Ops toolbelt

The catalog of single-purpose (or few-purpose) tools worth keeping loaded — the sysadmin’s pocket knife roll. Not the platforms (those live in their own notes: OSS routers, Open source backup software, Reverse proxies) — the small sharp utilities that solve one ops annoyance properly, especially the ones younger/quieter than their fame deserves.

Entry format: what it does, why it earns a slot, and the honest caveat (stars, maturity, alternatives).

TLS / certificates

• certkit (OSS) (Go, MIT, pre-1.0) — “Swiss Army knife” for TLS certs: inspect cert/key/CSR, verify chain + key-match + expiry, live TLS connect (chain/cipher/ALPN), bundle leaf → full chain for nginx/Apache/HAProxy, convert PEM/DER/PKCS#12/JKS/PKS#7, sign from CSRs, scan a directory of certs into an inventory. Earns the slot by replacing a dozen openssl one-liners nobody remembers; the directory-scan mode is the audit nobody does until renewal day. Caveat: 3★ and an explicit no-interface-stability-before-1.0 banner. Older/narrower cousin: mkchain (OSS) (383★, chain assembly only, quiet since 2024-11).

Related: OSS routers · Open source backup software · Do-nothing scripting (where these tools get scripted around)

Secrets

• factorseal (OSS) (61★, Rust, Apache-2.0; by Domen Kožar/cachix — the NixOS ecosystem’s toolsmith) — hardware-backed local secrets vault: TPM 2.0 (Linux/Windows) or Apple Secure Enclave (macOS) protects unlock; typed personal records + scoped application access (the vault service authenticates calling executables and checks grants — per-binary ACLs, the pattern password managers rarely ship); SecretSpec provider, Bitwarden/1Password/KeePass import, experimental device sync + browser extension. Context (@domenkozar’s tweet, quoting a 1Password frustration thread — “avg credentials per workspace / avg time to fill a password… it’s starting to get crazy how often I have to reauthenticate”): the lean-local-tool answer to manager bloat. ⚠️ Self-declared unaudited prototype — watch, don’t deploy. Fits the password-lab lane at ~/projects/pass-lab (pass/sops/age family tree).

systemd

• Socket activation (via @psviderski, captured; the Uncloud daemon ↔ Caddy-container case) — the fix for circular startup dependencies between services that talk to each other: a .socket unit makes systemd hold the listening socket open before any daemon starts; first connection triggers the .service unit, which receives the listening fd and accepts the kernel-queued connections. Kills the socket-availability race (no wait-and-retry loops in dependents) and gives on-demand startup for free (service spins up on first connection — the inetd pattern, modernized). The underused lever: most people only meet systemd via timers and unit files; socket activation is the one that changes dependency topology.

OWASP Cheat Sheet Series (the 137-recipe security baseline)

midudev (1.6k❤ / 206 RT): “¡Si tienes un servidor propio, necesitas esta guía!” — if you run your own server you need this: ~137 cheat sheets for protecting machine and application, official OWASP (cheatsheetseries.owasp.org, captured). Coverage spans authentication/sessions/passwords, Docker, GraphQL, GitHub Actions, .NET/Java/PHP/SQL — and now AI-agent security (per the tweet’s screenshot: “seguridad de agentes de IA” in the sidebar). Downloadable as a full offline bundle (bundle.zip), ATOM feed for updates; leaders Jim Manico / Jakub Maćkowski. For the homelab fleet: the checklist to walk before exposing any new *.h service — pairs with factorseal (local secrets) and the WAF blocking analysis lane.

Rebalancer: the assignment-problem solver, open-sourced (Meta)

rebalancer (OSS) (144★ C++, facebook; 9 years in production at Meta; via @Meta_Engineers, 1,852❤ / 88k views + the eng post, both captured). ~40 million assignment problems/day across 30+ formulations; P99 solve 12s at 265k objects × 3.2k bins. The pattern is the keeper — separate specification from solution: describe objects/bins/constraints/objectives in a small modeling language (dimensions, partitions, scopes, utilizations → expression API → dozens of Spec recipes like CapacitySpec/BalanceSpec/GroupCountSpec); it compiles to an expression DAG that feeds EITHER an optimal MIP (Gurobi/FICO Xpress/HiGHS) OR a parallelized local-search solver (move-based neighborhood, millions of evals/sec, pruning; O(|objects|+|bins|) worst case). Uses at Meta: hardware placement (racks→DCs across fault domains), service/task placement, traffic routing (billions of users→geo DCs). Constraints violated by the initial assignment become high-priority goals minimized to zero — graceful degradation, not hard failure. Ops relevance: the general shape behind every scheduler question (k8s bin-packing, VM placement, oncall shift assignment); DSL-on-top-of-solvers is a design worth stealing whenever ‘just run an optimizer’ meets messy real-world policy.

