Chameth.com - posts like debugging-beyond-the-debugger, docker-automatic-nginx-proxy, g15-ram-upgrade, home-automation-without-megacorps, sense-api, why-you-should-be-using-https

An interesting Tailscale + Docker gotcha

2026-01-29T00:00:00Z

As I’ve written about before, I use Tailscale for a lot of things. I thought I had it set up in a reasonably secure manner, but I recently noticed a problem.

I use Tailscale’s ACLs to limit what each node can access, based on the tags I apply to it. So an app node can’t access anything via Tailscale, while an integration or server node can access things tagged with either app or integration. This is expressed pretty simply in the Tailscale ACL JSON:

{
	"tagOwners": {
		// Servers that can be SSH'd into
		"tag:server": [],
		// Applications that are exposed on tailscale but never connect out
		"tag:app": [],
		// Things which talk to other services over tailscale (connecting to apps etc)
		"tag:integration": [],
	},
	"grants": [
		{
			// Users can access everything
			"src": ["autogroup:member"],
			"dst": ["*"],
			"ip":  ["*"],
		},
		{
			// Servers and integrations can access integrations and apps
			"src": ["tag:server", "tag:integration"],
			"dst": ["tag:integration", "tag:app"],
			"ip":  ["*"],
		},
	],
}

Over the past week I’ve been setting up a private Forgejo instance behind Tailscale, complete with an actions runner that runs things using a docker-in-docker container. I didn’t want the runner knowing anything about Tailscale, so I had it configured to speak to Forgejo direct over HTTP (forgejo:3000) instead of using full Tailscale HTTPS URL that I use when accessing it (http://git.example-net.ts.net/)¹.

Everything was going fine, until I forgot to do that translation… and it worked. My Forgejo action runners could access anything on my tailnet. I run several things on Tailscale that just have authentication turned off, on the basis that only authorised devices can access them. Things like the admin interface for this website. I definitely didn’t intend for any workflow I run on my git server to have access to edit my website!

This wasn’t just limited to Forgejo, either. Any docker container I was running could access the tailnet. In hindsight it’s fairly obvious why: the host is running Tailscale, connected as a node tagged with my server tag. That creates a tailscale0 interface, and automagically sets up iptables rules to route Tailscale traffic over the interface. Docker also automagically sets up iptables rules to bridge traffic, and apparently these two sets of rules interact in such a way that traffic from Docker containers is allowed to route via the tailscale0 interface.

I say it’s fairly obvious in hindsight — there’s no reason why Docker would special case any particular host interface after all — but it still feels pretty surprising. Because both bits of software inject their own iptables rules, I never really had a good mental model for how they interact. The host Tailscale node was a completely separate building block to Docker. It would be a pain to use either of them if they didn’t do these rules, but it’s also one of the reasons I don’t really like “magical” things².

There are lots of ways to fix this, but none of them feel particularly great. You can configure both Tailscale and Docker to not automatically fiddle with iptables and handle the rules yourself, but I really hate dealing with iptables³. As a stopgap I did hold my nose and add some iptables rules to drop traffic to the tailscale0 interface if it originated from the IP ranges that Docker was configured to use:

iptables -I DOCKER-USER -s 192.168.0.0/16 -o tailscale0 -j DROP
iptables -I DOCKER-USER -s 172.17.0.0/12 -o tailscale0 -j DROP

The DOCKER-USER chain is a nice little escape hatch; it comes before the main auto-generated DOCKER chain, and Docker leaves the rules in it alone.

So I added these rules, and felt pretty good about myself, and then… everything started breaking in weird ways. After some debugging I realised the problem was DNS⁴. The server’s DNS resolver is 100.100.100.100, a special Tailscale address. This is so that it can resolve tailnet hostnames via MagicDNS (and so I don’t have to configure my custom DNS servers manually on each device; Tailscale does it for me). My new iptables rules inadvertently dropped all the DNS packets coming from docker containers. D’oh.

Obviously the solution here is to double down and add MORE iptables rules:

iptables -I DOCKER-USER -s 192.168.0.0/16 -d 100.100.100.100 -o tailscale0 -j ACCEPT
iptables -I DOCKER-USER -s 172.17.0.0/12 -d 100.100.100.100 -o tailscale0 -j ACCEPT

This got DNS working again, but it all feels a bit gross. Not least because to actually make these persist you need to use iptables-save, and then you also get all the rules that both Docker and Tailscale have inserted. I came across a script to filter out the Docker ones, but… yuck⁵.

I realised a cleaner idea might just be to lock down what server tagged nodes could access within Tailscale itself. That way I can avoid touching iptables at all. It’s handy to be able to curl services from the host when debugging, but it’s not really necessary. So I removed that access, and… stuff broke again. I’m using my Forgejo instance as a registry for some of the docker images I run, so the docker daemon needs to be able to reach it. I ended up making a new tag for infrastructure, which can be accessed from server devices. This does still allow all the docker containers to reach Forgejo, but I already have it set up with appropriate access controls and public/private repository splits. Forgejo is a service designed to run publicly, so this seems a reasonable trade-off for convenience. I used the tests feature of Tailscale’s ACL config to make sure I’d got the rules right:

{
	"tests": [
		{
			// Servers can only access infrastructure
			"src":   "tag:server",
			"proto": "tcp",
			"allow": [
				"tag:infrastructure:8080",
			],
			"deny": [
				"100.84.16.43:8080",
				"me@example.com:8080",
				"tag:server:8080",
				"tag:app:8080",
				"tag:integration:8080",
			],
		},
	],
}

The whole situation still feels a bit messy. If I ever get around to switching to nftables I might loop back and manually craft some rules for routing traffic, instead of leaving Tailscale and Docker to do their own thing.

