Stut.dev

narc: GitHub Action Runners on Nomad

Tue, 06 Oct 2026 00:00:00 +0100

I ran out of GitHub Actions minutes. Public repositories get hosted runners for free, but private ones draw from a monthly allowance, and between the platform and a handful of projects I was burning through it well before the month was out. The obvious fix was to pay for more. The less obvious fix was sitting right there: a Nomad cluster that spends most of its time with CPU and memory to spare.

My Server Setup, 2026 Edition

Fri, 21 Aug 2026 08:00:00 +0100

Back in 2023 I wrote a five-part series describing the infrastructure that hosts my websites and projects. Almost none of it is true any more. The workloads are mostly the same; nearly everything underneath them has been replaced. This is the update.

Then and now

	2023	2026
Hosting	3 Scaleway VPSes	4 Hetzner Cloud VPSes + a home cluster
OS	Ubuntu 22.04	NixOS
Config management	Ansible + Terraform	Nix flakes (the whole machine is the repo)
Clusters	One	Two, fully independent (cloud and home)
Secrets	Vault	sops-nix
Deployment	DockerHub webhooks + Noman	A home-grown GitOps reconciler (cd)
Admin access	SSH bastion	Tailscale
Certificates	Aleff + Let’s Encrypt	cloudflared (TLS terminates at Cloudflare)
Static sites	Docker containers in the cluster	Mostly Cloudflare Pages

The scheduler survived: it’s still Consul and Nomad, and I still think that’s the right amount of orchestration for this scale. Everything else went.

My Claude Code Skills

Thu, 20 Aug 2026 00:00:00 +0100

I’ve published a small collection of Claude Code skills as a plugin. There are two so far: one that runs a technical interview against you and then tells you the truth about how it went, and one that walks you through configuring a GitHub repository properly.

Neither of these is technically impressive. Both exist because of the same observation: there are things I know I should do, and things I know would be good for me, and in both cases the friction of getting started is what stops me. Skills turn out to be a nice way of packaging up “the version of me that has already thought about this” so that future me can just invoke it.

imgsrv: Serving images the lazy way

Tue, 21 Jul 2026 00:00:00 +0100

imgsrv is a small open source Go service that resizes and transcodes images on demand, sitting behind nginx. There’s nothing revolutionary about the idea: nginx serves everything it can straight from disk, and only a cache miss ever reaches the Go service. When that happens it generates the requested version of the image, writes it to disk, and returns it. Every request after that is a plain static file serve that never touches the Go code at all.

Introducing Wakuwi

Wed, 15 Jul 2026 00:00:00 +0100

Wakuwi is an open source, lightweight, read-only web interface for exploring Kubernetes clusters. It runs locally, uses the contexts already present in your kubeconfig, and requires no additional configuration. Install it, run it, and point your browser at localhost. It can also be run in your Kubernetes cluster.

The name stands for:

Why Another KUbernetes Web Interface?

Which is a perfectly reasonable question.

It started with port forwarding

Wakuwi did not begin as an attempt to build a general Kubernetes interface.

My Server Setup Part 5: Eliminating the Downtime

Sat, 11 Feb 2023 00:00:00 +0000

Note: This series is now very out of date; a lot has changed since it was written back in 2023. Read the update: My Server Setup, 2026 Edition.

In this series of posts I am describing the infrastructure that hosts all of my websites and development projects.

Summary

In the Outstanding Issues section of part 4 I noted that the update mechanism results in a few seconds of downtime for a site when it’s updated. This is clearly unacceptable.
The resolution for this was to separate out the web server from the content.
Docker images are no longer built containing the site content.
Instead a sidecar service clones and periodically pulls the repo into a directory on disk shared by the sidecar and the web server containers.
Downtime has been almost completely eliminated (miniscule window per file updated).

How Nomad enables this solution

When a Docker-based Nomad job is started a number of directories are created and auto-mounted into the containers. One of these is shared across all tasks in a group, known as the alloc directory. This directory is what enabled this solution to work.

