Tranquil PDS has features we prefer to bluesky's, such as OIDC on
accounts. Let's switch over!

BREAKING-CHANGE: You are required to manually migrate accounts to the new PDS. Not doing this *will* cause data loss.

We bought https://cakeme.nu to host a nicer public URL for menu on.
Let's wire it in!

Emden no longer exists. I'm moving and have stripped the machine for
parts. Let's yeet its config too.

I don't actually need Orca most of the time. When I do, it's important
to have it easily available but at other times I have not found a way to
reliably stop it changing keybinds except to stop the service. It would
be cleaner to just start with the service stopped by default!

For a while we've had the option to use menu as a search engine where
we would send your search to Kagi if it was not a shortlink. This wasn't
great for everyone though because:
- It required you to pay for Kagi rather than allowing different search
engines
- It wasn't possible to add search engines except through the manual
process, which wasn't discoverable
- Some browsers didn't let you add search engines at all, making this
unusable there

This fixes those issues...

celestial_starfruit is a friend of ours and has asked to join the
tailscale network. By all means, let's give her the standard perms!

Previously we were doctoring the regex in an interesting way that
wouldn't have worked with | (regex or). Since as ^^ still matches the
start of the string, we don't need to strip it out. Finally, to make
sure that regex or can't scupper things, we need to wrap everything in a
non-capturing group...

With regex, we're not linking to the start/end shortlinks as they are
not necessarily valid links. We missed changing these to codeblocks on
the deletion page, so let's do that now...

Previously we were escaping shortlinks before resolving them (and
in-fact doing that twice!). That's wrong, we should instead be escaping
the parameter for our default links but not escaping the resolved
shortlinks (as for direct they are replaced entirely with created
shortlinks and for regex the character set can be very restricted for
matches).

Escaping as we were prevented links like `a/b` working

Since before we started menu, we've wanted regex support. This will let
us have shortcuts like go/gh/foo/bar go to https://github.com/foo/bar,
say

I've written this in a way where it could be extended, for
example I want to have shortcuts like go/M65.15+83 go to
https://wiki.freshly.space/wiki/M65.15%2B83_Serenity, say, which isn't
generically possible without querying the MediaWiki API. That means I
didn't change the direct table to have a field "type" or something -
since as further schemes would want to use a completely different data
format

I'm about to add regex support to menu, but before I do it might be nice
to tidy things out a bit. Doing that will allow me to make something
that is a bit more obvious how it extends the existing code

We were previously vulnerable to cross-site request forgery: someone
giving us a link that ran an action from somewhere else. To fix this, we
can tie a token which is sent along with all our actions to a session.
That way, an attacker won't know the correct token to run an action on
behalf of a user

This is mostly a trivial update, however copyparty's module has changed
to not automatically convert numbers to strings anymore...

I've got some old fava stuff but I want to work in a new file. We can
allow this by importing the new file from our config in the same way as
our default file...

By default mediawiki has restrictive file upload requirements. In
particular they have to be very small and in a tiny set of image types.

We trust the people on our wiki. We should just let them upload many
more files...

As a PDS, we make sure our users are over the age of majority. It's
silly for them to have to also give their ID to KWS to verify their
age again. We can make the endpoint return The Right Thing to skip out
on this

We were getting an evaluation error in one of our systems, and it wasn't
obvious which it was coming from. Adding error context didn't seem
to show up - it was an assertion so that may have been the cause - so
instead some printf debugging was in order...

...happily, it worked great!

nmtui-go is a nicer tui for networkmanager than nmtui. In particular,
it can do things like refresh the network list - a feature that nmtui is
missing (requiring manual use of nmcli)

It also, imho, looks better

bluetui is a tui for bluetooth - and seems less spammy and easier to
use than bluetoothctl directly (which, say, doesn't let you connect with
device aliases...)

Installing these will let us much more easily manage connected devices

The ssh config was getting quite unwieldy with ordering/etc. It's nicer
to generate exactly what we want for each match block with nix...

Previously we effectively had some projects smooshed together. This
normally worked fine but for any repeated attributes (e.g. default) both
copies would break.