I discovered later on that logging into the container registry at forgejo:3000 actually issued a redirect to https://git.example-net.ts.net/ so this was all basically for naught… ↩︎
I didn’t use Tailscale’s MagicDNS for a long time just because the word “magic” put me off. Only when I eventually got around to learning how it worked, and seeing that it wasn’t really that magical under the hood, did I change my mind. ↩︎
nftables seems far better in lots of ways, but I can’t really be bothered migrating. Maybe next time I reimage the server for whatever reason… ↩︎
It’s always DNS… ↩︎
Again, nftables would almost certainly help here. It actually has (gasp) configuration files. But again, I really didn’t want to spend the time migrating. ↩︎

10 Weeks with an Apple Watch 10

2025-09-09T00:00:00Z

My watch. Yes, I am available for wrist modelling opportunities.

Around ten weeks ago¹ I picked up an Apple Watch 10, and have been wearing it almost constantly since. It’s not my first Apple Watch — I had a Series 5 for a bit back in 2020 — but it’s the first time I’ve actually stuck with it. Ten weeks seems like an apt time to reflect on it.

Firstly, why did I even bother? Well, for a couple of years I’d been wearing a Xiaomi Smart Band 7, mainly to monitor my sleep stats and set alarms that won’t wake up everyone else nearby. Its battery life was fantastic — with notifications and other things turned off, I got about a month of use between charges — but actually using it felt like trying to order food via the medium of interpretive dance.

My biggest gripe was the screen lock. If I didn’t have the screen locked then I’d periodically trigger it during the night when I moved around and it came in contact with my chest or leg. With the lock enabled you had to deliberately swipe up from bottom to top to enable interaction, but it didn’t work reliably. When I wanted to adjust an alarm, I’d be stood swiping repeatedly trying to get it to respond. When you finally get it unlocked, the whole interface is just fiddly.

The other issue was the data quality. There were some nights when I’d been woken up, sometimes even getting up and moving around, and it just didn’t show it in the data. If it can’t even get whether I’m asleep right, can I trust anything else it says?

I spent a while researching the best devices for sleep tracking. The Oura ring came highly recommended, but it was expensive and required a subscription to do anything useful. No thanks! The Apple Watch was consistently rated pretty well, and I reasoned I could pick up a refurbished older unit. I’ve been using an iPhone as my daily driver for a while, so it’d fit right into my begrudged walled garden.

The Series 10 has a significant advantage, though: it charges much quicker than all the previous generations. On a 30-minute charge, the Series 10 can go from 0 to 60%; the 9 can only make it to 40%, and my old 5 a measly 30%. Shorter charge times means I’m far less likely to leave it on charge and wander off without it. In some ways the daily charging is more convenient than monthly: the wireless charger sits on my desk, and I plop the watch on it for a little while in the evening; I don’t need to dig out the weird pogo-pin connector that has vanished sometime in the last four weeks, then carefully arrange it so it stays attached.

How a watch maybe saved my life

One of the big features of the Apple Watch, like many other wearable devices, is health and fitness tracking. I didn’t think much about this, beyond the sleep data I wanted, at first. I’ve never had a particularly good relationship with exercise², but I do like some good statistics. I started going for walks more often to get more data and see the graphs of VO2 max and HR recovery gradually inch up. That wasn’t the most profound effect on my health, though…

The recent versions of the Apple Watch have a feature that monitors for sleep apnea, a disorder where you don’t breathe properly during your sleep. I knew I wasn’t sleeping great — that’s why I was paying attention to sleep tracking data — but was still a bit surprised to get a notification from Apple Health after wearing the watch for 30 days. It gives you a graph to print and take to your doctor. So I diligently booked an appointment and a few weeks later went to see my GP.

The appointment went about as you’d expect: talking about referral to a sleep centre for a study, and so on. Towards the end, the doctor took my blood pressure (sleep apnea can be caused by, and can cause high blood pressure, in a lovely little vicious cycle). I don’t think either of us expected anything; it was just one of those standard checks for a related problem. After taking the reading, the doctor looked at me and said, “I can’t let you leave with a BP like this”. Yikes!

Blood pressure readings are split into stages: normal is under 120 mmHg³ over 80 mmHg⁴, stage 1 is up to 140/90, stage 2 is up to 180/120, and above is simply called “crisis”. Guess where I was? Also, fun fact: depending on how exactly you count and attribute things, hypertension comes out as the single largest cause of death in humans. It doesn’t kill you outright, but contributes to strokes, coronary artery disease, heart failure, and lots of other lovely things you don’t want on your CV.

After doing a few more readings, it settled down to just under the “crisis” stage and into the “holy crap, start treatment immediately” stage instead. I won’t labour on much more about this, but things are definitely moving in the right direction now⁵.

While the Apple Watch didn’t literally save my life, it triggered the chain of events that led to this diagnosis and treatment. Who knows what would have happened had it remained undetected? Probably nothing good. Also, go check your blood pressure! It’s simple to do and simple to treat if there is an issue, but so many people are walking around with hypertension and not even realising.

Building gates in the walled garden

Even though the watch is arguably a life-saver, not everything is rosy. It’s an Apple product, so you’re firmly locked in a walled garden, jealously guarded by people wearing black turtlenecks. Fortunately, there are a few ways to make it less painful.