My Server Setup Part 4: Continuous Delivery

Wed, 04 Jan 2023 00:00:00 +0000

Note: This series is now very out of date; a lot has changed since it was written back in 2023. Read the update: My Server Setup, 2026 Edition.

In this series of posts I am describing the infrastructure that hosts all of my websites and development projects.

Summary

All services exist in their own GitHub repository.
Each repository contains a Dockerfile in the root that will build the Docker image.
Each one has a GitHub action that’s triggered by merges to master and will tag the repo with the current date and time.
Each repository on GitHub has a matching repository on DockerHub.
The DockerHub repository watches for new tags and will trigger a build.
A webhook will inform Noman of a new image being available.
Noman will update the image tag in Consul which will trigger Nomad to update the job.

GitHub

This is where I’ve chosen to keep the source for my projects. Each service has its own repository, and the common feature is a Dockerfile in the root that will build the deployable image. No other build steps can be required, everything needs to happen in the Dockerfile for this process to work.

My Server Setup Part 3: Nomad Jobs

Tue, 03 Jan 2023 00:00:00 +0000

Note: This series is now very out of date; a lot has changed since it was written back in 2023. Read the update: My Server Setup, 2026 Edition.

In this series of posts I am describing the infrastructure that hosts all of my websites and development projects.

Summary

All services I currently run are deployed as Docker containers.
Various static HTTP sites based on plain HTML, Jekyll, Hugo, and custom Python generators.
A number of development projects running everything from Go to PHP to Python.
Supporting services: Fabiolb, Aleff, Prometheus, Alertmanager, Noman (custom component).

Docker containers

Nomad supports deploying a wide range of packages, from raw binaries through Docker containers to Java jars. For my pusposes I’ve only needed to use Docker container so far, but it’s a comfort knowing there are other options available in the ecosystem I’m using.

My Server Setup Part 2: Nomad

Mon, 02 Jan 2023 00:00:00 +0000

Note: This series is now very out of date; a lot has changed since it was written back in 2023. Read the update: My Server Setup, 2026 Edition.

In this series of posts I am describing the infrastructure that hosts all of my websites and development projects.

Summary

Each server runs Nomad in both client and server modes.
Each server also runs instances of Consul and Vault.
Fabiolb is used for external proxying and load balancing.
A custom, open-sourced tool called Aleff is used to automatically obtain and renew certificates from Let’s Encrypt.

Nomad

As mentioned in the previous post I was using Kubernetes for a while, but since the company I work for has standardised on Nomad I’ve switched my personal setup so I can learn more about it and the whole Hashicorp stack. The experience was less than smooth but after a few false starts I now have a stable cluster and everything is working as well as it did with Kubernetes.

My Server Setup Part 1: Hosting and Configuration

Sun, 01 Jan 2023 00:00:00 +0000

Note: This series is now very out of date; a lot has changed since it was written back in 2023. Read the update: My Server Setup, 2026 Edition.

In this series of posts I will describe the infrastructure that hosts all of my websites and development projects.

Summary

Hosted at Scaleway.
3 cheap development-grade virtual servers.
Running Ubuntu 22.04.1 LTS, Nomad, Consul, and Vault.
Server-to-server communication over a host-provided private network.
Server configuration managed with Ansible.
Nomad job configuration is managed with Terraform.
Only HTTP, and HTTPS are exposed on public IPs.
Access is provided via SSH by a secure bastion server connected to the private network.
DNS is provided by Gandi, and all domains have A records for all public IPs in the cluster.

Hosting

I’ve been running publicly available servers since 1998, including running my own hosting company for nearly 10 years, and the main thing I’ve learned is that nobody does it all well. In recent years I’ve used AWS, DigitalOcean, Vultr, and a number of other smaller hosts, and each one had strengths and weaknesses. I currently use Scaleway and I’m very happy with their services so far.

Template-based DNS zone management

Mon, 03 Dec 2012 00:00:54 +0000

I own nearly 100 domain names, which is a pretty modest number against some people and organisations I know. Most of them are currently registered with Gandi.net and I’ve always found their service to be good value for money and that’s still true today.