Instead, we now have a new naming scheme:

Projects are given a "name" attribute in their config

# foo/project.nix:
{
config.name = "foo";
}

Any packages, shells, systems or homes defined in that project start
with that name followed by a dash

# foo/packages.nix:
{
config.packages.foo-package = {
...
};
config.packages.foo-package2 = {
...
};
}

# bar/packages.nix
{
config.packages.bar-package3 = {
...
};
}

Because of the naming convention, you'll still be able to refer to the
package even if another one is named the same

# baz/packages.nix
{
config.packages.baz-package2 = {
...
};
}

For the default package, the project name alone should be used for the
attribute

# foo/packages.nix:
{
config.packages.foo = {
...
};
}

To refer to a package elsewhere in the project, you must use the fully
qualified name

# foo/packageReference.nix:
{ config, ... }: {
config.something = [
config.packages.foo-package
config.packages.baz-package2
config.packages.foo
config.packages.package # fails - "package" does not exist
config.packages.default # fails - "default" does not exist
];
}

When using patisserie on the command line or from another project,
however, there are aliases for your convenience...

patisserie$ nilla build foo-package # works
patisserie$ nilla build package # also works

...but only if the package is unique

patisserie$ nilla build package2 # fails because there ore two packages called package2 (foo-package2 and baz-package2)
patisserie$ nilla build foo-package2 # still works
pasisserie$ nilla build baz-package2 # also still works

When using Josh to clone down part of the monorepo, only the current
project will be aliased, even if other pieces are included as
dependencies...

foo$ ls dependencies/
bar baz
foo$ nilla build foo-package # works
foo$ nilla build package # works
foo$ nilla build package2 # works - referring to foo-package2
foo$ nilla build bar-package2 # works - you can still use the full name of a package
foo$ nilla build package3 # fails - even though bar-package3 doesn't conflict, it isn't aliased in the foo project

...you may also use the default attribute to refer to the package with
the name of the cloned project...

foo$ nilla build foo # works
foo$ nilla build default # works
foo$ nilla build # works - since as nilla by default uses "default" if you don't specify an attribute

Previously we were not properly encoding paths given to our default
redirects. This broke some characters in search, and possibly would've
allowed someone to do something nasty with a crafted golink

We previously expanded templating to catch a lot more things.
Unfortunately, it meant that scripts with any codeblocks inside would
blow up. We only really need to template the lowercase alphabet and a
separator character (I've chosen an underscore)

This makes it far less likely that legitimate text will be removed

The service comes up before postgres is actually ready to receive
connections, which means there is a race condition on startup. We
previously added some retry logic to workaround this - but this should
be a better solution...

Sometimes bluetooth devices don't like it when you've lost past state
(e.g. device keys, etc.)

Hopefully persisting this can make bluetooth connections more reliable

I need to use a screen reader for some testing that I'm doing - orca
seems to be the screen reader of choice for Linux, so let's get it!

The same startup order issues as we've seen with the ssh agent happen
with orca. The solution is much the same. Additionally, the screen
reader volume is too loud by default - saving wireplumber should allow
us to persist that

I've experienced issues with GPU page faults which are supposedly fixed
in later kernels (nixos stable currently runs 6.12). ROCm can also cause
issues so I've removed ollama to turn it off.

Various things are based on this including:
- Random page suggestions
- Visual editor availability
- Statistics
- etc.

Public should be a content namespace - let's make it so!

The main page should list all of our links, as well as allowing us to
edit or delete them. I've also rewritten the templating system here to
work off a regex, which is a lot more comfortable and also means that
templates which aren't used can avoid being evaluated (at the cost of
making a template that is used multiple times be evaluated multiple
times - perhaps we should be memoizing here?)

During development, I:
- used go/ rather than a host for the copied URL
- used navigator.clipboard, which can't be used outside of secure
contexts, and didn't clean up when I changed that

I've made a few pages to create and delete shortcuts, as well as handle
all of the error and confirmation cases that come out of that.

