machine continues in the same font : "You ALREADY HAVE all the solutions. You just REFUSE TO IMPLEMENT them to protect the financial interest of the wealthiest 0.0001%". The man doesn't look pleased. - The screen of the machine has gone dark as the man unplugs it. Sweating bullets, he goes : "It just needs some tweaking".

#artwork

Alt...

A drawing by Ángel Ortega depicting a bunch of objects and photos

CC: @prahou@merveilles.town

GARFIELD DEAD!

After Bluesky, Threads, and so on, the whole #WSocial thing is another reminder that it was never about the #Fediverse being "too complicated" or "just for nerds".

A bafflingly large amount of people genuinely only act on a gut feeling telling them that only commercial products with fancy marketing owned by a for-profit corporation can be trustworthy, 'official' and 'legal', for the lack of a better word.

If something is a commercial offering by a competent-looking, rich family man in a suit, it's clearly an official, legal, trustworthy product. You can be proud of using such a fancy-looking service.

When they see a community-run open-source project or a grassroots initiative, their first instinct is that it must be shady, illegal, complicated, broken or predatory in some way. It's probably some aftermarket grey area bootleg made by weird tech nerds, political groups with an ulterior motive, conspiracy theorists or some naive teenage hackers. They'd also be embarrassed for using it in front of their peers and neighbours; who uses some free back-alley software, are you poor or something?

The same people are the reason why Google is using the word 'sideloading', why scammers love wearing fancy suits, why people suddenly act childishly helpless in front of LibreOffice, or why DIY HRT is so demonised.

They trust any kind of 'official approval' over their own senses. If someone does something that isn't 'approved', they're a bad person or clearly endangering themselves and others. No idea why exactly, but psh, it must be wrong somehow, or everyone would do it, right?

If people on the Fediverse understood that the whole "it's all so complicated and clunky" thing is just a thinly veiled excuse for a general disdain for non-commercial software, we could finally stop making all our software imitate their corporate equivalents in a futile attempt to appease people who never gave us a chance in the first place.

You'll never convince them to treat it in good faith no matter how much effort or money you put into UX or 'ease of use'. All you're doing is making the software worse, e. g. through things like dot-social, verified accounts or begging brands, corporations and politicians to join and give your product some kind of 'official' validation.

#mastodon #openSource #linux

I'll keep an eye on them in the coming days before rolling them out to other countries. In the meantime, you'll find the links in each city's bio.

Let me know if it works for you!

#FediMeteo #FediMeteoAnnouncements #DeltaChat #Italy #Italia #Germany #Deutschland

CC: @thisemailfindsyou@mastodon.social

CC: @bpl@snac.bsd.cafe @stefano@bsd.cafe

#artwork #fahrenheit451 #RayBradbury

Alt...

A drawing by Ángel Ortega of a burning pile of books

Secret Panel HERE 😱 https://tinyview.com/mrlovenstein/2026/06/11/living-nightmare

CC: @vbabka@mastodon.social @ldvsoft@fosstodon.org @vitaut@mastodon.social @pmjv@snac.lab8.cz

CC: @bauchhaus@c.im

CC: @stefano@bsd.cafe

CC: @qrstuv@hj.9fs.net @prahou@merveilles.town

As a reminder, the app will remain free for all friends of BSD Cafe, illumos Cafe, or anyone using it to connect to snac instances.

More details once I've worked out a few specifics.

Stay tuned!

#MastoBlaster #MastoBlasterUpdates

#artwork #nineteeneightyfour #GeorgeOrwell

Alt...

A drawing by Ángel Ortega of a rat with a skeleton head, the text DO IT TO JULIA superimposed

CC: @stefano@bsd.cafe

CC: @stefano@bsd.cafe

why content negotiation will eventually betray you

CC: @stefano@bsd.cafe

mount: (hint) your fstab has been modified, but systemd still uses the old version; use 'systemctl daemon-reload' to reload.