Most of the DNS for those domain names is also hosted with Gandi. Why? Because it’s included in the registration cost. However, their zone management tool, while it had a major overhaul in the last year which has made it a lot better, it’s still a major pain to use. Unfortunately this seems to be a common theme with DNS management interfaces.

Snippet: HTTP authentication in PHP

Sun, 11 Nov 2012 00:00:32 +0000

HTTP authentication is the easiest way to make a page or area of a website secure. It’s very easy to accomplish with pure PHP, so no web server configuration is required making it a lot more portable.

This function implements a very simple HTTP Basic Auth authentication system. Simply call it before you do anything else in your script, pass it an array of valid users (username => password), an optional description of what’s being secured and it will do the rest.

Handling email notifications in PHP

Sat, 12 Nov 2011 00:00:49 +0000

Twitter sends notifications of new followers and direct messages by email. While you can use the API to keep track of those things it wastes hits and it’s incredibly inefficient especially for accounts with minimal activity.

I run several Twitter-based services but they all share the same email address. This allowed me to use the same email handling setup to process all email coming in from Twitter. So far it’s working really well but it means this script is a bit more involved than it needs to be.

Fortune's Tower in PHP

Tue, 16 Aug 2011 00:00:08 +0100

When I get bored while working I choose something from a list of things I want to have a go at someday. Some things are “read this blog post”, or “learn about this technology”, but most are along the lines of “make this”. Today I picked a “make this” item… to implement the game Fortune’s Tower.

I came across this game in the Fable® II Pub Games on my Xbox. I have never actually played Fable® II, and I’ve barely touched the other pub games in the Xbox Live Arcade Pub Games, err, game, but I keep returning to Fortune’s Tower. While playing it I’ve tried various strategies but always wanted an automated way to test whether my strategies are actually any good. The best way to do that is to write some code that can play the game, so that’s what I did.

Snippet: Array element access in PHP

Tue, 12 Apr 2011 00:00:39 +0100

A common logic pattern that’s seen when dealing with GET and POST parameters in PHP is to check whether the array element exists, then set another variable to that or a default. It usually looks something like this…

$var = (isset($_GET['var']) ? $_GET['var']) : '');

If you don’t develop with notices turned on (WHICH YOU SHOULD!) you probably haven’t seen the problem that this code gets around. Simply referring to $_GET['var']will produce a notice if it does not exist.

Twitter TOS changes

Sun, 13 Mar 2011 00:00:11 +0000

A couple of days ago, Ryan Sarver of Twitter sent an email to the API developers mailing list notifying us of changes to their terms of service. As per usual the community have exaggerated the implications of these changes to the point where it’s now pure comedy. As has happened every time Twitter make any changes that may affect developers, developers are panicking, and for no good reason that I can find.

Misleading broadband ads

Mon, 24 Jan 2011 00:00:48 +0000

My thoughts on ISPs and how they’re whiney little kids who like to throw their toys out of the pram have been previously documented on this site. Apparently the advertising industry is set to get involved, and, according to NMA, is poised to ask the public for their thoughts on how broadband suppliers advertise their services.

Here are my thoughts on this prospect.

That article states that…

Concerns centre on claims made by suppliers about the maximum speed customers can expect to receive from their broadband service against the speeds actually experienced.

TweetMeme live test video from April 2009

Fri, 19 Feb 2010 00:00:03 +0000

The other day I was continuing my long-term quest to sort through all the flotsam and jetsam of accumulated crap on my hard drive when I came across the following video (click through if you don’t see the video below). Recorded in April 2009, it shows the first version of the TweetMeme Live functionality without any rate or minimum retweet restrictions. As you can see it moved pretty quickly.

Bear in mind that these are unique URLs, not simply repeats of URLs already seen. Between seeing a URL in a tweet and it appearing on this page the system has followed any redirects, grabbed and parsed the contents of the page and stuffed it into a database, and it does it all nearly instantly. Pretty impressive stuff if you ask me.