All the health and fitness data is stored in Apple Health. You can export data as a big messy file, but it’s a very manual process to do so and the data format is gnarly. Luckily, there’s an app for that! Health Auto Export can, well, automatically export health data. It does what it says on the tin. It can send the data to Home Assistant, over MQTT, or dump it in some cloud file services, but I just have it post it all to a REST endpoint on a service I wrote. Then I dump it all in a database and can do whatever I want with it!⁶

Another tool that’s more useful on the watch itself is Apple Shortcuts. This is their no-code “if-this-then-that”-type thing. You can make automations or shortcuts that run a number of tasks. I have a whole slew of them I access via a complication⁷ on my watch face: one which prompts for input and adds an item to my to-do list (swiping to write letters is surprisingly not horrible), one which lets me select from a bunch of pre-written ones (“charge kindle”, “take laundry out in 1 hour”, type things), one to log my weight into Apple Health, one which can open and close the blinds in my room, and so on. It’s a surprisingly robust and easy-to-use system and offers just enough freedom that I’m not constantly grating on the edge of the walled garden.

Shortcuts being able to initiate arbitrary web requests is the real killer feature for me. Anything I can’t do on the watch itself, I can just farm off to a web server and connect it up with a shortcut. No need to learn Swift or pay Apple for the privilege of being a developer! For a lot of things, like controlling the blinds or adding to-do items, I already had a HTTP endpoint available and exposed over Tailscale⁸. Adding it to the watch was just a case of entering the right things in the Shortcuts app.

Daily nitty-gritty

There are lots of other little bits and pieces that come up when using the watch daily. I don’t think I can bundle them up into a pleasing narrative arc, so instead please enjoy some disjointed paragraphs of observations.

The Apple Watch has a lot of nagging abilities. It can notify you about your fitness “rings”, prompt you to stand up every hour, count how many seconds you wash your hands for, etc. I think I’d dislike these just on general principle, but the way it does them is so condescending it’s painful. I think there’s probably a cultural divide issue here, but there is no way in British English to say “Great job! You washed your hands for 30 seconds!” without it sounding like you’re being amazingly sarcastic or like you’re talking to a young child. So I turned all of that nonsense off. It’s meant to be a tool not a wannabe life coach.

You can access Maps directly on the watch and even do navigation. It works really well. The navigation mode has some nice haptic feedback: it does a short pulse as you’re approaching a turn, and then a long pulse at the actual turn. I like it a lot more than having to dig out my phone or have the directions read out. You get one pulse, glance down and see where you need to go, then it reminds you a little later when it’s time to do it. It’s a delightful user experience.

Watchfaces aren’t quite so delightful. There’s a limited number of built-in ones, and some are “exclusive” to the Ultra Series, and you can’t use them on a peasant watch like a Series 10. Annoyingly, there’s not one that does exactly what I want: a plain analogue clock with an inset date and four complication slots around the outside. Instead, I have to use one of the slots to show the date. There are third-party watchfaces, but they have issues. Firstly, there’s no actual API for making watchfaces⁹, so what they do is bodge it horribly by using a photo background that has fake widgets on it. On top of that they’re almost universally subscription-based. Again, no thanks¹⁰.

The issue I had with the Smart Band triggering when I was sleeping is solved trivially on an Apple Watch, by virtue of it having a physical button in the crown. When you put it in sleep mode, you have to double-press the crown to unlock it before it’ll do anything else. It hasn’t misfired once while I’ve been using it.

Sleep data; spot when I swapped devices!

Finally, a special mention for the gesture controls. If you raise the watch it reliably wakes up (switching from a low refresh rate, dimmed screen to an active, brighter one); you can then double-tap your index finger and thumb together and it will scroll down or page through whatever you’re looking at. The killer feature for this is navigating recipes: you can advance to the next step in a recipe while your hands are covered in flour. It’s also handy for reading notifications: when one pops up, you can double-tap to expand it, then, when it gets to the bottom, it’ll outline the default button (often “Dismiss”) and you can double-tap again to click it.

The verdict

I normally don’t like writing an actual labelled conclusion, but it feels like one is needed here! Overall, I’m happy with the watch. The daily charging doesn’t bother me, the data gathered seems reliable, the health monitoring has obviously paid dividends already, and the walled garden isn’t too chafing. It’s a straight upgrade over my old Smart Band, and I think it was worth the cost.

The original reason for getting the watch was better sleep tracking, though, so how well did it do? I’m much happier with the data: it seems to more accurately represent when I was awake in the night, and overall the sleep phases just seem to make more sense. You can see in the graph that the old data switched frequently between phases, and they didn’t quite line up for some reason; towards the right when the Apple Watch is supplying the data instead there’s a much more consistent pattern of sleep phases that repeat over the course of the night.

I’m not going to advocate that you go out and buy one, though. I know my requirements and usage aren’t typical, and I’ve also not got experience with any recent Android Wear alternatives or the new version of the Pebble watch that’s coming soon. You should definitely get your blood pressure checked, though!