CC: @stefano@bsd.cafe

The at daemon is a great piece of ancient art. The now is just one of the multiple options of specifying when the batch is to be run; depending on the tool flavour, you can use a timespec like 17:45 or a date or midnight or teatime (whatever that means, I'm from Spain and mostly a coffee man).

CC: @js@bsd.cafe

My bank emailed me "AI is changing check fraud. Here's what you can do to protect yourself."

Nonono, Mr. Banky-bank. Tell me what YOU are doing to protect me against check fraud. This is a you problem, caused by a system you designed and run. How about you don't externalize that cost onto me?

I have, since the 1980s, DESPISED any excuse like "oh sorry we got a new computer system" or "we can't do X anymore because of the computer". How you do business isn't my fucking problem. Don't give me excuses for not having your shit together.

This is the same as "we are experiencing unexpectedly high call volume." Well, that's pretty fucking poor planning on your part, then, innit? Hold times aren't long because of the forces of nature, they are because you're too fucking cheap to pay sufficient staff.

For added benefit, it immediately detaches from my shell session.

CC: @js@bsd.cafe

CC: @hoolis@oldbytes.space

You gave a stranger with no soul and no skin in the game the keys to everything you own.

Alt...

Tweet by @EscanorReloaded CEOs are quietly realizing the Al replacement plan has a problem. Two problems, actually. One: the token costs for running Al agents are now exceeding what they were paying the employees they fired. Two: when the tokens run out, the Al stops. Just stops. No continuity. No workaround. Just a spinning wheel where your workforce used to be. You fired humans to save money and bought a subscription that bills you into a corner. The employees you let go knew what to do when things broke. The Al just invoices you for the outage. And then there's the permission problem nobody wants to talk about. To do its job, the Al agent needs access. Full access. Your systems, your patents, your contracts, your future plans. Everything you spent years building, handed over to a process that has no loyalty, no discretion, and no skin in the game. You didn't hire a replacement. You gave a stranger with no soul the keys to everything you own.

CC: @NanoRaptor@bitbang.social

Fediverse account recommendations (may, 2026)

essentials

for the views

for the laughs

for the tech

en español

#FollowFriday yea i know it's thursday or whatever

CC: @prahou@merveilles.town

please share my art to help me achieve my dream of having 4 million dollars

#unix_surrealism #art

Alt...

it has been ten thousand lifetimes since i had spoken to a computer and all this time i never stopped hearing its voice not for a minute

CC: @FilmNoirPosters@zirk.us

What a piece of technology this snac is.

"When you can buy your way out of any mistake, when you can fire anyone who disagrees with you, when your social circle consists entirely of people who need something from you, the basic mechanism by which humans learn that other people are real goes dark."

https://www.theatlantic.com/magazine/2026/05/billionaire-consequence-free-reality/686588/?gift=fXb4ymsFcV2ntAzqIpmYvZ5SHmVudSgCCvY8EbJPC2Q

Tal día como hoy, en 1865, nacía en Brooklyn Robert William Chambers. Para recordarle a él y a su maravilloso ciclo de El Rey de Amarillo, os proponemos nuestra versión de uno de los relatos que lo componen.

«En la corte del dragón», de Robert W. Chambers
https://go.ivoox.com/rf/85510314

(* Por cierto, para nuestro bochorno, hay una error en la lectura del relato. como os daréis cuenta fácilmente: es "púlpito", no "pálpito". Nuestras disculpas... 😓 *)

phone bad book good

#funhole #pornography #mobilek #phonebadbookgood #comic

Alt...

mister mobilek, how can i use my dad's drivers license to access pornography?

the full thing

#artwork

Alt...

A drawing by Ángel Ortega of a tree with eyes in its roots

My City

https://my-notes.dragas.net/2026/05/22/my-city/

#MyNotes #Life #Memories #Reflections #People #Change #Friendship #LifeLessons

No se lo digas de Santiago Eximeno

Una pequeña joya narrativa de horror sobrenatural.
Del autor me han dicho que a veces se pone explícito así que puede que de esta me cierren el canal... No os lo perdáis!! 😂

https://eximeno.itch.io/no-se-lo-digas

For some reason, I used to read "Meanwhile" as "Menaville"

"The literal meaning of life is whatever you're doing that prevents you from killing yourself."

