Blog - James Mead

Organisation-specific git authentication and commit signing

2026-04-19T10:13:00+01:00

Recently I wanted to use a separate SSH key for work on repositories in a specific GitHub organisation, but continue to use a single GitHub user account. I already had some organisation-specific git configuration</a> which sets the email address used in commit notes and I've now managed to extend that to incorporate using an organisation-specific SSH key both for authentication with GitHub and for signing my commits.</p>

One complication was that I wanted to continue to manage my SSH keys in 1Password which I use as my SSH agent</a>. I struggled to find a way to make the 1Password SSH agent offer the correct organisation-specific key, but eventually worked out that I could set core.sshCommand</code></a> in my organisation-specific git config to override the default ssh</code> command and specify the relevant public key using the -i</code> (identity file) option. Although this feels like a bit of a hack, the only downside I can see is that I had to export each of the public keys to my ~/.ssh</code> directory which effectively introduces duplication, but it's duplication that I can live with.</p>

While testing this configuration I came across the gpg "ssh".allowedSignersFile</code></a> git configuration option which means you can use git log --show-signature</code> to check your commits have been signed correctly.</p>

1Password configuration</h2> Using these instructions</a>:</p> Generate an Ed25519</a> SSH key for organisation 1</li> Generate an Ed25519</a> SSH key for organisation 2</li> </ul> And then download the public key for each to:</p> ~/.ssh/github-organisation-1.pub</code></li> ~/.ssh/github-organisation-2.pub</code></li> </ul> GitHub configuration</h2> Emails</h3> In your GitHub email settings</a>:</p> Add & verify email.address@organisation-1.com</code></li> Add & verify email.address@organisation-2.com</code></li> </ul> SSH keys</h3> In your GitHub SSH key settings</a>:</p> Add SSH key for organisation 1 as authentication key</li> Add SSH key for organisation 2 as authentication key</li> Add SSH key for organisation 1 as signing key</li> Add SSH key for organisation 2 as signing key</li> </ul> SSH configuration</h2> Configure ssh to use 1Password as its agent. And list allowed signers for each organisation to be used as allowedSignersFile</code>.</p> # ~/.ssh/config Host * IdentityAgent <path-to-1password-agent.sock> # ~/.ssh/allowed_signers_for_organisation_1 email.address@organisation-1.com ssh-ed25519 <ssh-public-key-for-organisation-1> # ~/.ssh/allowed_signers_for_organisation_2 email.address@organisation-2.com ssh-ed25519 <ssh-public-key-for-organisation-2> </code> </pre> Git configuration</h2> Shared</h3> Sign commits using SSH keys in 1Password</a></li> Include organisation-specific configurations</a></li> </ul> # ~/.gitconfig [gpg] format = ssh [gpg "ssh"] program = /Applications/1Password.app/Contents/MacOS/op-ssh-sign [commit] gpgsign = true [includeIf "gitdir:~/Code/organisation-1/"] path = ~/.config/git/organisation-1.inc [includeIf "gitdir:~/Code/organisation-2/"] path = ~/.config/git/organisation-2.inc </code> </pre> Organisation 1</h3> Use SSH key for organisation 1 to authenticate with GitHub</li> Use SSH key for organisation 1 to sign commits</li> Specify allowed signers for organisation 1 (used by e.g. git log --show-signature</code>)</li> </ul> # ~/.config/git/organisation-1.inc [user] email = email.address@organisation-1.com signingkey = ssh-ed25519 <ssh-public-key-for-organisation-1> [core] sshCommand = "ssh -i ~/.ssh/github-organisation-1.pub" [gpg "ssh"] allowedSignersFile = ~/.ssh/allowed_signers_for_organisation_1 </code> </pre> Organisation 2</h3> Use SSH key for organisation 2 to authenticate with GitHub</li> Use SSH key for organisation 2 to sign commits</li> Specify allowed signers for organisation 2 (used by e.g. git log --show-signature</code>)</li> </ul> # ~/.config/git/organisation-2.inc [user] email = email.address@organisation-2.com signingkey = ssh-ed25519 <ssh-public-key-for-organisation-2> [core] sshCommand = "ssh -i ~/.ssh/github-organisation-2.pub" [gpg "ssh"] allowedSignersFile = ~/.ssh/allowed_signers_for_organisation_2 </code> </pre>


