devops

A time-based bandwidth cap on a home LAN using Squid delay pools: bytes vs bits, the acl time trap, container TZ, and a second unlimited pool.

One folder or five scattered paths? The shape of your include set decides when subtree split is safe and when an rsync snapshot wins.

A 429 rate limit froze my research pipeline. Designing multi-key rotation: per-HTTP-status cooldown, single-pass failover, and errors that should not rotate.

TL;DR: The pipeline hit 429 rate limits, so the author added key rotation with per-status cooldowns: 60s for 429, 300s for 402, an hour for auth errors. Rotation is single-pass to avoid infinite loops, and request errors like 404 throw immediately. The author stresses rotation only raises ceilings; fix wasteful requests first.

Copying an active SQLite file is not a backup. Lessons from a light backup script: hot backup, verified atomic tar, and layered pruning.

TL;DR: The script backs up SQLite databases using the official .backup API instead of raw cp, since copying active WAL files can yield corrupt snapshots. Archives are staged, verified with tar, then atomically renamed, with flock preventing overlap. Pruning keeps 14 days plus a floor of 3 newest archives, so failures can't silently destroy valid backups.

Migrating the Hermes watchdog to host-native was not just swapping paths. Lessons in git diff --quiet, set -euo pipefail, and a zero-token pattern.

TL;DR: Migrating Hermes to host-native broke hermes-patch-watchdog.sh, which still pointed at the old container path. The fix required more than a find-and-replace: git semantics shifted, the venv moved, and set -euo pipefail turned silent mid-script failures into false healthy signals. Every check now fails loudly, since for a silence-means-healthy watchdog, noise beats quiet mistrust.

Wiring env vars in Compose is only half the job; the container still needs a deliberate network path before the LLM search feature can talk to its router.

The upstream image ships no sudo and /etc is ephemeral. A tiny entrypoint override in compose reinstalls passwordless sudo on every boot.

Two small compose decisions, identical paths on both sides and a matched UID, make the host Projects folder safe to use from a container without chmod 777.

My first guess was a ports block in compose. Host-mode already shares the host loopback, and ports actually breaks compose validation.