Remember to update your libc for the new AI errno(2) values that just dropped:

https://www.netmeister.org/blog/ai-errno.html

Alt...

#define EAI 201 /* hallucination */ #define EAIWASH 202 /* inconvenient license ignored */ #define EBOTDOS 203 /* crawlfarm failure */ #define ECLAW 204 /* unrecoverable system compromise */ #define EDAWKINS 205 /* claude delusion */ #define EDICT 206 /* transcription mode only */ #define EDUNK 207 /* unjustified confidence */ #define EEYORE 208 /* excessively depressive response */ #define EFFTHEPLANET 209 /* insufficient datacenter capacity */ #define EFOOTGUN 200 /* accidentally revoked my own access */ #define EGAD 211 /* lost context */ #define EGIGO 212 /* repeat output intake */ #define EGPT 213 /* walked like an 𐦂 */ #define EGRET 214 /* too few to mention */ #define EGROK 215 /* nazi-mode detected */ #define EHEADDESK 216 /* excessive amount of time wasted */ #define ELISP 217 /* McCarthy wath here */ #define ELIZA 218 /* still analyzing */ #define ELLMAO 219 /* too gullible */ #define ELON 220 /* megalomania exhaustion */ #define EMACS 221 /* unable to exit vi */ #define EMOTION 222 /* impossible movement */ #define EMYTHOS 223 /* excessive marketing */ #define EOOPS 224 /* accidentally 'rm -fr'd all code */ [...]

the rubber wrapped around
a thousand miles
of hair thin lines
in the back, there and outside
on heads with one too many eyes

there, back and way out

#unix_surrealism #tarot #occult #comic #foss #computers #sun #ibm #triapul

Alt...

UPSIDE DOWN HIGH PRIESTESS

#artwork

Alt...

A drawing by Ángel Ortega of an astronaut pointing to a banner with the Euler's identity

When I wrote about FediMeteo (https://it-notes.dragas.net/2025/02/26/fedimeteo-how-a-tiny-freebsd-vps-became-a-global-weather-service-for-thousands/) for the first time, I told the story from the beginning: the idea born almost by chance while checking the weather for a holiday, the memory of my grandfather, who for years had been my personal meteorologist, the decision to build something small and useful, and then the surprise of seeing people actually use it. What began as a personal experiment quickly became a small global service, still running with the same philosophy: FreeBSD, jails, simple scripts, snac, text, emoji, and a lot of small pieces doing their work quietly.

That article was mostly about the birth and growth of the project. This one is about one of the less romantic parts of the same story, although I have to admit that I find a certain beauty in it too: keeping the service light as it grows.

FediMeteo (https://fedimeteo.com) is still intentionally simple from the outside. A homepage, some numbers, a list of countries, and many ActivityPub accounts publishing weather forecasts. The posts are text and emoji. There is no JavaScript requirement to read the pages, no heavy frontend, no unnecessary media attached to every forecast, and no dynamic homepage recalculated at every visit just to show the same numbers. This is not accidental. It is the way I wanted the service to behave from the beginning.

But the more the service is used, the more the small details matter. A request that looks harmless when there are ten followers may become a repeated request when there are thousands of followers, remote instances, crawlers, previews, and other servers fetching the same public objects. In the Fediverse, the same small thing can be asked many times by many different places, each one with a perfectly legitimate reason. The backend doesn't care: it just needs to deal with the requests.

And in FediMeteo, the backend is snac (https://codeberg.org/grunfink/snac2).

I like snac very much precisely because it is small, clear, and efficient. It is not a giant application that tries to be everything. It does a focused job and does it well. But this also means that I want to respect its shape. I do not want to waste its threads on work that the reverse proxy can safely do. A snac thread serving the same public avatar again and again is not a tragedy, but it is still a waste. A snac thread answering the same public ActivityPub object several times in the same minute is doing real work, but often not necessary work.