Adding human.json to my website
2026-04-04T21:30:00+01:00
Prompted by reading this blog post by Bastian Tzovaras</a>, I've added a human.json</code> file</a> to this website to assert my authorship of the content and vouch for the "humanity" of other websites. The human.json protocol</a> uses URL ownership as identity and trust propagates through a crawlable web of "vouches" between sites. I've also added an IndieWeb slashpage</a> to explain that I don't use generative AI to create content on this website</a>.</p>

If we know each other and you avoid using generative AI</a> on your website, let me know</a> and I'll add a "vouch" for you.</p>


Configuring Zed editor to use HTML Beautifier as a formatter in ERB templates
2025-03-30T17:05:00+00:00
Following on from my previous post about configuring Zed editor to use ERB Lint as a formatter</a>, here's how to configure Zed</a> to use Paul</a>'s excellent HTML Beautifier</a> as a formatter in ERB templates.</p>

Configure HTML Beautifier as a formatter</a> for ERB files as well as HTML files by adding the following JSON to your Zed settings, either global or project-specific:</p>

  
    {
      "languages": {
        "ERB": {
          "formatter": [
            {
              "external": {
                "command": "bundle",
                "arguments": ["exec", "htmlbeautifier", "--keep-blank-lines", "1"]
              }
            }
          ]
        },
        "HTML": {
          "formatter": [
            {
              "external": {
                "command": "bundle",
                "arguments": ["exec", "htmlbeautifier", "--keep-blank-lines", "1"]
              }
            }
          ]
        }
      }
    }
  </code>
</pre>

Note that I've added the HTML Beautifier formatter configuration after</em> the ERB Lint formatter configuration for ERB files and that seems to work well.</p>


Configuring Zed editor to use ERB Lint as a formatter
2025-03-30T15:46:00+00:00
I've recently started using the Zed editor</a> instead of VS Code. It took me a
while to work out how to configure ERB Lint</a> as a formatter, so hopefully this
will save someone else some time.</p>

Write a shell script to run ERB Lint as follows:</p>

  
    #!/usr/bin/env sh

    bundle exec erb_lint --autocorrect --stdin $1 2>/dev/null \
      | sed '1,/^================/d'
  </code>
</pre>


  Enable the option to automatically correct linting errors (--autocorrect</code>)</li>
  
Read the file content from standard input and specify the path supplied in
the first command-line argument (--stdin $1</code>)</li>
  
Suppress irrelevant warnings & error messages (2>/dev/null</code>)</li>
  
Remove the preamble from the output to make it suitable for a Zed editor
formatter (sed '1,/^================/d'</code>)</li>
  Ensure the script is executable (chmod +x erb-lint-formatter</code>)</li>
</ul>

Configure ERB Lint as a formatter</a> by adding the
following JSON to your Zed settings, either global or project-specific,
replacing $PATH_TO_FORMATTER</code> with the path to the shell script you created
above:</p>

  
    {
      "languages": {
        "ERB": {
          "formatter": [
            {
              "external": {
                "command": "$PATH_TO_FORMATTER/erb-lint-formatter",
                "arguments": ["{buffer_path}"]
              }
            }
          ]
        }
      }
    }
  </code>
</pre>

Zed sets the {buffer_path}</code> placeholder to the path of the buffer currently
being edited.</p>


Mocha v2 release
2022-11-01T14:01:00+00:00
This major version bump of the Ruby mock object library, Mocha</a>, includes some fairly significant changes. So I wanted to expand a bit on the release notes</a> and give some more detailed guidance on factors to consider when upgrading.</p>


  Strict keyword argument matching</a></li>
  
Removal of deprecated functionality</a></li>
  
Dropping of support for older versions of Ruby, minitest & test-unit</a></li>
  
Acknowledgements</a></li>
</ul>

TL;DR: If you're using a non-ancient version of Ruby, you're using a non-ancient test library version, you've already upgraded to Mocha v1.16.0, and you've fixed all the Mocha deprecation warnings, then the worst that should happen when you upgrade is that you'll see some new deprecation warnings!</em></p>

