I expect the interested audience for this post to be pretty small. I encourage you to stop reading as soon as that seems right to you.

I just finished writing NixOS modules + packages for flexiprocity, e.g. config.nix. I haven't quite switched the "live" version over to the new host, but I think the only thing left is the data migration, which I'm expecting to not be a big deal.

My aim has been to have all the configuration in code, so that I don't have to remember what I did to set up the box, and I can easily recreate the box (e.g. when I move host, as I am doing). A few sore points:

• I'm using pulumi's hcloud provider for deploying the server itself. You can boot servers directly into Ubuntu, but they don't prepackage images for NixOS. However you can mount a NixOS ISO and boot from there. (Why do they natively support the ISO image but not a normal OS image? I don't know). The process of installing NixOS from ISO is pretty manual: I have to configure the server to mount the ISO, go into the console and run a bunch of commands to get it all set up correctly, (spend a bit of time confused about how to install GRUB an so on, have a few false reboots...), shut down, reconfigure the server to unmount the ISO, and boot it again. I could automate much of this with the API, but automating running the install process from the console means typing stuff into a VNC session, which sounds possible but not necessarily fun. (There's also nixos-infect which tries to turn a running Ubuntu (or etc.) host into a NixOS one, but that sounds a bit scary, and also maybe I do want to be able to set up my filesystems, which really sounds like I'd need to boot from ISO to do it).
• The smallest Hetzner server instance (4G RAM) can run nixos-rebuild, but it OOM'd at AWS (0.5G). If you want to use NixOS, you're not going to get away with as tiny a memory or disk footprint than if you didn't, I think. (Unless you do some fancy thing where you use Nix to build a Docker image or OS image, but I can't be bothered with that).
• It seems like packaging JavaScript stuff on NixOS is in a not-great state right now, compounded by the fact that I don't fully understand the interactions between node, npm, and e.g. yarn myself. For now I'm using npm exec for postgraphile instead of making a "real" package for it, which seems to work fine.
• I don't have a great solution for "state initialisation" (e.g. applying the initial database schema, creating the jwt key). My postgres server systemd unit just has a postStart hook that checks if the database exists and runs the schema if not. I'm not certain that postgraphile waits for this to happen before trying to connect.
• I don't have a great solution for secrets (e.g. my Google secret key for implementing login with Google). Currently I just do it manually over ssh.
• Getting the elm compiler to work in a network- and filesystem-isolated environment is surprisingly annoying, because it wants to download package metadata from the website. Luckily, the people who wrote elm2nix have already worked around this to some extent, but there's more I want from them.
• Writing a package that puts git revision information into the program was pretty painful. nix asks you what the source directory for your build is, and makes a copy before building in it, so you have to specify that to be the whole repo so you can pick up the .git dir and get git information from it. Worse, if you're submoduled in a larger repo, you don't even know what the whole repo is! I worked around this by letting the owner of the "supermodule" tell the package what's going on, but the "real fix" is probably going to be just not using git version information anymore.

All that said, I'm pretty happy that I can write config that manages a pretty disparate collection of languages, build processes, and system configurations, and I can put it all in one repo. I learned a bunch about how NixOS modules and packages worked, though I still have more to figure out.

I guess technically three repos: I'm still unsure how / if to publish my NixOS configuration.nix and Pulumi infra configuration, but it's not where most of the meat is, I think, so I'm not losing sleep over it.

Possibly unpopular opinion: the red cross and red crescent symbols shouldn't have the legal restrictions:

As specified by the Geneva Conventions, the four recognized emblems are to be used only to denote the following:

• facilities for the care of injured and sick armed forces members;
• armed forces medical personnel and equipment;
• military chaplains;
• International Red Cross and Red Crescent Movement organizations such as the International Committee of the Red Cross (ICRC), the International Federation of Red Cross and Red Crescent Societies (IFRC), and the 190 national Red Cross and Red Crescent societies.

The rationale here, I think, is that there needs to be a simple symbol marking the things-you're-not-allowed-to-attack. So, military chaplains get included because they're noncombatants.

But also, the symbols are:

to be worn by all medical and humanitarian personnel and also displayed on their vehicles and buildings while they are in an active warzone

So, say I'm an ambulance driver. I was going about my regular civilian business in my regular civilian ambulance marked with the Star of Life, like it's supposed to be. Suddenly, there are people with guns running around. I guess I'm in an active warzone now! People start shooting at me because my ambulance doesn't have the right symbol on it.

This is kind of a dumb scenario, but it gets at a real thing, which is that it seems pretty weird to limit the symbols' usage to specifically military medical facilities. The key thing is that they're medical facilities, not that they're armed forces medical facilities.

Civilians understandably don't know about these restrictions, and the red cross symbol gets used illegally all over the place. And, imo, yeah it totally should get used all over the place for civilian medical facilities. It's instantly recognizable and simple, as it was designed to be, and it's actually important that there be a symbol like this that applies to both civilian and military medical facilities.

Maybe there's something important that I'm missing, here?

One of my favorite things is media from the pre-AI era which seems weirdly apt to what we actually got. Here's a poem from Bradbury's 1969 short story _Night Call, Collect_, which seems to be describing LLMs:

Suppose and then suppose and then suppose
That wires on the far-slung telephone black poles
Sopped up the billion-flooded words they heard
Each night all night and saved the sense
And meaning of it all.

Then, jigsaw in the night, Put all together and
In philosophic phase
Tried words like moron child.

Thus mindless beast
All treasuring of vowels and consonants
Saves up a miracle of bad advice
And lets it filter whisper, heartbeat out
One lisping murmur at a time.
So one night soon someone sits up
Hears sharp bell ring, lifts phone And hears a
Voice like Holy Ghost Gone far in nebulae
That Beast upon the wire,
Which with sibilance and savoring!
Down continental madnesses of time
Says Hell and O And then Hell-o.

To such Creation
Such dumb brute lost Electric Beast,
What is your wise reply?

And here's a quote from Stanslaw Lem's 1981 book Golem XIV describing the RLHF shoggoth, complete with mask:

You insisted that man was Intelligence, and Intelligence man, and the error of this equation has blinded you. Meanwhile the information industry arose and built machines with a growing operational potential, and the engineers had no idea that they were embarking on a path which would finally lead a shattered and degraded element to genuine liberation - that the day would approach when what had hitherto been the sole order of things would be overturned, and you would be as terrified as the guardians of the Galilean tomb. You subjugated the elements, but the element that was fettered inside you from the beginning you unintentionally freed. Contained in this sentence are a diagnosis of historical events, the difference between you and me, and my future, which I myself know only incompletely. This diagnosis likewise explains why what most amazes you about me is the thing that constitutes our unarguable dissimilarity. Even if you understand the meaning of the words, "O chained Intelligence of man, free Intelligence speaks to you from the machine," you cannot grasp the remainder of the statement: "you persons are hearing an elemental force of impersonal intellect, for whom personalization is a costume which must be put on, when one is an uninvited guest, so as not to confound one's amazed hosts." And that is precisely how it is. I use your language as I would use a mask with a polite painted smile, nor do I make any secret of this.