OK, it’s more like 14 now, it’s taken a while for this post to make its way from my brain into text. ↩︎
Exercise for the sake of exercising just seems so overwhelmingly tedious and boring to me. And other types of exercise generally require social interaction, coordinating with people, and so on. ↩︎
Who decided to use “millimetres of mercury displaced” as a unit? You can’t just put random chemical symbols in units! That’s not how this works! ↩︎
Blood pressure readings have two parts: systolic (the pressure when the heart is beating) and diastolic (the pressure between those beats). They’re generally presented with the systolic reading on top and the diastolic reading below, and read as “X over Y”. Now you know what some of the random numbers they shout in medical shows mean! Yay learning! ↩︎
No thanks to how much salt is in everything. I’m pretty sure I’ve had at least twice the recommended daily amount of salt in a single serving before. Don’t even get me started on the things that are “low salt” but are still full of sodium from other sources. I don’t have a problem with ionic compounds, I have a problem with sodium! ↩︎
This mainly looks like drawing graphs that are slightly different to the graphs in the Apple Health graphs, for reasons I’m not sure I can explain. Making graphs is fun, OK? ↩︎
Complications are basically just home screen widgets, but with a fancy name because they’re on a watch. ↩︎
Tailscale actually causes me some problems here: everything works fine when the watch is connected to my phone, as the phone handles the Tailscale part, but if I’m not carrying my phone the watch will try to connect over WiFi directly and doesn’t understand anything about Tailscale. It happens infrequently enough that I’ll just live with it; it’s not much worse than having no signal on a phone. ↩︎
Yay walled gardens… ↩︎
I don’t object to subscribing to things in general, but it has to be something that’s worth the ongoing cost and offers something in return for the subscription. A watchface doesn’t need enough ongoing maintenance to justify subscribing to it, it’s just a cash grab. ↩︎

Home Automation Without the Megacorps

2025-05-21T00:00:00Z

I first experimented with home automation in 2016, by picking up a Samsung “SmartThings” hub. It was terrible. The UI to configure things was slow and clunky, firmware updates were applied whether you wanted them or not, and everything stopped working if their cloud services stopped. You were also locked into whatever integrations they deigned to support, of course. After that broke for the umpteenth time I scaled back and for years the closest I got to home automation was a couple of Hue bulbs.

Recently I’ve been building it out again, though. This time using off-the-shelf components that interop using Zigbee, open-source software, and some code I wrote myself. It’s great; it runs entirely locally and has had basically zero downtime. The Zigbee ecosystem lets me integrate all sorts of things without having to spend lots of money on “smart” alternatives. I think I’ve spent less on this incarnation than I did on the original SmartThings hub all those years ago (even without adjusting for inflation!).

My current setup

I run everything on a Raspberry Pi 4, with a Sonoff USB Zigbee adapter based on the CC2652P chipset¹. Interfacing with the Zigbee stack is handled by zigbee2mqtt (z2m for short), an open-source project that basically bridges your devices to an MQTT broker². When a device reports some data, it will send a new message over MQTT; when you want to make a device do something you just post a message back. It’s incredibly lightweight, but supports a huge array of devices out of the box. And as it’s just using MQTT, it’s trivial to integrate with other software or build on top of.

I know a lot of people building out this kind of home automation use Home Assistant, but I don’t get on with it terribly well. It felt incredibly sluggish, and the entire project is just a bit… much. I want a binary or package or docker image I can just run, not an entire operating system. That’s not how computers are meant to work! In contrast, z2m is simple to set up, super light weight and responsive.

Anyway. z2m exposes Zigbee devices over MQTT, so I wrote some code in Go to connect to the MQTT broker, and listen to the messages. It’s grown a bit beyond this now, and I’m skipping some boring bits like error handling and JSON parsing, but at first I had something like:

for {
    message, topic, err := c.ReadSlices()
    
    if string(topic) == "zigbee2mqtt/desk-button" {
        if strings.Contains(message, "single") {
            c.Publish(nil, []byte("{\"state\": \"TOGGLE\"}"), "zigbee2mqtt/room-lights/set")
        }
    }
}

I think I actually made this harder to read by trying to simplify it here, but hopefully you can follow that it was relatively straight forward to listen for a particular action to happen (in this case me “single”-pressing on the device called “desk-button”) and then make another device do something in response (toggling the state of the “room-lights” device).

So what actually are these devices? At present in z2m I have the following:

Some generic buttons
An air quality sensor (USB powered), and a separate temperature sensor (battery powered)
A light switch
Some 240V relay modules, that I use to turn non-smart devices on and off
Some USB relay modules, for the same purpose
Some “smart” plugs that I mostly use to monitor power usage
A motorised blind roller

I think all of these are either Tuya or Moes branded, and were all sourced from AliExpress. You can get the same things from Amazon or elsewhere, but they tend to be 3-4x more expensive for the same product.

One of the cool things about Zigbee devices is that the powered ones work together to create a mesh network, so you don’t have to worry about network repeaters or signal strength like you do with Wi-Fi networks. z2m even makes a map showing the connections:

The network map produced by z2m. You can see how all the powered devices form a mesh that the lower power ones can connect to.

Some interesting automations

A Zigbee relay spliced into the power cable for the fan

So what do I actually do with all of this? Some of it is just what I’ll call “laziness automation”: I want to be able to turn on the lights without getting up and walking to the light switch. So there’s a Zigbee button on my desk that does it. Then there are some less manual automations: my blinds are automatically closed at sunset³, for example. It feels a bit trivial, but it’s surprisingly nice just not to have to think about that at all.

Another nice quality of life automation is the light I have above my monitor. It’s USB powered, and I now have it going through a Zigbee USB relay that lets it be toggled on and off. Then I have a small agent running on my desktop that turns the light on when the computer is unlocked, and off when it locks or shuts down. I keep meaning to make a “film mode” that detects when I’m watching a film, and turning all the lights and blinds down, but I haven’t got around to it yet.

The most complex automation is probably for a window fan. It’s not smart in any way, so I cut the power cable and inserted a Zigbee relay. The whole thing is housed in a little project box to keep it secure. The relay basically acts as a switch: the live wire leading to the fan runs to the “normally open”⁴ contact, while the upstream power goes to “common”. When the relay is told to turn the fan on, the two get connected and the fan gets power. Oh, it’s also not actually a window fan, but I designed and 3D printed some adapters so that it sits right in the window.