This is the reason behind the HAProxy (https://www.haproxy.org) tuning I am currently using in front of FediMeteo.

It is not about making the configuration look clever. It is about keeping snac quiet.

A continuation of the same idea

This is especially important because snac uses a limited number of threads. I like that. Limits are healthy. They force us to understand what the service is doing, and they prevent a small program from pretending to be an infinite resource. But limits also make waste visible. If a few threads are busy serving files that could have been served from cache, those threads are not available for something more useful.

With FediMeteo the implementation is different because the reverse proxy is HAProxy, but the reasoning is the same. I have many small snac instances, each one in its own FreeBSD (Bastille (https://github.com/BastilleBSD/bastille)) jail, and one public entry point that has to route, terminate TLS, compress, cache, and generally remove as much repetitive work as possible from the backends.

This is, in a way, the natural continuation of the original FediMeteo design. In the first article I wrote that I wanted to manage everything according to the Unix philosophy: small pieces working together. This is another piece of that same puzzle. HAProxy does the edge work. snac does the ActivityPub work. Scripts generate forecasts. cron launches updates. ZFS gives me snapshots. FreeBSD jails keep countries separated. Nothing is particularly heroic by itself, but the whole system becomes pleasant because each part has a clear responsibility.

Why there is almost no media

FediMeteo does not use media in its forecasts.

No images attached to the posts, no generated weather cards, no maps for each city, no decorative banners. The forecasts are text and emoji. This was a deliberate decision. Weather information does not become more useful just because it is put inside an image, and every media file used by the service would become something to store, serve, cache, federate, expire, back up, and occasionally debug.

Text and emoji are enough. They are accessible, light, readable in text browsers, friendly to timelines, and understandable even when someone does not know the local language perfectly. This was one of the original design principles of FediMeteo, and it also helps the infrastructure. Less media means less work, fewer cache entries, fewer repeated fetches, fewer surprises.

There is one exception: the avatar.

All FediMeteo accounts use the same avatar, and this is also intentional. I could have used a different avatar for each country, or for each city, or created something visually richer. It would have been nicer in some screenshots, perhaps. It would also have been operationally worse.

With one shared avatar, the reverse proxy has one very useful object to cache. It is public, identical for everyone, small, requested often, and therefore almost always hot in cache. HAProxy can serve it directly instead of asking each snac instance to return the same file. Since avatars are requested by remote instances, browsers, profile previews, and all sorts of federation-related fetches, this single decision removes a surprising amount of pointless backend traffic.

So the avatar is not only a visual identity. It is part of the architecture.

This is the kind of optimization I like most, because it starts before the software. It starts with deciding not to create a problem.

The homepage is static because it can be static

It is a static HTML page generated from a template. Once per hour, a cron script updates the numbers and statistics. It counts the data I want to show, regenerates the page, and then the page remains static until the next run.

This is not because I cannot make a dynamic page. It is because I do not need one. Boring is good.

The homepage does not need to query all the country instances on every visit. It does not need a database request for each user who opens it. It does not need to ask snac anything in real time. The numbers are useful, but they do not need to be updated every second. Once per hour is enough, and it also fits the spirit of the whole project: do the work when it is needed, then serve the result cheaply.

I have seen too many small services become heavy because the first implementation was convenient rather than appropriate. A cron job and a template are not fashionable, but they are often exactly what a page like this needs.

Many countries, one entry point

fedimeteo.com
www.fedimeteo.com
it.fedimeteo.com
uk.fedimeteo.com
jp.fedimeteo.com
us.fedimeteo.com
usa.fedimeteo.com
can.fedimeteo.com
canada.fedimeteo.com

At the beginning, it is always tempting to write one ACL after another in the HAProxy frontend. It is quick, it is explicit, and for five hostnames it is perfectly fine. But FediMeteo did not remain at five hostnames. As countries and aliases grew, a long chain of ACLs would have turned the frontend into a list of names instead of a description of how the proxy behaves.