Strict keyword argument matching</h2>

Previously Mocha parameter matching always considered a positional Hash</code> as exactly equivalent to a set of keyword arguments. However, in Ruby v3, positional arguments and keyword arguments have been separated and, in Ruby v2.7, behaviour that would be different in Ruby v3 is flagged by deprecation warnings. See this article</a> for more details on the separation of positional and keyword arguments in Ruby v3.</p>

To address this a new configuration option (Configuration#strict_keyword_argument_matching=</a>) has been introduced in Mocha v2. This option is available in Ruby v2.7 upwards.</p>

In Mocha v2 the configuration option defaults to false</code>, but in a future version of Mocha it will default to true</code>. When the option is set to true</code>, Mocha parameter matching considers a positional Hash</code> and a set of keyword arguments as different</em> even if their "keys" and "values" are exactly the same, i.e. the parameter matching is stricter and some invocations which previously matched may no longer match.</p>

When the configuration option is set to false</code>, parameter matching that would behave differently if the option were set to true</code> is flagged by Mocha deprecation warnings. Once all these deprecation warnings are addressed, the configuration option can safely be set to true</code>.</p>

It's important to address this issue, because otherwise you may end up with passing tests that give you a false sense of security. See the examples below.</p>

Keyword argument syntax</h3>

An area of possible confusion is the Ruby syntax that distinguishes between a positional Hash</code> and a set of keyword arguments. In particular the use of hash rockets</a> ("=>") does NOT</strong> imply a positional Hash</code>. Instead what matters is whether the "keys" and "values" are surrounded by braces ("{ … }").</p>

The following code defines a method that in Ruby v3 expects to be called with a single keyword argument. That method is then called four times, twice with the correct keyword argument and twice with a positional Hash</code> including a key with the correct name. You might be surprised that the 2nd call (i.e. foo(:bar => 1)</code>) is passing a keyword argument.</p>

  
    def foo(bar:); p bar; end

    # Method called with correct keyword argument
    foo(bar: 1) # => 1
    foo(:bar => 1) # => 1

    # Method called with positional Hash
    foo({ bar: 1 }) # => ArgumentError: wrong number of arguments (given 1, expected 0; required keyword: bar)
    foo({ :bar => 1 }) # => ArgumentError: wrong number of arguments (given 1, expected 0; required keyword: bar)
  </code>
</pre>

Example with relaxed matching</h3>

The parameters in the expectation include a set of keyword arguments, but the parameters in the invocation include a positional Hash</code>. With strict matching disabled, these parameters match the expectation and the test passes. However, when Example#foo</code> is invoked in production code in Ruby v3 an ArgumentError</code> is raised, i.e. the passing test does not highlight that Example#foo</code> must be called with a set of keyword arguments.</p>

  
    class Example
      def foo(a, bar:); end
    end

    class ExampleTest < MiniTest::Test
      def test_foo
        example = Example.new

        # The parameters in the expectation include a set of keyword arguments
        example.expects(:foo).with('a', bar: 'b')

        # The parameters in the invocation include a positional Hash
        # These parameters match the expectation and the test passes
        example.foo('a', { bar: 'b' })
      end
    end

    example = Example.new
    example.foo('a', { bar: 'b' }) # => ArgumentError in Ruby v3
  </code>
</pre>

Note, however, that a deprecation warning is displayed:</p>


  Mocha deprecation warning at example_test.rb:NN:in `test_foo': Expectation defined at example_test.rb:MM:in `test_foo' expected keyword arguments (:bar => "b"), but received positional hash ({:bar => "b"}). These will stop matching when strict keyword argument matching is enabled. See the documentation for Mocha::Configuration#strict_keyword_argument_matching=.</p>
</blockquote>

Example with strict matching</h3>

With strict matching enabled, the parameters no longer match the expectation and the test fails. This test failure highlights that Example#foo</code> must be called with a set of keyword arguments.</p>

  
    Mocha.configure do |c|
      c.strict_keyword_argument_matching = true
    end

    class Example
      def foo(a, bar:); end
    end

    class ExampleTest < MiniTest::Test
      def test_foo
        example = Example.new