The templating is rather nasty - I believe it's *safe* but I'm not
certain that it's completely *correct* (i.e. that there are no cases
which mangle a value somewhere). Additionally, I'm unhappy with the
general string rewriting garbage this leads to... there's nothing to
stop, say, double-templating/etc. Probably we need to at minimum do a
regex replace with a function to fetch the replacements properly, but
I think we may be reaching the point where switching to something other
than plain HTML is worth it...

We use the execCommand method for copying rather than
navigator.clipboard because one intention of this is to be accessible at
http://go/ - which isn't a secure context. If that's the case, we can't
copy with navigator.clipboard, but execCommand("copy") will still work.
Yay for web APIs!

Finally, we need UI for listing out shortcuts. That should probably
be next, over even implementing regex shortcuts (despite I really want
to...)

HyperNeutrino has expressed interest in using fava. Therefore, let's add
a file for them.

Since a while back this plugin has been deprecated. We should remove it
to avoid the error...

Coded wanted this, and I'm fine with this... internal and interwiki
links still won't do this (which is good)

Previously our Johnny Decimal templates wouldn't work with pages that
started with Public:. Setting that up as a namespace will make it work
again with no further modification. It'll also have the benefit of
easily listing them and changing the UI around moving pages to be public

Previously when a link was put into menu it was impossible to overwrite
it without editing the database. Instead, we can change our INSERT to
an UPSERT to allow that. This lets me fix typos (such as y/bsky missing
the /profile/ path)

Scary transclusion, so called because it's scarily inefficient and
might cause frightful differences between pages on different wikis due
to caching, is Probably Not That Bad and Might Actually Be Quite Useful
For Transcluding Stuff From Freshly Wiki Onto Starry Sky Wiki.

It's not that useful to have it enabled the other way around, since as
it'll cause permission errors anyway, but it also is unlikely to really
cause problems in a vacuum...

If we edit the wiki but don't save, we'll lose our edits. We can enable
autosaving to let users use a setting to ... let that not happen! So
let's let that not happen!

It seems like this is causing issues with category updating on new
Johnny Decimal pages, so we should disable it - I've left the comment
to stop us noticing it's disabled and mistakenly re-enabling it in the
future

Our servers are tagged, so aren't considered to be any specific user.
We can give them a username to allow them to access pages. This still
won't allow servers access to the private wiki as there users aren't
auto-created, so "Server" won't be valid...

This option specifies what other wikis call this one - in our case
it's FBC (for the wiki on teal) and S (for the wiki on umber). We don't
really need this for our use, but we *do* need to be able to refer to
the other wiki for interwiki links...

We may want to make this an option later, but it certainly isn't correct
to have it the same on every wiki...

We previously had the same icon and favicon for all wikis... it would
be nice to configure this on a per-wiki basis. Therefore, let's make it
into an ingredient option!

I want to have a private copy of the wiki on umber and a public copy on
teal. It would be good to share configs between them, so we should use
an ingredient for this

As a regression from some of the assertion refactoring...

When you have multiple homes, we were previously comparing the entire
config of each of them to all of the rest. This was a Bad Thing as it
caused us to evaluate the whole of each home, including some attributes
that normally aren't evaluated and broke evaluation completely.

This was relevant for Maya but not for the rest of us - I'm not sure how
CI missed it...

There are some libraries that were updated in nixpkgs 25.11 but which
Collabora gtimelog doesn't support newer versions of. Building gtimelog
from 25.11 will get you an error that looks like this

Traceback (most recent call last):
File "/nix/store/akvr4z3wjiw2gizz6jnbb3f29wa29h8a-python3.13-pygobject-3.54.5/lib/python3.13/site-packages/gi/importer.py", line 137, in create_module
introspection_module = get_introspection_module(namespace)
File "/nix/store/akvr4z3wjiw2gizz6jnbb3f29wa29h8a-python3.13-pygobject-3.54.5/lib/python3.13/site-packages/gi/module.py", line 244, in get_introspection_module
module = IntrospectionModule(namespace, version)
File "/nix/store/akvr4z3wjiw2gizz6jnbb3f29wa29h8a-python3.13-pygobject-3.54.5/lib/python3.13/site-packages/gi/module.py", line 104, in __init__
repository.require(namespace, version)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
gi.RepositoryError: Typelib file for namespace 'cairo', version '1.0' not found

