What we've put out.
The things we build for ourselves, given away.
Some of the work doesn't belong to a client. Tools we needed, wrote properly, and had no reason to keep. They'll show up here as they're cleaned up enough to hand over.
gonixgo
A Go builder for Nix that gives every package its own derivation. Editing one package rebuilds that package, whatever imports it, and the link, so dependencies are compiled once and not on every build. There is no vendorHash and no lockfile to update when go.mod changes: module hashes are worked out while Nix evaluates, through builtins.exec. That needs one Nix option switched on, but no plugin and no experimental features. Pure Go only for now.
go-secret-bunker-iroh
Pure-Go client for secret-bunker-iroh, with no CGO, built on the native Go iroh implementation. The client's identity is its ed25519 key — authenticated in the QUIC handshake, authorized against the bunker's ACLs. No certificates, no tokens. Covers the full protocol, from reads and compare-and-set writes to the admin operations.
secret-bunker-iroh
A small secrets service that stores secrets encrypted at rest and serves them over iroh — peer-to-peer QUIC dialed by public key. No TLS certificates or CAs to configure: the bunker's identity is its ed25519 key, and a connected peer can do nothing until that key is granted access. Ships with a Kubernetes operator that syncs bunker secrets into native Secret objects via a BunkerSecret custom resource.
Want to build something in the open?
We're happy to talk about work that ends up public — libraries, tooling, or the boring infrastructure everyone rewrites.
Start a conversation