        # The parameters in the expectation include a set of keyword arguments
        example.expects(:foo).with('a', bar: 'b')

        # The parameters in the invocation include a positional Hash
        # These parameters no longer match the expectation and the test fails
        example.foo('a', { bar: 'b' })
      end
    end

    # When Example#foo is invoked in production code:
    example = Example.new
    example.foo('a', { bar: 'b' }) # => ArgumentError in Ruby v3
  </code>
</pre>

Removal of deprecated functionality</h2>

A bunch of deprecated functionality has been removed in Mocha v2. As long as you've previously upgraded to Mocha v1.16.0 and fixed all the deprecation warnings you shouldn't have any trouble.🤞</p>


  It's no longer possible to pass API#mock</code></a>, API#stub</code></a> or API#stub_everything</code></a> a single symbol argument to create a mock object responding to a method named according to that symbol argument. Such an argument is used to name the mock object itself; any stubbed methods and return values should be setup by passing a Hash</code> into these methods or by calling Mock#expects</code></a> or Mock#stubs</code></a>.</li>
  
If Expectation#yields</code></a> or Expectation#multiple_yields</code></a> have been used to specify that a stubbed method should yield then the stubbed method must be invoked with a block otherwise a LocalJumpError</code> will be raised.</li>
  
The Configuration#reinstate_undocumented_behaviour_from_v1_9=</code> method has been removed. If you have addressed the deprecation warnings for API#mock</code>, API#stub</code>, API#stub_everything</code>, Expectation#yields</code> and Expectation#multiple_yields</code> as explained above then this configuration option is redundant.</li>
  
The Configuration.allow</code>, Configuration.warn</code> and Configuration.prevent</code> methods have been removed. Use Mocha.configure</code></a> and/or Mocha::Configuration.override</code></a> instead.</li>
  
The mocha/setup.rb</code> mechanism has been removed. Use one of the supported installation mechanisms</a> instead.</li>
  
The Ruby on Rails</a> plugin mechanism has been removed. Use one of the supported installation mechanisms</a> instead.</li>
  
A StubbingError</code></a> is now raised when stubbed methods are invoked in a test other than the one in which they were defined. This is to avoid unintended interactions between tests and hence unexpected test failures. A test should clean up any state that it introduces.</li>
</ul>

Dropping of support for older versions of Ruby, minitest & test-unit</h2>

Mocha v2 drops support for older versions of Ruby</a>, test-unit</a> and minitest</a>.</p>

More specifically Mocha v2 only supports:</p>


  Ruby v2.0 and upwards. In particular Ruby v1.9 is no longer supported. Note that support for Ruby v1.9.3 ended on 23 Feb 2015</a>.</li>
  
Gem versions of test-unit from v2.5.1 (released on 05 Jul 2012) upwards. Versions of test-unit from the Ruby v1.8 standard library are no longer supported.</li>
  
Versions of minitest from v3.3.0 (released on 27 Jul 2012) upwards.</li>
</ul>

Acknowledgements</h2>

Many thanks to the following:</p>


  Nick Koh</a> for all his hard work on the strict keyword argument matching functionality.</li>
  
Paul Battley</a> and Murray Steele</a> for testing preview releases of Mocha v2 on sizeable codebases.</li>
  
Kelvin Gan</a>, Ollie Treend</a>, Dilwoar Hussain</a>, and the rest of the GDS</a> developer team for helping me test preview releases of Mocha v2 on the sizeable alphagov/whitehall</a> codebase.</li>
  
My Go Free Range</a> colleagues, Chris Lowis</a> and Chris Roos</a>, for funding a lot of my time working on Mocha, for reviewing code & documentation and for just generally being very supportive.</li>
</ul>


How to backup Google Drive to S3 using the AWS CDK
2022-05-18T17:27:00+00:00
Way back in the Before Time</a>, I did some work to automate a couple of our recurring manual Harmonia</a> tasks. One of these was the task to back up our shared Google Drive</a> to Amazon S3</a>. Prior to this we'd been running the rclone sync</code></a> command manually on one of our local machines. One significant downside of this was that we each needed to have a local copy of all the files (~17GB), so I was keen to come up with an automated solution running in the cloud.</p>