PHP job queue

Fri, 29 May 2009 00:00:31 +0100

One of the pillars of a scalable website is ensuring that only activity which is required to build a page should be performed during the processing of a page request. Activities that fall under this category commonly include sending emails, recording statistics and general housekeeping such as removing temporary files.

Back when I started working on sites big enough for these activities to cause a problem I went down the obvious route of making a PHP CLI script for each job that needed doing and getting it to run using cron. This worked for a while but as the sites I was working on got bigger and more complex it quickly became clear that this was becoming difficult to manage, so I started to consider alternatives.

Twitter unfollows: Too much information?

Sat, 31 Jan 2009 00:00:09 +0000

A couple of days ago I released a new TwitApps tool called Follows. I know I haven’t talked about TwitApps on this blog yet – that post is coming – but if you follow me on Twitter you should be aware of it.

The Follows service monitors your followers on Twitter and sends you a daily, weekly or monthly email telling you who’s followed and who’s unfollowed you since your last email. Twitter itself has the facility to send you an email every time someone starts following you but does not offer any sort of notification when they stop.

OAuth and Twitter: Realistic expectations

Sat, 24 Jan 2009 00:00:51 +0000

Twitter promised OAuth support a l-o-o-ong time ago, and it would appear to finally be here. Alex Payne sent a “Call for OAuth beta participants” to the developers list yesterday and had an overwhelming response. This predictably triggered a deluge of tweets and blog posts, but the one that caught my eye was on ReadWriteWeb titled “Why Twitter’s New Security Solution Could Pave the Way to a Future Web of Mashups”.

A number of things disturbed me about this post so I posted a comment or two but I believe the issues involved deserve more attention.

Twitorfit

Wed, 17 Dec 2008 00:00:20 +0000

My latest project went live on Monday this week. It’s another Twitter-based toy along the same lines as hotornot but it uses your Twitter account and profile picture. Since launch it’s proved very successful and has spread quickly due to its viral nature.

Screenshot lost :(

The site is called Twitorfit and was the brainchild of a Twitter-based conversation between Nick Halstead of fav.or.it and Andy McLoughlin and Zuzanna Pasierbinska from Huddle. You can read the full story on the Twitorfit blog.

Snippet: Simple templates with PHP

Tue, 28 Oct 2008 00:00:27 +0000

Several templating systems exist for PHP, but since PHP was originally created as a templating language I’ve never understood why more developers don’t use pure PHP in their view layer. The following snippet is a small function that facilitates precisely that.

The only setup required is to simply define TPL_DIR to point to the root directory of your templates. You can then call the function, passing it the relative path to a template file in that directory, an array of variables to be used by the template and you can optionally have it return the results rather than sending them to the browser.

Snippet: Password generator for PHP

Thu, 23 Oct 2008 00:00:24 +0100

Really short snippet today – a password generator. Not much to say about this one since it’s pretty simple. Pass it the length of password you want and optionally a string of valid characters it can use and it’ll give you a random string back.

function GeneratePassword($len, $allowedchars = false)
{
 if ($allowedchars === false) {
 $allowedchars = 'abcdefghijklmnopqrstuvwxyz01234567890';
 }
 $retval = '';
 $maxidx = strlen($allowedchars) - 1;
 for ($i = 0; $i < $len; $i++) {
 $retval .= $allowedchars[rand(0, $maxidx)];
 }
 return $retval;
}

I’ve got something a bit meatier lined up for the next snippet so I recommend subscribing to the RSS feed to make sure you don’t miss it. As always comments, questions, suggestions and requests are welcomed.

Snippet: Singletons with PHP

Mon, 20 Oct 2008 00:00:25 +0100

Today’s snippet describes the singleton pattern. The singleton pattern is a method of creating a class that statically maintains an instance of itself and ensures that no other instances can be created. This is useful for classes that implement app-wide services such as logging, DB access and other shared resources.

The basic requirements for a singleton class are as follows…

The constructor is private. This ensures that nothing outside the class can create instances.
A static method exists that returns the instance. When first called the method creates a statically stored instance of the class. Subsequent calls return the existing instance.
Magic methods to prevent the instance from being cloned or serialized (PHP-specific). PHP provides functionality to clone and serialize objects. By adding simple implementations of the __clone and __wakeup magic methods we can prevent this from happening.