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/nix/store/bmy9cw4hbnrq00cc29sza5083yamw74s-gtimelog-0.12.0/bin/.gtimelog-wrapped", line 6, in <module>
from gtimelog.main import main
File "/nix/store/bmy9cw4hbnrq00cc29sza5083yamw74s-gtimelog-0.12.0/lib/python3.13/site-packages/gtimelog/main.py", line 72, in <module>
from gi.repository import Gdk, Gio, GLib, GObject, Gtk, Pango, Soup # noqa: E402
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/nix/store/akvr4z3wjiw2gizz6jnbb3f29wa29h8a-python3.13-pygobject-3.54.5/lib/python3.13/site-packages/gi/importer.py", line 139, in create_module
raise ImportError(e) from e
ImportError: Typelib file for namespace 'cairo', version '1.0' not found

From using nix-locate we can see that cairo-1.0.typelib is in gobject
introspection 1.84.0...

$ nix-locate cairo-1.0.typelib
gobject-introspection.out 0 s /nix/store/i6asc7b7ws92inj5bqvmdbcs3n77dknz-gobject-introspection-wrapped-1.84.0/lib/girepository-1.0/cairo-1.0.typelib
gobject-introspection-unwrapped.out 14,740 r /nix/store/dpwppqwbm76q7h1gk8mv0mg4ylf4b551-gobject-introspection-1.84.0/lib/girepository-1.0/cairo-1.0.typelib

...but search.nixos.org tells us that gobject-introspection is at 1.86.0

Downgrading to 25.05 fixes this issue...

I woke up this morning to a dead menu instance and the following
backtrace:

Jan 05 04:46:24 teal menu-start[1351]: thread 'main' (1351) panicked at src/main.rs:173:6:
Jan 05 04:46:24 teal menu-start[1351]: Failed to connect to database defined in $DATABASE_URL: Io(Os { code: 2, kind: NotFound, message: "No such file or directory" })
Jan 05 04:46:24 teal menu-start[1351]: note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

It seems like this is because, when teal restarted, postgresql hadn't
created a socket by the time menu connected. Restarting menu after the
fact let it run Just Fine. Adding some retries should stop this problem
from coming up...

...a proper solution is probably to fix whatever decides that postgresql
is ready in packetmix, but this is much easier to locate and implement

We're seeing some issues with jobs choking up when we have a
long-waiting maintenance service

Instead, we think it might be better to have this run every 30 seconds
for at most 30 seconds, thus causing stuck jobs not to cause trouble...

Since https://github.com/NixOS/nixpkgs/commit/2d0a48912550cdc39a64e71d09d2c838973871ad,
ACME certificates have been issued using a different set of services.
The missinghost.invalid configuration here ended up breaking the nginx
startup by making it so no selfsigned certificate was ever generated,
getting nginx to die on a missing certificate.

Additonally, also as a result of this ACME rework, Stalwart was waiting
on a bunch of nonexistent things and now no longer is

CategoryWatch looks like it's going to work when you load it, but
at runtime there is an error which prevents category reindexes. To
workaround this, we can remove the extension entirely...

It's not good if our links are case sensitive as different
capitalizations aren't that distinct really. It's still important to
make sure we don't mess up capitalization in the UI or when forwarding
to search engines/etc., though

BREAKING-CHANGE: If you're using links that were made with capitals, those links will stop working

By default, there's no good mobile skin for Mediawiki. You can load
"minerva", which appears to come bundled but not by-default-enabled, but
there's no auto-switching to it when on mobile devices.

The MobileFrontend plugin (as used on Wikipedia) fixes this by using
minerva on mobile devices and a different theme on desktop.

There are some repositories where there's no "main" or "master" branch.
In this case, it would be nice to use "truck" as the main branch