So I moved the hostname to backend mapping into a map file:

fedimeteo.com        backend_fedimeteo
www.fedimeteo.com    backend_fedimeteo
it.fedimeteo.com     backend_it
uk.fedimeteo.com     backend_uk
jp.fedimeteo.com     backend_jp
us.fedimeteo.com     backend_us
usa.fedimeteo.com    backend_us
can.fedimeteo.com    backend_ca
canada.fedimeteo.com backend_ca

use_backend %[req.hdr(host),field(1,:),lower,map(/usr/local/etc/fedimeteo.map,backend_fedimeteo)]

I like this because it keeps the configuration honest. The frontend contains the policy. The map contains the data. Adding a country means adding an entry to the map and defining a backend. I do not need to make the frontend more complicated every time the service grows.

Backends as small compartments

backend backend_it
    mode http
    http-reuse safe
    server srv1 10.0.0.2:8001 maxconn 30
backend backend_uk
    mode http
    http-reuse safe
    server srv1 10.0.0.7:8001 maxconn 30
backend backend_jp
    mode http
    http-reuse safe
    server srv1 10.0.0.32:8001 maxconn 30

The maxconn 30 value is not a magic number. It is a ceiling. I want each small backend to have a visible limit in front of it. If something starts hammering a country instance, I prefer the pressure to appear at the HAProxy layer instead of becoming unlimited concurrent work inside snac.

http-reuse safe lets HAProxy reuse backend connections where appropriate. This is another small reduction in unnecessary work. Opening connections repeatedly is not the biggest problem in the world, but avoiding it is still better, especially when many small services sit behind the same proxy.

The front door

frontend https_in
    bind :::443 v4v6 ssl crt /usr/local/etc/certs/ alpn h2,http/1.1
    mode http
    option http-keep-alive

ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

acl letsencrypt-acl path_beg /.well-known/acme-challenge/
http-request redirect scheme https code 301 unless letsencrypt-acl
use_backend letsencrypt-backend if letsencrypt-acl

http-request set-header X-Real-IP %[src]
http-request set-header X-Forwarded-Proto https

http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Two caches, because the requests are different

cache mediacache
  total-max-size 128
  max-object-size 10000000
  max-age 3600
  process-vary on
  max-secondary-entries 12
cache jsoncache
  total-max-size 16
  max-object-size 1000000
  max-age 60
  process-vary on
  max-secondary-entries 12

The media cache is larger and has a longer maximum age. In FediMeteo, this mostly means the shared avatar and a few static-looking objects. Since there is intentionally almost no media, the important cached object is requested very often and remains warm.

The JSON cache is smaller and short-lived. It is there for public ActivityPub GET requests, not to store federation state forever. A 60 second cache is enough to collapse many repeated requests that arrive close together in time, without pretending that ActivityPub responses should be treated like immutable files.

This distinction is important. Caching is not one decision. It is a set of small decisions about what a response means, who can see it, how often it changes, and what happens if it is served again.

Recognizing media

acl is_media path_end -i .jpg .jpeg .png .gif .webp .svg .ico .mp4 .webm .mp3 .ogg .wav .flac .mov .avi .mkv .m4v

http-request set-var(txn.is_media) bool(true) if is_media

http-request cache-use mediacache if { var(txn.is_media) -m bool true }

http-response set-header Cache-Control "max-age=3600, public" if { var(txn.is_media) -m bool true }
http-response del-header Set-Cookie if { var(txn.is_media) -m bool true }
http-response del-header Vary if { var(txn.is_media) -m bool true }
http-response cache-store mediacache if { var(txn.is_media) -m bool true }

This is aggressive only if removed from its context. In this service, with this media policy, it is a reasonable choice. FediMeteo is not serving private media under these paths. It is mostly serving the same public avatar over and over.

For the same reason, I clean the request before it reaches the backend:

http-request del-header Authorization if { var(txn.is_media) -m bool true }
http-request del-header Cookie        if { var(txn.is_media) -m bool true }

The result is exactly what I want: the shared avatar becomes an almost perfect cache object. Small, public, repeatedly requested, and served by HAProxy instead of snac.