That’s basically it. Here’s a simple example…

Snippet: Time class for PHP

Fri, 17 Oct 2008 00:00:21 +0100

Pretty boring snippet today, but I find it immensely useful. My time class provides representations of periods from OneMinute to OneYear. It only has one method which will calculate an absolute time by adding a given time period to the current time. You can optionally provide a format intended for use by the date function to return a formatted string rather than a timestamp.

Hope you find it useful too.

Snippet: Cookie class for PHP

Thu, 16 Oct 2008 00:00:20 +0100

Today’s snippet is a complete class for normalising cookie usage. In addition to providing methods to set and get cookies you can also check to see if a cookie exists, is empty and delete them without needing to concern yourself with more detail than necessary. Features include…

Cookies Set during a request are immediately available via the Get method.
Deleted cookies immediately cease to exist within the current request.
Pre
defined time spans allow for simple cookie management.
Sensible defaults throughout.

class Cookie
{
 const Session = null;
 const OneDay = 86400;
 const SevenDays = 604800;
 const ThirtyDays = 2592000;
 const SixMonths = 15811200;
 const OneYear = 31536000;
 const Lifetime = -1; // 2030-01-01 00:00:00

 /**
 * Returns true if there is a cookie with this name.
 *
 * @param string $name
 * @return bool
 */
 static public function Exists($name)
 {
 return isset($_COOKIE[$name]);
 }

 /**
 * Returns true if there no cookie with this name or it's empty, or 0,
 * or a few other things. Check http://php.net/empty for a full list.
 *
 * @param string $name
 * @return bool
 */
 static public function IsEmpty($name)
 {
 return empty($_COOKIE[$name]);
 }

 /**
 * Get the value of the given cookie. If the cookie does not exist the value
 * of $default will be returned.
 *
 * @param string $name
 * @param string $default
 * @return mixed
 */
 static public function Get($name, $default = '')
 {
 return (isset($_COOKIE[$name]) ? $_COOKIE[$name] : $default);
 }

 /**
 * Set a cookie. Silently does nothing if headers have already been sent.
 *
 * @param string $name
 * @param string $value
 * @param mixed $expiry
 * @param string $path
 * @param string $domain
 * @return bool
 */
 static public function Set($name, $value, $expiry = self::OneYear, $path = '/', $domain = false)
 {
 $retval = false;
 if (!headers_sent()) {
 if ($domain === false){
 $domain = $_SERVER['HTTP_HOST'];
 }

 if ($expiry === -1) {
 $expiry = 1893456000; // Lifetime = 2030-01-01 00:00:00
 } elseif (is_numeric($expiry)) {
 $expiry += time();
 } else {
 $expiry = strtotime($expiry);
 }

 $retval = @setcookie($name, $value, $expiry, $path, $domain);
 if ($retval) {
 $_COOKIE[$name] = $value;
 }
 }
 return $retval;
 }

 /**
 * Delete a cookie.
 *
 * @param string $name
 * @param string $path
 * @param string $domain
 * @param bool $remove_from_global Set to true to remove this cookie from this request.
 * @return bool
 */
 static public function Delete($name, $path = '/', $domain = false, $remove_from_global = false)
 {
 $retval = false;
 if (!headers_sent()) {
 if ($domain === false) {
 $domain = $_SERVER['HTTP_HOST'];
 }
 $retval = setcookie($name, '', time() - 3600, $path, $domain);

 if ($remove_from_global) {
 unset($_COOKIE[$name]);
 }
 }
 return $retval;
 }
}

Some example usage…

Snippet: Page expiry in PHP

Wed, 15 Oct 2008 00:00:39 +0100

This is the first of what I hope will be a series of posts showing snippets of code from my personal library. My intention is to highlight useful techniques I’ve developed or picked up over the years. Comments, questions, suggestions and requests are welcomed.

