What we've put out.
The things we build for ourselves, given away.
Some of the work doesn't belong to a client. Tools we needed, wrote properly, and had no reason to keep. They'll show up here as they're cleaned up enough to hand over.
kosh
An SSH server that runs inside a Kubernetes cluster. Whoever connects with a key from its list gets a terminal UI that behaves like k9s, with tables for the usual kinds, CPU and memory from metrics-server, describe, YAML, logs, actions like scale and drain, and a shell in a pod. kosh talks to the Kubernetes API as its own ServiceAccount, so nobody who connects holds a kubeconfig, and a key is read-only unless its name ends in /admin. Besides ssh it is reached with iroh-ssh by its endpoint ID alone, which needs no exposed Service and no open port, only outgoing traffic. A single static Go binary in an image with no shell, installed with a Helm chart.
rostnix
A Rust builder for Nix that gives every step of cargo's plan its own derivation, one rustc invocation or one build script run each. An edit rebuilds the steps that see the file and the steps that depend on them, and every test executable is built and run as a step of its own. Cargo plans the build while Nix evaluates, through builtins.exec, so features and profiles are cargo's own, and nothing generated has to be checked in when Cargo.toml or Cargo.lock changes. Like gonixgo it needs one Nix option switched on, but no plugin.
gonixgo
A Go builder for Nix that gives every package its own derivation. Editing one package rebuilds that package, whatever imports it, and the link, so dependencies are compiled once and not on every build. There is no vendorHash and no lockfile to update when go.mod changes: module hashes are worked out while Nix evaluates, through builtins.exec. That needs one Nix option switched on, but no plugin and no experimental features. Pure Go only for now.
go-secret-bunker-iroh
Pure-Go client for secret-bunker-iroh, with no CGO, built on the native Go iroh implementation. The client's identity is its ed25519 key — authenticated in the QUIC handshake, authorized against the bunker's ACLs. No certificates, no tokens. Covers the full protocol, from reads and compare-and-set writes to the admin operations.
secret-bunker-iroh
A small secrets service that stores secrets encrypted at rest and serves them over iroh — peer-to-peer QUIC dialed by public key. No TLS certificates or CAs to configure: the bunker's identity is its ed25519 key, and a connected peer can do nothing until that key is granted access. Ships with a Kubernetes operator that syncs bunker secrets into native Secret objects via a BunkerSecret custom resource.
Want to build something in the open?
We're happy to talk about work that ends up public — libraries, tooling, or the boring infrastructure everyone rewrites.
Start a conversation