Headless-browser engines for agents: Obscura vs Lightpanda (2026-10-07)

DivyanshT91162 → h4ckf0r0day/obscura (28.7k★ Rust, Apache-2.0; tweet + README captured): “a browser small enough for machines, powerful enough for AI agents” — embeds V8 directly, own rendering engine, CDP-compatible drop-in for Puppeteer/Playwright, and the differentiator: stealth built in (randomized fingerprints, hidden navigator.webdriver, masked native functions, 3,520 tracker domains blocked). Claims vs headless Chrome: 30 MB vs 200+ MB memory, 85 ms page loads, instant startup.

The user-asked comparison — lightpanda-io/browser (36.1k★ Zig; also captured — the engine Hermes itself routes to): “not a Chromium fork, not a WebKit patch — a new browser,” CDP + Playwright/Puppeteer support, 933-real-page crawl benchmark: 123 MB peak for 100 pages vs Chrome’s 2 GB (~16× less), 100 pages in 5 s vs 46 s (~9× faster). JS via its own engine (no embedded V8); no stealth claims.

Verdict table:

• Engine philosophy: both from-scratch (Rust+V8 vs Zig+own JS engine) — the V8 choice trades binary size for exact-JS compatibility
• Proof quality: Lightpanda publishes a reproducible 933-page benchmark; Obscura’s numbers are README claims
• Positioning: Obscura = scraping/stealth lane (anti-detect, proxy sponsors, Obscura Cloud); Lightpanda = automation/at-scale lane (crawl economics, mature nightly releases, shipped integrations — including Hermes’ own browser stack)
• Maturity: Lightpanda pushed today, multi-platform nightlies, brew/AUR; Obscura newer, cloud-in-progress
• Pick: scale crawling/agent-driving on owned infra → Lightpanda; fingerprint-hostile scraping → Obscura (with the usual EULA/robots caveats)

Kin: mdream (OSS) (the markdown output side of the same agent-browsing stack). Note: Lightpanda is the engine Hermes’ own browser stack routes to — see the hermes-browser-internals skill.

Addendum: Obscura vs Camoufox (2026-10-07)

Camoufox (12.4k★ Python/Firefox-fork, captured): the anti-detect browser this household actually runs — the allegro-scraping skill’s engine (Hermes profile skill, not a vault note), proven against DataDome in production (rate-based blocks, 403-status-still-has-data behavior — see the skill’s pitfall log). The engineering difference vs Obscura is where the spoofing lives:

• Camoufox: C++/Gecko level — “data is intercepted at the C++ implementation level, making the changes undetectable through JavaScript inspection.” No JS injection at all; fingerprints drawn from fpgen (a model of the real-world device distribution) and checked for coherence — parts that are each plausible can’t combine into a machine that does not exist. Graphical layer too: WebGL params, shader precision, font spoofing.
• Obscura: stealth features at the engine layer too (masked native functions, hidden webdriver, 3,520 tracker domains) but in a new Rust engine with embedded V8 — the stealth story is younger and less battle-proven; its README numbers aren’t benchmark-reproduced yet.

Verdict:

• Proven anti-bot survival (DataDome, PerimeterX-class): Camoufox, by field evidence — it’s what survived Allegro; identity coherence (fpgen + cross-property consistency) is the actual moat, not any single spoofed property
• Resource footprint / embed-ability: Obscura (30 MB, no Firefox) vs Camoufox (debloated but still full Firefox)
• JS compatibility risk: Camoufox inherits Firefox’s engine (nothing exotic); Obscura’s own renderer + V8 is newer territory for rendering edge cases
• Maturity honesty: Camoufox itself says “under development, may not be suitable for stable production” — and still outperforms most; Obscura is earlier
• Household pick stands: scraping that must not die → Camoufox (already deployed, skill-log-backed); owned-infra crawling where stealth is irrelevant → Lightpanda; watch Obscura for the stealth-at-30MB future

uniTerm: the 30-protocol access hub with an agent inside (2026-10-08)

