#devops

Lobste.rs moved to SQLite, and the HN thread had sharper lessons than the post itself:

• WAL checkpoints only run during “reader gaps.” Keep reads/writes continuously overlapping and the WAL file grows unbounded, a DoS vector kgeist reproduced with short-lived reads/writes, not just long-lived readers as the docs imply.
• Writes are fully serialized, one fsync each, yet app-layer batching still gets 100k+ writes/sec.
• Plain rsync on a live .db file can silently corrupt it since it doesn’t understand SQLite transactions. Use sqlite3_rsync instead.
• The real weak point is schema migrations: treat SQLite like a KV store, or reach for CQRS, to keep the churn low.

SecretSpec declares secrets once in secretspec.toml (names + descriptions, never values) and resolves them from any of 11 backends: keyring, 1Password, Vault, AWS, GCP, .env. Same command everywhere: secretspec run --profile production -- npm start. Per-secret fallback chains (providers = ["vault", "keyring", "env"]) and a ref = { item, field } form points at a secret you already have elsewhere, no renaming. Sharpest bit: agents get held to a stricter bar by default. require_reason = "agents" forces secretspec run --reason "..." before an AI agent can read a secret, appended to a local audit log; humans running interactively are unaffected. Rust core, SDKs for Python/Go/Node/Ruby/PHP/Haskell. Worth piloting on a project drowning in .env sprawl.

mise let’s you manage dependencies at OS level and project level. Thinking to manage my dev machine. The hard part is documenting what I have installed.

Hono based on web standards is a great option for js runtimes esp. if you plan to deploy your code to cloudflare workers, bun or deno. You get faster startup time and cross-platform compatibility.

The free-threaded version of python can be added to uv and github actions with t suffix. e.g. 3.14t and 3.13t source

New tools:

• gh-actions-lockfile to generate and verify lockfiles for gh-actions
• Proxyman is more user-friendly http debugging proxy than Charles Proxy on MacOS

actions/checkout saves the workflow token (GITHUB_TOKEN or a custom one) in the checked-out repo’s .git/config by default. Workflows that upload the repo as an artifact leak it, and Unit 42 found many projects doing this. GitHub calls it intended behaviour. Turn it off, and scan workflows with zizmor, which would have caught the Ultralytics injection.

- uses: actions/checkout@v4
  with:
    persist-credentials: false