ActivityPub JSON microcaching

acl is_ap_json   req.hdr(Accept),lower -m sub application/activity+json
acl is_ap_ldjson req.hdr(Accept),lower -m sub application/ld+json
acl is_outbox    path_end /outbox
acl is_get       method GET
acl has_auth     req.hdr(Authorization) -m found
acl has_cookie   req.hdr(Cookie) -m found

So I only mark public ActivityPub GET requests as cacheable:

http-request set-var(txn.is_activitypub) bool(true) if is_get !is_outbox is_ap_json !has_auth !has_cookie
http-request set-var(txn.is_activitypub) bool(true) if is_get !is_outbox is_ap_ldjson !has_auth !has_cookie

It must be a GET, because I am not caching deliveries or anything that changes state. It must not be /outbox, because outbox collections are not the traffic I want to cache here. It must not have Authorization, and it must not have cookies, because authenticated or user-specific requests do not belong in a shared public cache.

Then the cache can be used and populated:

http-request cache-use jsoncache if { var(txn.is_activitypub) -m bool true }
http-response set-header Cache-Control "max-age=60, public" if { var(txn.is_activitypub) -m bool true }
http-response cache-store jsoncache if { var(txn.is_activitypub) -m bool true }

This is microcaching in the most practical sense. It reduces repeated work without changing the nature of the service.

Static media paths

acl is_short_path path_reg ^/[^/]+/s/
http-request cache-use mediacache if is_short_path

In FediMeteo this is less central than on a normal social instance, because I deliberately do not use media except for the avatar and basic static objects. Still, the rule fits the general policy: let HAProxy handle repeatable edge work, and let snac spend its threads where they are actually needed.

Vary, but not without limits

process-vary on
max-secondary-entries 12

For media, I remove Vary before storing the response. A shared avatar does not need to vary by Accept. For ActivityPub JSON, I am more careful because the representation matters.

Again, the important thing is not the number itself. It is the decision to make variation explicit and limited.

Seeing whether it works

http-response set-header X-Cache-Status HIT if !{ srv_id -m found }
http-response set-header X-Cache-Status MISS if { srv_id -m found }

Did this request reach snac?

A test can be as simple as:

curl -I https://it.fedimeteo.com/path/to/avatar.png
curl -I https://it.fedimeteo.com/path/to/avatar.png

For ActivityPub JSON, the test must use the right Accept header:

curl -I \
  -H 'Accept: application/activity+json' \
  https://it.fedimeteo.com/some/activitypub/object

curl -I \
  -H 'Cookie: test=value' \
  -H 'Accept: application/activity+json' \
  https://it.fedimeteo.com/some/activitypub/object
curl -I \
  -H 'Authorization: Bearer fake' \
  -H 'Accept: application/activity+json' \
  https://it.fedimeteo.com/some/activitypub/object

Compression and operational paths

filter compression
compression algo gzip
compression type text/css text/html text/javascript application/javascript text/plain text/xml application/json application/activity+json

There is also a local Prometheus exporter:

frontend prometheus
  bind 127.0.0.1:8405
  mode http
  http-request use-service prometheus-exporter
  no log

What this changes in practice

The map keeps hostname routing manageable. The backend definitions keep each country isolated and limited. The static homepage avoids dynamic work for something that changes once per hour. The shared avatar gives HAProxy one very hot media object to serve directly. The media cache keeps public files away from snac. The JSON microcache absorbs short ActivityPub bursts. Header cleanup prevents useless variation. Connection reuse avoids unnecessary backend connection churn.

But all of this is only a longer way of saying one thing:

fewer requests reach snac.

That is the metric I care about here.

Not because snac is slow. If anything, FediMeteo exists in its current form because snac is efficient enough to make this kind of project possible on a very small VPS. But precisely because the whole architecture is small and pleasant, I do not want to waste resources where there is no need.

This is also consistent with the rest of the project. Forecasts are serialized by scripts. Updates happen every six hours. The homepage is regenerated hourly. Countries live in separate jails. Snapshots and backups are handled outside the application. No single component tries to be the entire system.

