The Shepherd is an init system and process manager initially built for GNU Hurd and now used by Guix. It can run with either root or user privileges to launch daemons, execute tasks, and manage processes. As we’ve discussed previously, Spritely has been working to port the Shepherd to Goblins. We’ve been a bit quiet since that announcement, so what’s the buzz?

First, as a quick refresher, the Shepherd is a great project to port to Goblins because it’s already built on the actor model. By switching to Goblins, we can bring the following benefits to the project:

• Streamline the codebase by replacing the Shepherd’s ad-hoc actor model implementation.
• Reduce the likelihood of concurrency bugs caused by the existing actor model implementation that exposes too much of its CSP foundation using Fibers.
• Transform services (and other actors) into object capabilities for fine-grained management of privileges, which will (eventually) make it to possible to unify the currently separate worlds of “system” Shepherds that run as root under PID 1 and “user” Shepherds that run as an unprivileged user.
• Enable Shepherd to use the Object Capability Network (OCapN) to open the door for distributed networks of “Communicating Shepherd Processes” in the future.

Since our last post, we’ve done the following:

• Wrote Goblins versions of the core actors like the service controller, service registry, and process monitor.
• Added unit tests for all of the core actors (there were none before).
• Rewrote the public API as a compatibility layer on top of a new Goblins actor API. This new API is private for now.

What this means is that all of the extant Shepherd functionality will soon be available in the Goblins port. We’re currently working out the remaining sneaky, tricky, subtle bugs in order to have a full 1:1 port that passes the existing test suite. We’re getting very close, so we felt it was time to share this update!

I noticed while creating a new post that if I provide a Thumbnail URL with an external (not hexbear.net) URL, then the original image gets used when viewing the post. I first noticed it on this post where I added a youtube thumbnail icon (check it in the browser console).

I tried researching if there's a bug for this in upstream Lemmy:

This one seems like it would have fixed it: LemmyNet/lemmy-ui: Update post listing to prefer local image when available

And see also this: LemmyNet/lemmy: Add initial skeleton of image proxy improvements for feedback

Unfortunately I'm not that familiar with the Lemmy codebase, but how possible would it be to proxy+cache thumbnails? I don't quite mean store it permanently in the database, just proxy the source image and cache it for performance reasons. Otherwise, maybe we should disable the thumbnail URL for now until this support is added upstream?

I remembered this song I hadn't listened to in years. Checked out the musician's page and saw that she's actively posting pro Palestine activism hard. Give her a listen!

In Russian they don't say "I love you" they say "пожирать плоть капиталистов" which means "we are one and the same" and I think that's beautiful

[Screenshot of google translate]

Query: Пожирать плоть капиталистов
Result: Eat the flesh of the capitalists

No clue what they're saying but I'm enjoying the instrument selection and dance

Recently I've been reading a lot about the topic of mesh VPNs (tinc, Nebula, Tailscale, ZeroTier, Netmaker, Netbird, etc) and find them pretty interesting. Is anyone here using these in some capacity at home or maybe at work?

My problem so far is that many of the options seem to be aimed at corporate use, understandably, so the developers can earn enough to keep doing it. This means the focus is on a centralized control plane, one server which knows everything about the entire network and manages firewall rules for all of it.

This is why I'm leaning towards Nebula, since I think the decentralized design just makes more sense. There is some centralization for issuing certs though. How do I go about setting up PKI? Is there some open source solution for managing certificates and automatically renewing them?

There's also the option of using vanilla WireGuard. This is my current setup, but I really like the idea of meshing, since it means I don't need to care if my devices are physically on the same network or not, the best connection will be used. Basically the layer of abstraction is a nice convenience that lets me think about hosts or services independently of the physical network topology.

I'm interested to hear your thoughts on this topic! What's your setup like and what do you use it for?