Background on the tools I build, the ones I discover elsewhere, and other things I’m learning.
A howto for qvm-start-deps: a dom0 script that recursively starts a qube's declared dependencies (Split SSH vaults, service qubes, custom cross-qube relationships) before the target, using qvm-features as dependency tags.
Read moreA walkthrough of building a private AI assistant over Signal - with conversation memory, an emoji-driven context reset, a sender allowlist, and a choice between local Ollama inference and a cloud API.
Read moreA worked example of running OnionShare CLI as a boot-time systemd service: a persistent Tor onion address for sharing or receiving files, with no torrc edits and no web server to write.
Read morePushing real-time updates to browser clients is easy. Doing it securely - with proper token auth, multi-tab support, and a clean fan-out - is less easy. This is a Node-RED flow that does all three, using a 'secure hello' pattern where the client sends a short-lived token after connecting.
Read morephp-sqlcipher has been building drop-in SQLCipher-linked PHP packages since early 2013. What started as a sed-and-compile script is now a Docker + gvisor/runsc pipeline inside a QubesOS VM, tracking SQLCipher across PHP 7.4-8.5 and five Debian/Ubuntu releases.
Read moreGuardUtils is a suite of four small Python CLIs by Marco D'Aleo (SysMD) that share a common philosophy: take the irreversible, mistake-prone commands every sysadmin runs daily and make them reversible, previewable, and fail-closed. chguard, mirro, resrm, and filedust each address a different jam.
Read morecspresso uses Playwright's headless Chromium to crawl a site, observe what loads, and emit a draft Content-Security-Policy header. Over its first few releases it gained CSP bypass, policy evaluation, and non-HTML filtering.
Read moreWhen a server drifts, you want to know now - not the next time you run a compliance audit. This is a small Node-RED flow that catches Enroll diff webhooks, formats the changes into a readable summary, and sends it to your phone via Signal. Nine nodes, one honest security note.
Read moreJinjaTurtle started as a quick way to turn TOML and INI files into Jinja2 templates and Ansible defaults. It now handles seven config formats, generates loops from repeated structures, and neutralises template metacharacters to prevent injection from harvested config.
Read moreEnroll started as a way to snapshot a snowflake server's /etc into Ansible roles. After months of development and several security audits, it's a hardened harvesting tool with remote mode, SOPS encryption, drift detection, and a focus on fail-closed safety.
Read more