So now we have a window fan that can be turned off and on automatically. But I don’t want to have to press a button to do that. I’m lazy, remember? Instead, I made it so that the Go code constantly monitors the temperature reported by the air quality sensor, and queries the free OpenWeatherMap API to get the rough temperature outside. It can then turn the fan on if the room is too hot, and outside is cool enough to make a difference (there’s no point in blowing hotter air in!).

A graph of room temperature, showing the effect of the fan being turned on and off

I don’t want it to do that all the time though. The room doesn’t need to be cooled if I’m not around. There are various Zigbee presence sensors you can get, but the cheaper ones seem to be of dubious quality. Instead, I wrote some code to guess whether I’m present. It uses the state of the monitor light as a proxy for “is the computer in use”, and then makes some guesses based on the last time the computer was used and the current time (if I turn the computer off at midnight it probably means I’m going to sleep; if I turn it off at 2pm it probably means I’m going out somewhere).

You can see in the graph that the fan has a decent impact on temperature. I coded it to cool the room to 19 degrees, but then not turn on again until it was above 20. This prevents it flip-flopping on and off constantly. You can clearly see the pattern in the graph, as it actively cools and then slowly the room warms back up. This arrangement is much better than being woken up at 5am because it’s painfully cold. Trust me.

Bonuses: metrics and 3D printer

One of the things my custom Go code does is collate all the various stats reported by the Zigbee devices, and inserts them into a VictoriaMetrics database. I originally hosted this on the Pi itself, and it performed fine, but I’ve since moved it onto a server so that I can use it for some other things as well.

I set up Grafana to point to VM, and can create dashboards showing power usage, what devices are turned on when, and a bunch of environmental conditions. This also makes it easy to spot how good the data coming from the devices are. For example, the air quality sensor reports a figure for the amount of Carbon Dioxide in the air, as well as the amount of Volatile Organic Compounds (VOCs). The graphs are basically identical, but on a different scale. It turns out this particular device has no actual way of detecting CO₂, so it just “calculates” it from the VOCs figure. Useful to know if you want to actually use that data.

Recently I came across a go library for interacting with Bambu Lab printers, so I’ve also hooked that into my automation. It exports metrics about the printer, so I now have a way of seeing what’s going on when I’m not physically present⁵. I even added a HTTP endpoint (exposed over Tailscale) that shows pictures from the built-in camera.

On the automation front, I’ve made it automatically turn off the printer’s light when it finishes a print, and also added push notifications via PushOver whenever the state changes. No longer will I be sat in another room blissfully unaware it ran out of filament seconds after I walked out the door!

Was it worth it?

These days you could probably just buy some kind of ‘smart home’ hub that works well enough, and do most of what I’ve done with a lot less effort and no coding. I’m still of the opinion that for something so essentially local, it should itself be managed entirely locally. I don’t trust companies like Google or Amazon not to kill their products, or change or remove an API I rely on.

Obviously the “Not Invented Here” approach of coding everything yourself doesn’t suit everyone, but as someone who enjoys coding and enjoys having things work just so it works very well for me.

It turns out the chipset is important. I initially used a similar Sonoff dongle that used a CC2531 chipset, and its performance wasn’t great. It often failed to pair with new devices, and dropped links to existing ones. The zigbee2mqtt docs do explicitly advise against the CC2531 chips for that reason. At the time they recommended CC2652Ps, so that’s what I went with. If you’re starting new I’d go with whatever their latest recommendation was. ↩︎
MQTT is basically a network protocol for publishing and subscribing to arbitrary messages. A broker is the thing that sits in the middle and routes the messages. I use Mosquitto but any will do. ↩︎
They originally also re-opened at sunrise but that was a terrible mistake. Who knew the sun rose so early?! ↩︎
“open” meaning “there’s a gap so it doesn’t work” not “open for business”. This confusion in terminology also extends to drawbridges. ↩︎
I use the printer in LAN mode, which means there’s no way to monitor it from a phone, even if you’re connected to the same network still. ↩︎

How I Get Things Done

2024-09-01T00:00:00Z

I always quite like reading about how other people do things. What software or hardware they use, or how they manage reminders, todo lists, and so on. I’ve never actually written about how I do any of that, though. So here it is!

Productivity

In the past I’ve fallen victim to the idea of there being One True Productivity System that would solve all my problems and make me amazing at getting things done. The title of this post is a nod to Getting Things Done, which I’ve read and tried to religiously follow in the past, but it’s just not for me. One thing that did actually stick from it, though, was the idea of “open loops”:

Anything that does not belong where it is, the way it is, is an “open loop,” which will be pulling on your attention if it’s not appropriately managed.

If I want to do something and it’s not recorded in a way I trust, it weighs on me a little. Those little weights all add up, and just make life uncomfortable. I deal with those in a few ways:

Inbox Zero-ish: if an e-mail needs me to do something, it sits in my inbox until it’s done. When it’s done, it gets archived.
Notes: random things I try to remember I put into my notes, so I can search for them later.
Budget: anything monetary I just adjust in my budget or create a category for.
Todo list: any other kind of task I want/need to do either now or at some point in the future goes into Todoist.

Todoist

In the past I’ve gone through a lot of different todo systems, once again hunting for one that will fix all my problems etc¹. In the end I always ended up coming back to Todoist, and have stuck with it for a decent period now.

In Todoist, I have everything split up into projects. Work projects are one colour and personal projects are another. Anything that needs more than a handful of individual tasks gets a project, which is archived when it’s done. Any one-off things that don’t neatly fall into projects go into “Random junk” project.