Unlike with our Trello backup</a>, it wasn't obvious to me how we could split the work up into tasks short enough to run as AWS Lambda</a> functions. Also, although it was interesting from an educational point-of-view, I felt as if the orchestration/coordination complexities introduced by splitting up the Trello backup tasks had been overly cumbersome. So I decided to explore the idea of spinning up some compute to execute a script in one go much more like how a cron job</a> would run on a traditional server.</p>

I was (and still am) enjoying using the AWS CDK</a> and so after a bit of research, I decided to use the ScheduledFargateTask</code></a> construct which is one of the higher-level patterns made available in the CDK. This construct meant that it was relatively straightfoward to spin up a container on Amazon Elastic Container Service (ECS)</a> at regular intervals and execute a shell script on that container.</p>

Scheduled Fargate Task</h2>

The task needed access to</strong> the internet, but there was no need for it to be accessible from</strong> the internet. I could've run it on a private subnet, but this would've meant I'd need either a NAT Gateway (expensive) or to run a NAT Instance on Amazon EC2</a> (maintenance/complexity overhead). Since the tasks only run for a few minutes every week I was willing to sacrifice the extra security provided by a private subnet in favour of a simpler/cheaper system where the tasks run on a public subnet.</p>

However, at that point ScheduledFargateTask</code> only ran if its VPC had a private subnet - if there was no private subnet available, an error was reported. So I decided to take the opportunity to contribute to the AWS CDK project and opened a pull request to allow ECS tasks to run on a public subnet</a> which was released in v1.29.0</a>. I really enjoy contributing to open-source projects like this - it's a really good way to get a deeper understanding of how it all works.</p>

Having incorporated that change, I used ecs.ContainerImage.fromAsset</code></a> to define the container image using a local Dockerfile</code></a>. This installs rclone</code> on an Ubuntu base image and copies a backup script</a> and associated rclone configuration</a> files into the home directory. This means you need the Docker CLI</a> available locally when you run cdk deploy</code> so it can build the container image and push it up to Amazon Elastic Container Registry</a> ready for use by ECS.</p>

It turned out that using the rclone sync</code> command on a Google Drive folder containing so much data needs quite a bit of CPU and memory, but it was easy to increase this from the default of ¼vCPU & ½GB to 4vCPU & 16GB</a> so that the command ran very quickly. Even though this is pretty beefy, given that it only runs for a few minutes once a week, the cost is negligible.</p>

The task is scheduled using the CronOptions</code></a> interface. Configuration is supplied to the container via environment variables using dotenv</a>. Credentials for Google Drive are supplied via Secrets Manager</a>. Those for the S3 bucket are made available via the IAM role assigned to the ECS Task and used by rclone</code> with the env_auth</code></a> option set to true</code>.</p>

The task is monitored with the excellent Healthchecks</a> service which we were already using for the Trello backup. This is effectively a dead man's switch</a> which alerts us if the script doesn't complete successfully at a given frequency and within a defined grace period.</p>

Reflections</h2>

Two years on, I'm really happy how this turned out. Once I'd got the backup running successfully, we've only had one failure which was due to a recent change to the Google Drive API requiring a newer version of rclone</code>. This meant I had to dive back into the code again to fix it, but I found it pretty easy to find my way around again partly because there's not actually very much code!</p>

The source code for the whole CDK project is available on GitHub</a>.</p>


Youtube video of my 3D maze game for the ZX Spectrum
2021-01-23T21:32:00+00:00
</p>

I recently stumbled across a quirky Youtube video</a> which piqued my interest. In the video James O'Grady</a> demonstrated a 3D maze game. He'd typed in the code for the game from a familiar-sounding book called Graphic Adventures for the Spectrum 48K</a>.</p>

The nominal author of this book, Richard Hurley, was one of my teachers and he included programs written by me and a number of my friends. The 3D maze game was one I wrote in about 1984 when I was 16. In the video James goes on to critique the game, to explore some ways to improve it, and to read some reviews of the book from magazines of the time.</p>