This first snippet is a simple function to set appropriate expiry headers. Simply pass it a time period in seconds or a unix timestamp to set the expiry to some time in the future, or 0 to expire the page immediately.

Sessionless sessions

Sat, 26 Jul 2008 00:00:54 +0100

Ok, so the title is a little misleading, but hopefully only until I explain what I mean. The first session refers to PHP sessions, and the second refers to the concept of sessions. Maybe it needs a little more explanation than that.

Do what?

There aren’t many PHP applications (or indeed web applications) out there that don’t need to maintain some form of user state between page requests. This functionality is commonly known as sessions, and most web development languages provide a built-in mechanism for managing them, and PHP is no exception. It’s probably safe to assume that most people reading this probably know what sessions are and how they work, but I think it’s worth taking a moment to spell it out.

Sending email

Wed, 18 Jun 2008 00:00:52 +0100

TLDR: If you’re using PHP you want PHPMailer. If you’re using something else there’s probably an equivalent library (Google is your friend). However, regardless of how you do it you should always consider the impact of your email activities on your users.

Unwanted email is one of the biggest problems on the Internet today and the more you can do to present your website as a responsible sender of email the better.

Is it harder to create usable digital interfaces?

Sun, 13 Apr 2008 00:00:22 +0100

While catching up on Twitter this morning I came across a blog post by David Cushman on the simplicity of riding a bicycle compared to using ebay or iTunes.

I kinda see what he’s saying, but as he points out I think it has more to do with what people are used to. His daughter has almost certainly seen people riding bikes so I would suggest she picked up the general idea through observation rather than it being particularly intuitive. While it’s not likely to happen I’d love to see how someone who’s never seen a bike would go about working out how to ride it.

When will ISPs realise they're supposed to be "service providers"?

Wed, 09 Apr 2008 00:00:48 +0100

This is really daft. It’s been widely covered recently that the BBC iPlayer service is taking off in a big way which is great news for the future of TV. Unfortunately some ISPs are throwing their toys out of the pram and complaining that the increased bandwidth usage is costing them a lot of money and that the BBC should help cover the cost.

This strikes me as an extension of the equally stupid claim that it’s ok to have fair usage limits on unlimited broadband packages. The ISPs provide connectivity to their users and it’s up to them to set their terms of use. If they feel they need to bring in more cash to cover the additional costs incurred by these additional services they should price their packages accordingly, but they should also do so as transparently as possible and not try to pass the cost on to content providers and certainly not to the tax payer.

Web hosting - a mug's game

Sun, 11 Nov 2007 00:00:21 +0000

It is with great regret that I must inform you that SharedServer.net will cease trading at the end of this year. This has been a difficult decision to make, but for various reasons it is not practical to continue.
Me, In An Email To My Customers, Early November 2007

I wrote this in an email to my customers last weekend. After 10 years of running a web hosting service as “a hobby” I’ve decided that it’s no longer practical to continue with it. I’ve had several customers reply wanting to know why, most also saying that they were very happy with the service which is always nice to hear. I can’t go into some of the reasons yet – I’ll post those when I am able to – but hopefully the following will go some way to explaining my decision.

Extracting the map from social networks

Wed, 10 Oct 2007 00:00:45 +0100

One thought keeps spinning round my head and has been for a while now. There are too many social networks for global participation to be practical. The core problem is that each site has their own list of your friends. This list is usually referred to as the social map and for the idea of social networking to really become a permanent part of the Web this aspect needs to be extracted and standardised.

Amazon S3 SLA

Tue, 09 Oct 2007 00:00:34 +0100

Amazon have announced an SLA for their S3 service which is, you know, good news. But like every other company on the planet they place responsibility for monitoring whether they meet it on the customer.

By definition an SLA is a company committing to a level of service. If they then expect you to monitor their availability they are essentially saying they’ll only get punished for breaching it if you notice that they’ve breached it, and even then only if you “apply” for compensation. I’d be interested to know what percentage of people monitor their interaction with S3 to the level required to catch breaches, and how many will be adding it based on the arrival of the SLA.