News

Project notes, lessons learned & history

Background on the tools I build, the ones I discover elsewhere, and other things I'm learning.

Miguel Jacq · 2 September 2026

BoatRules.au: a marine licence practice test that keeps you on your toes

I passed my Victorian marine licence test, but the fixed official practice tests bugged me - same questions, same answer positions, every time. So I built BoatRules.au: a quiz that shuffles everything every sitting, mixes playable horn audio with SVG buoy and light schematics and text questions, and leans on spacing, interleaving, retrieval practice and dual coding to make the rules actually stick.

Miguel Jacq · 31 August 2026

SYN City: a networking arcade game (just for fun)

A side project I built just for fun - a hold-and-release arcade jumper where every level is a different networking or sysadmin idea. It started as a derivation of 100 Jumps, with its author's blessing, and grew into 27 levels of packet-pushing nonsense.

Miguel Jacq · 29 August 2026

Running OnionShare CLI as a systemd service

A worked example of running OnionShare CLI as a boot-time systemd service: a persistent Tor onion address for sharing or receiving files, with no torrc edits and no web server to write.

Miguel Jacq · 22 August 2026

Secure WebSocket push notifications from Node-RED

Pushing real-time updates to browser clients is easy. Doing it securely - with proper token auth, multi-tab support, and a clean fan-out - is less easy. This is a Node-RED flow that does all three, using a 'secure hello' pattern where the client sends a short-lived token after connecting.

Miguel Jacq · 15 August 2026

php-sqlcipher: encrypted SQLite for PHP, done properly

php-sqlcipher has been building drop-in SQLCipher-linked PHP packages since early 2013. What started as a sed-and-compile script is now a Docker + gvisor/runsc pipeline inside a QubesOS VM, tracking SQLCipher across PHP 7.4-8.5 and five Debian/Ubuntu releases.

Miguel Jacq · 8 August 2026

Why you should be using SysMD's GuardUtils

GuardUtils is a suite of four small Python CLIs by Marco D'Aleo (SysMD) that share a common philosophy: take the irreversible, mistake-prone commands every sysadmin runs daily and make them reversible, previewable, and fail-closed. chguard, mirro, resrm, and filedust each address a different jam.

Miguel Jacq · 1 August 2026

CSPresso: brewing Content Security Policies from real page loads

cspresso uses Playwright's headless Chromium to crawl a site, observe what loads, and emit a draft Content-Security-Policy header. Over its first few releases it gained CSP bypass, policy evaluation, and non-HTML filtering.

Miguel Jacq · 25 July 2026

Wiring Enroll drift detection to Signal

When a server drifts, you want to know now - not the next time you run a compliance audit. This is a small Node-RED flow that catches Enroll diff webhooks, formats the changes into a readable summary, and sends it to your phone via Signal. Nine nodes, one honest security note.

Miguel Jacq · 23 July 2026

SQLite batch inserts: wrapping transactions for a 94% performance win

A practical case study in SQLite transaction tuning: why each implicit insert is its own transaction, how BEGIN IMMEDIATE changes the picture, and the monitoring that proved the fix worked.

Miguel Jacq · 18 July 2026

JinjaTurtle: turning config files into templates, safely

JinjaTurtle started as a quick way to turn TOML and INI files into Jinja2 templates and Ansible defaults. It now handles seven config formats, generates loops from repeated structures, and neutralises template metacharacters to prevent injection from harvested config.

Miguel Jacq · 11 July 2026

Enroll: from snowflake harvester to hardened Ansible generator

Enroll started as a way to snapshot a snowflake server's /etc into Ansible roles. After months of development and several security audits, it's a hardened harvesting tool with remote mode, SOPS encryption, drift detection, and a focus on fail-closed safety.