ponceto91 → uniterm (OSS) (782★ Go, Apache-2.0; tweet + README captured): “all-in-one terminal covering 30+ protocols” — SSH/Telnet/Mosh, SFTP/SCP/FTP/SMB/WebDAV/S3, RDP/VNC/SPICE/X11, DB clients (MySQL/PG/Oracle/Redis/Mongo/ES), Kubernetes/Docker/Podman, server monitor — plus the agent layer: an autonomous AI agent that plans-executes-observes-iterates multi-turn shell commands in the active terminal, four execution modes (bypass / dangerous-only / dangerous+write / confirm-all), and — the notable bit — a built-in MCP server so external agents (Claude Code, Codex, Gemini CLI) run commands and transfer files on saved connections while “credentials never leave the app.” The architecture is the inverse of the harness pattern: instead of a coding agent gaining shell access, an access hub (Xterm-like + connection manager) gains an agent — the credential vault stays at the connection-manager layer. Kin: the homelab bastion lane (Warpgate/Tailscale SSH posture — one controlled ingress), Agent sandbox (execution placement), octop’s remote-desktop-per-agent (the GUI answer to the same access problem).

Shoulder: the agent that watches your terminal (2026-10-08)

exedev + blog.exe.dev + shoulder (OSS) (day-old, 1★; all captured): born from real ops — live-migrating VMs between hosts and wanting “an extra set of attention heads” on it. shoulder wraps your bash in a session the agent can see and control — read your logs alongside you, flag what you missed — connectable locally or from anywhere via tailcat (Tailscale). The design lesson worth keeping is the rejected first iteration: a tmux-style split TUI (agent one half, terminal the other) — “I tried it and I hated it: my preferred agent is one thing (Shelley in a browser) and my preferred terminal is another (Ghostty), and it’s much better to bridge the two.” So: no new surface — the agent attaches to your terminal of choice. Demo includes Luna the agent playing Tetris, badly. For the vault: the ops-adjacent sibling of uniTerm’s inverse (access hub gains agent) — here the terminal itself becomes agent-shareable; the “extra attention head during live migrations” is exactly the oncall-lane pattern (watch the boring-but-critical stream, tap the human when something’s off).

mise secrets via fnox: task-scoped, daemon-served (2026-10-08)

jdxcode (24❤; jdx, mise author): after 2 years of not being happy with how secrets worked in mise, the design that finally lands — secrets via fnox (fnox (OSS), 2.2k★, jdx’s encrypted/remote secret manager; mise-env-fnox (OSS) plugin; tweet + both repos captured). The two differences he names: (1) designed around tasks — granular control over which task gets which secrets (scope follows the task graph, not the shell); (2) optionally uses the fnox daemon — no filesystem caching and no re-fetching secrets on every run (the perf/footprint seam: a long-lived process holds the secret channel, tasks draw from it). Status honest: experimental, “not done, more work to be done, but this feels like the right direction.” For the vault: the task-scoped-secrets pattern is the interesting half — it’s the same boundary as microsandbox’s host-brokered keys and uniTerm’s credentials-never-leave-the-app (Agent sandbox): secrets scoped to the unit of execution, delivered by a broker, not smeared into env-var context. mise context: the NixOS note’s “mise is a low-power, low-IQ tool” jab is quoted there — this is mise’s answer to the secrets gap that jab implied.

Mimik: workflow→guide capture, fully local (2026-10-08) — the years-long search ends

westpoint-io/mimik (1.5k★ TypeScript, MIT; captured): “auto-capture any browser workflow into a step-by-step guide — no account, no cloud, no tracking” — click record, do the thing, get a polished guide with annotated screenshots (clicked element highlighted + zoomed per step; rapid clicks merged; clicks intercepted pre-navigation so SPAs don’t lose steps). The completeness that makes it the one: Smart blur (mode-based masking of emails/phones/SSNs/cards/IPs/MACs, per-category toggles, manual DOM picker — with an unusually honest “not covered” table: iframes, shadow DOM, canvas, ::before/after, non-top frames); AI step descriptions from lightweight DOM context (~50–100 tokens, “15–30× cheaper than vision”) with BYO key; voice narration transcribed to steps (full transcript kept, editable, never exported); Guide Me replay (highlights next element on the live page, advances as you click — the onboarding loop closed); editor with version history; exports to video (narrated, §508-friendly), GIF, PDF, DOCX, HTML, Markdown, and .mimik (plain zip + manifest + README so it reads without the extension; blur burnt into pixels, typed field text stripped, session-token query strings dropped on export). Everything client-side. USER NOTE, verbatim: “I have been looking for that for years. Literally years.” Vault fit: the documentation-capture counterpart to Redline (review-in-place) and shoulder (agent-over-terminal) — human-workflow capture joining the ops-toolbelt’s evidence lane; the SaaS lane it replaces (Scribe/tango/guidde-class) went cloud+subscription, Mimik is the local-first answer with better privacy ergonomics than any of them.