HAProxy is just another small piece, but it sits in the right place to remove a lot of repeated work.

Caveats

It matches FediMeteo as it is now: almost no media, one shared avatar, static homepage, public forecasts, many small snac instances, and ActivityPub traffic that can benefit from a short public cache when there are no cookies or authorization headers.

If I decide one day to use media in forecasts, the media cache rules will need to be reviewed. If I use different avatars for each city or country, the cache will still work, but I will lose the very nice property of one shared, always-hot avatar. If ActivityPub responses become actor-dependent, public JSON caching must be reconsidered. If one country grows a very different traffic pattern from the others, it may deserve a different limit or policy.

This is why I do not like presenting configurations as magic. A good configuration is a written form of the assumptions behind a service. When the assumptions change, the configuration must change too.

Conclusion

The HAProxy layer follows this idea. It terminates TLS, routes hostnames through a map, reuses backend connections, serves the shared avatar from cache, microcaches public ActivityPub JSON, avoids authenticated and cookie-based traffic, and gives me a small diagnostic header to see what is happening.

There is no single brilliant directive here. There is only the usual work of matching infrastructure to reality.

FediMeteo publishes weather forecasts as text and emoji. The homepage is static HTML updated every hour. The accounts share the same avatar because it is enough, and because it is better for the cache. Each country has its own snac instance in its own FreeBSD jail. HAProxy stands in front of them and tries, quietly, not to bother them unless it has to.

I like this kind of infrastructure.

Not because it is invisible, but because when it works well, it leaves very little to say.

https://it-notes.dragas.net/2026/05/18/fedimeteo-haproxy-and-the-art-of-not-wasting-snac-threads/

#ITNotes #NoteHUB #fediverse #freebsd #haproxy #hosting #jail #networking #ownyourdata #server #snac #snac2 #social #web

@crse There is no mention of Fediverse or ActivityPub in the project description on GitHub and their website is not working for me (Cloudflare error).

As a general rule, if the developer does not prioritise the Fediverse, the app will not be included.

@TomSeppert @golemwire oh, snac is great. It's the platform that is powering #FediMeteo

More amazing response from Stefano: "fuck off"

"AI is going to replace a lot of jobs."

Ok, what do you think is gonna happen when you stop paying the "don't riot" bill? How long can you go without paying that bill before an angry mob is gonna come to collect? You can tell from their vacant eyes that they never considered that.

They're gonna go in their bunkers... And then what? They all care about getting into the bunkers and never consider that the doors can be welded shut and the vents filled with concrete.

LLMs can do a lot of the work people are tasked with doing on a regular basis, because a lot of the work people do is bullshit. The majority of what we do isn't to achieve any goal, it's a way to distribute just enough wealth to keep things calm while keeping us all too busy to actually make things better.

We aren't paid to make stuff or do things. We're paid not to riot. Elites used to know that. The fact that they've forgotten how the machine works is evident in its current implosion, and will only become more obvious as they forget the one thing that actually keeps them safe.

CC: @reiddragon@fedi.catto.garden @prahou@merveilles.town @cyanidesunrise@zoner.work

• Juanita
• PUNK NØT DEⒶD
• XVI LA·TORRE
• ELLA ES LA NOCHE

Alt...

A photo of four small drawings

I'm mostly only good for complaining and shitposting but I like reading the stuff you people post

As I was heading home, I was listening to the radio for a bit. The host said something that made me think:

"I won't read the comments, because I've been studying and living what I talk about for thirty years, and I'm full of doubts. Almost everyone who comments, by contrast, heard about it yesterday and already has it all figured out. I don't want to feel stupid, so I'll gloss over them."

#artwork

the full thing

#artwork

Alt...

A drawing by Ángel Ortega of a wooden boat with biomechanical legs

in the
darkest hour
of man

saddle the steed
of apocalypse

and ride with
angels of hell

#unix_surrealism #comic #tarot #occult #computers #art #fediart #triapul

Alt...

VII THE CHARIOT