In my early teens I played a lot of games on the ZX81 and then the Spectrum, but as I got older I became bored of playing the games and more interested in writing them. I learnt a lot about programming games from typing in code from magazines and books.</p>

The first games I developed were written entirely in Sinclair BASIC</a>, e.g. Sub Hunt</a> which was published in an earlier book</a>, but I quickly realised I would need to use machine code to get the performance I wanted. Initially I wrote small bits of machine code to speed up critical bits of the games. However, the 3D Maze game in the video was the first game I wrote pretty much entirely in Z80 machine code using the excellent Zeus assembler</a> and with my trusty copy of The Complete Spectrum ROM Disassembly</a>. It was closely based on the "3D Monster Maze" game by J.K. Greye Software.</p>

The ZX81 original</h3>


  </iframe>
</div>


  
    Most importantly, from the point of view of video game history, the ZX81 was the computer which hosted the world's first ever 3D game on a home computer - JK Greye's 3D Monster Maze. A simple labyrinth is generated, and the player has to find their way out, all the while being stalked by a Tyrannosaurus Rex. The whole experience was rendered in what is now referred to as 'first person' view - ie, you see what you would see out of the eyes of the character in the maze, as pictured in the ZX81's rather blocky but still effective graphics. A quick play of this game on an emulator is recommended to all fans of Doom, Quake, Unreal, Half Life and all the other FPSs which are now so popular, as it really is the literal grandaddy of them all. It is difficult now to describe the impact this game had on a public who had quite literally never seen anything like it.
    –
    
      The Hitchhiker's Guide to the Galaxy (Earth Edition): The Wonderful Computers of Clive Sinclair</a>
    </cite>
  </p>
</blockquote>

My version</h3>

One slight disappointment was that unlike in "3D Monster Maze" there was no "monster" in my version of the game or at least not in the version James was playing. I know that I did eventually add a Tyrannosaurus Rex to the game, but I vaguely remember having to rush for a publication deadline, so the monster might've have missed the cut! If I recall correctly, a friend with better artistic skills than me drew a T Rex in a series of "frames" walking towards the observer. I then traced the drawings onto graph paper and converted them into user-defined graphic characters</a>. I do half wonder whether these might be the mystery bytes which James refers to at one point in his video. Otherwise I believe the program uses calls to the ROM, e.g. this line-drawing subroutine</a>, to draw the walls of the maze.</p>


  </iframe>
</div>

The Youtube video</h3>

James must've been incredibly patient to type in all the raw numbers for the machine code with only very rudimentary checksums. And, given that the game is written entirely in machine code and the assembler source code is lost in the mists of time, I was impressed that James managed to successfully modify the game in a couple of different ways using a load of judicious PEEK</code>s and POKE</code>s</a> and apparently without the use of a disassembler. In particular he's written a nice maze editor program which runs on the Spectrum and allows you to design your own maze. I was quite amused to learn that the maze had to be square - I can't imagine it would've been much harder for me to have allowed rectangular ones!</p>

James is very fair in his criticisms of the game - his main observation is that it's not very interesting to play, but it is very fast compared to other similar games. I also enjoyed reading the reviews of the book he'd found in a couple of magazines of the time. I had a lovely exchange with him in the Youtube comments</a> and he changed the title</a> of the Youtube video to include my name which was a nice gesture. Anyway, this was a brilliant trip down memory lane for me and reminded me of my programming roots!</p>

Playing the game</h3>

If you feel as if you want the full "type it in" experience, the Portuguese (!) version of the book is available for download</a> from Spectrum Computing</a> and you can find the game in "Labirinto" (chapter 4, page 105). Otherwise, this GitHub repo</a> includes a set of TAP format</a> files which might work in a Spectrum emulator, although I haven't yet had a chance to try them myself.</p>


Using Lambda@Edge with CloudFront to configure redirect rules for domains
2021-01-17T16:38:00+00:00
I'm a big fan of cool URLs</a> and not breaking the internet</a> and so over the years I've accumulated a few domains for which I've implemented a lot of redirect rules. In recent years I've implemented these rules using mod_rewrite</a> and run them on Apache</a> and on my Linode</a> VPS, e.g. the redirect rules for blog.floehopper.org</code></a>.</p>