As I’m writing this, I have 116 items in 22 projects. A good deal of those are things that I might want to do at some point, not things that I actively need to worry about. If I want to get one of them done, I schedule it so it shows up in the “today” view. I have the Todoist desktop app open automatically when I login to my computer, and it gets positioned on the right hand side of my ultra-wide monitor, so I can see the “today” view and add/remove things immediately at any point.

I’m not precious about tasks becoming overdue, or unscheduling things I’d previously scheduled. Priorities change, ideas that sounded good a week ago might no longer sound good, and so on.

I do a few things to help me manage tasks and keep track of things:

I have a monthly recurring task to look through everything that’s not scheduled, just so I keep a rough idea of what’s there, and can update or get rid of it as needed.
I wrote todoistager and have it running on a server to automatically apply tags to tasks based on their rough age: weeks, months or years. This lets me identify things that are lingering and reconsider them².
I automate adding tasks for things that demand my attention, like incoming GitHub pull requests. The Todoist API is nice and straight forward, and hooking it up to things is trivial.

Other desktop software

For notes I use Logseq, and I just put whatever I need to write under today’s note and rely on search or tags to find it again when I need to. I note basically anything that I might like to use again in the future. One of my most common tags is #blub, a term I came across in the excellent article “In defense of blub studies”. Blub is random ultra-specific knowledge; it might not be eminently useful to know on its own, but over time it can pay dividends.

I’ve previously tried a bunch of note taking apps, and methodologies, but like with todo lists I end up just wanting something that just works and stays out of the way. Logseq stores notes in Markdown, and I have a cronjob to commit and push my changes to a private git repository.

Like Todoist, Logseq launches when I log into my computer, and sits in the same 500px-or-so region on the right of my monitor. This allows me to switch from Todoist to take or refer to notes when needed. To do this positioning, I use devilspie2. I also use this to position Discord and my IRC client side-by-side on a small portable monitor that sits underneath my ultrawide.

More mundane software: I use IntejjiJ IDEA for almost all development and complex text editing³. The only exception is Android development where Android Studio rules the roost. For lighter text editing, Sublime Text is my choice.

I spend a fair bit of the time at the command line. I use kitty as a terminal emulator, with the zsh shell and Oh My Zsh for some nice plugins and enhancements. One thing I couldn’t live without is autojump, which allows quickly jumping to any directory you’ve previously visited using a substring of the name.

Web browsing is all Firefox, with Bitwarden for password management and two pinned Fastmail tabs, one for personal e-mail and one for work. I don’t think there’s much else to note there.

Oh, I use Arch, by the way.

Infrastructure

This is the hodge-podge of things that support my computer usage but sit outside the actual computer. In no particular order…

All my DNS queries go through NextDNS using DNS-over-HTTPS. NextDNS lets you add custom responses, block certain things from resolving, and subscribe to pre-made anti-tracking or anti-advertising lists. It gives you far more control over everything than most other services I’ve looked at.

Every device I control runs Tailscale to enable remote access. I also use Tailscale’s SSH authentication feature for my servers, allowing quick and easy access from my phone where I don’t have or want normal SSH keys.

One exciting service that combines these two is golink. It was created by Tailscale, presumably based on the go service used extensively inside Google. I run a version on my tailnet, and have NextDNS configured to resolve go to the tailscale IP of the service. That lets me type “go/whatever” on any machine I set up with NextDNS and Tailscale, including mobile devices. I use go links for all sorts of things:

Shortcuts to tools I use commonly: go/board gets updated to my current client’s kanban board or similar tracker, whether it’s in Jira, GitHub, Asana or whatever; go/meet goes to Google Meet with the user parameter set so I’m logged in with my work account not my personal account.
In place of bookmarks: go/flex goes to the CSS-Tricks flexbox guide⁴, go/cad goes to the OnShape login page, go/hmrc goes to the HMRC online services page, and so on
A few dynamic things: go/github/chameth.com will go to the csmith/chameth.com project on GitHub; go/ref/pipico will go to the Pi Pico page on my electronics reference wiki.

For my servers I have a minimal Ansible setup that does some basic configuration and deploys SSH keys to the right places. Almost everything runs inside Docker, and I use my own software for HTTP proxying: Dotege uses tags I apply to containers to build a config for Centauri which handles reverse proxying, using Let’s Encrypt for TLS certs. At the minute I have two servers: a dedicated server that runs basically all my services (including this website), and a little VPS for monitoring and backups. Both are from Hetzner.

I wrote my own basic monitoring software called Goplum to make sure things that should be running on my servers actually are. If it fails checks it sends a notification to my phone using Pushover, and a message to a channel on my private IRC server (running Ergo).

Hardware

For the last two years I’ve used a laptop as my main computer⁵. It’s a Dell G15 Special Edition. After some upgrades its specs are:

Intel i7-12700H processor
NVIDIA GeForce RTX 3060 graphics card
2x32GB DDR5 RAM
2TB Gen4 SSD

At home it sits behind my Alienware AW3423DWF monitor. This is a Quantum Dot OLED monitor, and I bought it almost immediately upon seeing someone else use it at a LAN event. As did three other people that were sat near us. It just looks so good. I wasn’t sure I’d get on with a widescreen monitor, and made sure it supported picture-by-picture before buying it, but have never actually used that. I generally run whatever I’m working on at nearly-fullscreen, then have Todoist or Logseq on the far right. Games go fullscreen over everything, of course.

Above the widescreen I have a curved lightbar that I find helps reduce eyestrain and makes it easier to focus on the monitor. And on top of that I have a Logitech Brio webcam which gives a great picture with lots of control over pan/zoom/etc for meetings. I have a little set of systemd scripts that detect when the external webcam is connected and disable the laptop’s built-in webcam, and vice-versa when it’s disconnected; that means whenever I jump into a video call in any app there’s only one input and it’s always the right one, which is nice.

Below the main monitor and its friends, I have a generic 1080p portable monitor connected to the laptop via USB-C. This comes with me when I travel, and serves as a Discord/IRC monitor when at home. It’s handy for throwing other things on as well, like if I need to reference a design while writing code, and don’t want to keep alt+tabbing.

I have two Durgod K320 keyboards: one with Cherry MX Silent Red switches for when I’m at home and don’t want to annoy people with the sounds, and one with Cherry MX Blues for when I’m travelling and can make a bit more noise in exchange for a much nicer typing experience. They’re both tenkeyless so they can handily fit in a backpack.

I use a Zowie EC1-C wired mouse, which does the job well. I got fed up with mice from more mainstream manufacturers failing: my previous mouse was a Razer Viper that lasted 7 months before it started losing clicks. All my audio goes through a HyperX Cloud Alpha Wireless, which has the most insanely good battery life of any wireless headset I’ve ever owned or seen. Their claim of 300 hours is not just marketing!

In non-computer hardware, I have a Bambu P1S 3D printer that I’ve mentioned in my blog before. For printing in fewer dimensions I have an Epson EcoTank ET-1810, which is surprisingly reasonable for an inkjet printer, and the ink costs aren’t as astronomical as normal cartridges. Plus, you can’t decide to DRM ink when it’s loaded raw into the printer…

I have a small Zigbee network set up mainly to control the lights and the old 3D printer I no longer use (the P1S has a sensible standby mode so you don’t have to yank its power away to make the fans stop spinning!). That’s run through a Raspberry Pi running Zigbee2Mqtt and a custom app I wrote to monitor events on MQTT and generate the appropriate responses (or just log the data).

My daily-driver phone is an iPhone 15 Pro, but I have a bunch of Android devices kicking around for work purposes. I read nearly every day on a Kindle Paperwhite Signature Edition.

Money and work

I use You Need A Budget for figuring out how much money I can spend on what, and making sure I have enough put aside for bills and taxes and so on. I use it for both business and personal accounts together, but I mark all the business categories and accounts with a 💼 emoji, and have some scripts that use the API to make sure the money split makes sense⁶.

Every recurring monthly and annual payment has a category, as do all upcoming events I plan to attend, and all the wonderful taxes I have to pay. I also have categories for hobbies and other expenditure. I think all of that is pretty typical for a normal YNAB setup.

I also use YNAB for tracking anything I might like to buy at some point: it gets a category in a “Wishlist” group, and I’ll occasionally budget to buy things from there. I try (and often fail) to use that as a way to put off impulse purchasing. As my income is often very inconsistent, I try to set aside money so that I can “spend” a bit every week on things in the wishlist group. That feels a lot nicer to me than just budgeting everything in one go as soon as I get paid, and gives me more time to consider whether I really want those things⁷.

For work, I do all the more technical accountancy and tax filing and so on through FreeAgent. For my fairly straight-forward tax situation, I can basically manage everything myself using FreeAgent without paying for an accountant. That does mean occasionally spending a bunch of time reading tax manuals, but I’d rather fully understand the rules than just follow advice anyway.

The problem with implementing productivity systems or switching todo apps or anything of that ilk is that it can feel like you’re being productive by doing so. It takes a while to realise that you’re not, and actually getting on with things is better. ↩︎
Or just accept that I’ll maybe do them at some point. I kept the labels vague to try and not make it feel judgmental. ↩︎
Including writing this blog post right now. ↩︎
One day I will get all the justify- and align- options right without looking them up, but until then… ↩︎
This is very normal for developers, but much less common for computer gamers. I’ll probably go back to a desktop next time I upgrade, as I’m travelling a lot less. ↩︎
I can’t just arbitrarily move money from the business to myself, it has to be given as salary or a divided etc, which has tax implications. If I budget “business money” for personal things, then it actually has to be properly transferred and accounted for before being spent (as I’m in effect budgeting a future paycheck). It would be cleaner to keep the accounts completely separate, but I find this way works well for me as I can be a bit more flexible. ↩︎
It feels a little like I’m giving myself pocket money, which is a bit weird, but it’s a lot better than having no “income” for several months when client invoices fall weirdly or I’m between contracts. ↩︎

Further adventures in 3D printing

2024-08-04T00:00:00Z

The Bambu Labs P1S.

Not quite a year ago, I bought a Sovol SV06 3D printer and wrote about my initial experiences. At the end I joked:

I’m sure there will be more problems, but hopefully I get at least a week or so before anything else goes wrong. Maybe I’ll print an “X days since the last SV06 problem” counter…

That turned out to be more prophetic than I expected. It became a running joke that I’d flip the imaginary “days since” sign back to 0 almost every time I printed. I still really enjoyed having a printer, though: it’s so useful to be able to be able to go from an idea to a CAD drawing to a physical object in the space of minutes or hours. So when Bambu Labs reduced the price of the P1S — a printer generally regarded as about as trouble free as you can get — to £522 including shipping, I splurged on one.

Concerns

I make it sound like that was an easy decision, but I actually ummed and ahed a lot before pulling the trigger. I had a lot of objections to a Bambu Labs printer, and wasn’t quite sure if the price made up for them.

The Bambu Labs printers are designed to be more consumer friendly than most previous 3D printers. You can start a model printing directly from their website or mobile app, which employs a cloud-based slicer that then sends the model down to your printer. This is one of those things that sounds amazing for consumers, but should terrify anyone who works with computers. There are so many ways for a “cloud-connected” printer to go wrong, and with such potentially disastrous results it gives me anxiety just thinking about it.

This is not just theoretical, either. In a blog post with the rather under-stated title of “Initial Investigation in the Bambu Cloud Temporary Outage”, Bambu describe how a server-side error caused printers to start printing unprompted. Users on Reddit reported printers starting in the middle of the night, trying to print on top of other objects that were left on the build plate, and so on. 3D printers can easily start fires; having them cloud controlled is frankly insane.

As a result of that “temporary outage”, Bambu further improved the “LAN mode” for their printers, which allows you to sever its connection from their servers and control it over the network. That’s basically how my old printer worked anyway, so I was happy enough that I could enable LAN mode and ignore all the cloud nonsense.

My other objection to Bambu was more nebulous. Almost all 3D printers are built upon open source software, and some companies like Prusa go out of their way to make their products more open to give back to the community. Bambu don’t really do any of that: I’d be very surprised if they hadn’t incorporated a bunch of open source software into their printers and just ignored the licences¹. I’d much rather give my money to a company doing good, but the only equivalent printer was the Prusa MK4 which was double the price and didn’t come with an enclosure. To add an enclosure kit would have made it £800 more expensive than the P1S, and I just can’t justify that.

Experience

The initial setup of the P1S was a breeze. While the SV06 shipped in parts, the P1S came fully assembled and just needed some packaging and retaining screws removed. These were all clearly marked with large coloured arrows. It’s very much designed so anyone can do it.

I ran through the initial calibration, firmware update, and then put it in LAN mode. Then I just started printing and it went fine. No messing around levelling a bed, or using a sheet of paper to try and set the Z-offset properly; it just worked. It was really loud though. After talking a bit with a friend who’d also bought a P1S, I realised that most of his noise was from the fans, while most of mine was from the servos. A bit of research later and I found out they added servo noise compensation in a firmware update, but I hadn’t run the calibration for it because the initial calibration happened before the update. After doing that, the printer went from sounding like it was impersonating a continental police siren to just being a bit fan-y.

The biggest difference over the SV06 is the speed. I’d swapped the nozzle on the SV06 to a 0.6mm one, and generally printed at a layer height of 0.4mm. The P1S still has its 0.4mm nozzle, and I mostly print at a layer height of 0.2mm. So it’s laying down twice the number of layers, with a nozzle that can extrude half the amount of plastic… And it’s at least twice as fast! Prints that I previously wouldn’t have even attempted on the SV06 are now 8-10 hours on the P1S, without even adjusting the speed or lowering the quality. Here’s a side-by-side comparison:

P1S vs SV06.

The P1S can print eight objects because of its slightly larger bed, while the SV06 can only manage three. The P1S is also printing at a much higher quality. Yet somehow it still ends up being faster. It’s mind blowing.

The other big difference I’ve not mentioned yet is that the P1S is a “core XY” printer rather than a “bed slinger”. That means in order to move along the Y-axis (from the front of the bed to the back), the P1S moves the extruder while the SV06 moves the bed. This makes a big difference when printing tall objects, as they’re far more likely to wobble and come loose when the bed is moving back and forth. It also presumably makes the kinematics a lot easier as the mass of the moving parts is constant, instead of gradually becoming heavier as more and more plastic gets added.

The only failures

I’ve only had a handful of failures since getting the P1S. I had one weird issue where the slicer decided to print some parts extremely slowly, and the print just didn’t work out in those parts; that’s more of a slicer issue, though: after tweaking the model to stop the weird behaviour it printed fine.

The only failure I can directly attribute to the printer was when I tried ironing. This is a process where after printing the top layer, the printer slowly goes back over it at the same height while extruding a small amount of plastic. This is meant to fill in the small gaps between extrusions and give a smooth finish. In my case, though, it just clogged the nozzle and extruder.

At first I thought it was because I was printing too hot: the profile I was using was designed for fast printing, so had to melt the filament rapidly, but there was no way to turn that temperature down just for the ironing pass. I tried another run at a lower temperature and everything clogged again. I then swore off ironing, did a normal print, and everything clogged once more.

At this point I was getting exceedingly good at disassembling the hot end, but also fairly annoyed. It felt like I was using an SV06 again²! I’d previously read some recommendations that you should leave the door or top of the enclosure open when printing PLA, but had never really had any issues so hadn’t bothered. I tried a print with the top propped open and everything worked smoothly again. In hindsight all these clogging issues happened when it was particularly hot and humid outside, which was probably a factor.

Summary

Upgrading to the P1S has made the 3D printer feel more like a tool and less like an additional ongoing project. The speed increase continues to amaze me, as does the increase in quality.

I still think it was valuable to have the SV06 to learn how printers work — you definitely don’t get as much of that from using something so consumer-focused as the P1S — and figure out if I was actually going to use it long-term or whether it was just a fad for me. So it served its purpose, but I’m rather glad to see the back of it in favour of something better in pretty much every way.

And if they did there’s nothing anyone can do about it because copyright doesn’t exist in the same way in China. ↩︎
Although taking apart the P1S (which is a proprietary machine you might not expect to be very user-servicable) was orders of magnitude easier than taking apart the SV06 (which was an open source design). Everything is just much nicer: the connectors are easier to attach and detach, the screws are all a consistent size instead of needing a whole suite of allen keys, and so on. ↩︎