However, in September 2019 I started publishing this website on GitHub Pages</a> and over the intervening period I've removed pretty much everything else I was running on that VPS. And so I'd started thinking it would be nice to shutdown the VPS and stop paying for it! The legacy redirects mentioned above were the only things preventing me from doing this.</p>

In the last 18 months I've used the AWS CDK</a> quite a bit both at work and for personal projects. Unfortunately I've only got round to publishing one article about it</a> (something I hope to remedy in the not too distant future). Anyway, I'd read a bit about Lambda@Edge</a> and noticed that it was indeed supported by CloudFormation</a> and the AWS CDK, so I thought I'd give it a whirl.</p>

My basic idea was to create a CloudFront distribution</a>, associate a custom domain with it, configure an Edge Lambda function</a> to handle all requests to that distribution and implement the appropriate redirects in JavaScript, then point the relevant DNS records at the CloudFront distribution.
This turned out to be pretty straightforward, although I did have to use the AWS Certificate Manager</a> to create an SSL certificate</a> for the domain to get everything to work.</p>

You can find the full project source code on GitHub</a>. I'm afraid I haven't yet got round to updating the README from the default version generated by the AWS CDK. If you prefer, here's a slightly cut down version of a couple of key project files illustrating how I did this for the blog.floehopper.org</code> domain:</p>

  
    # file: lib/edge-redirector-stack.ts

    import * as cdk from '@aws-cdk/core';
    import * as lambda from '@aws-cdk/aws-lambda';
    import * as cloudfront from '@aws-cdk/aws-cloudfront';
    import * as origins from '@aws-cdk/aws-cloudfront-origins';
    import * as acm from '@aws-cdk/aws-certificatemanager';

    export class EdgeRedirectorStack extends cdk.Stack {
      constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
        super(scope, id, props);

        this.createDistribution('blog.floehopper.org', 'blogFloehopperOrg', 'arn:aws:acm:us-east-1:687105911108:certificate/aa11ee5a-54db-4a04-8307-f77330f86cb5');
      }

      createDistribution(domain: string, handler: string, certificateArn: string) {
        const certificate = acm.Certificate.fromCertificateArn(this, `${handler}Certificate`, certificateArn);
        new cloudfront.Distribution(this, `${handler}Distribution`, {
          defaultBehavior: {
            origin: new origins.HttpOrigin('example.com'),
            edgeLambdas: [
              {
                eventType: cloudfront.LambdaEdgeEventType.VIEWER_REQUEST,
                functionVersion: this.redirectVersion(domain, handler)
              }
            ]
          },
          domainNames: [domain],
          certificate: certificate,
          enableLogging: true
        });
      }

      redirectVersion(domain: string, handler: string) : lambda.IVersion {
        const redirectFunction = new cloudfront.experimental.EdgeFunction(this, `${handler}Redirect`, {
          runtime: lambda.Runtime.NODEJS_12_X,
          handler: `${handler}.handler`,
          code: lambda.Code.fromAsset('./lambdaFunctions/redirect')
        });

        return redirectFunction.currentVersion;
      }
    }
  </code>
</pre>

  
    # file: lambdaFunctions/redirect/blogFloehopperOrg.js

    'use strict';

    exports.handler = function(event, context, callback) {
      const request = event.Records[0].cf.request;

      const mapping = [
        // Legacy Typo-style articles
        ['^/articles/([0-9]{4})/([0-9]{2})/([0-9]{2})/(.+)$', (m) => `http://jamesmead.org/blog/${m[1]}-${m[2]}-${m[3]}-${m[4]}`],

        // Redirect blog.floehopper.org -> jamesmead.org
        ['^/(.*)$', (m) => `http://jamesmead.org/${m[1]}`],
        ['^$', (m) => `http://jamesmead.org`],
    ];

      let redirectUrl;
      for (const [pattern, url] of mapping) {
        const match = request.uri.match(new RegExp(pattern));
        if (match) {
          if (typeof(url) == 'function') {
            redirectUrl = url(match);
          } else {
            redirectUrl = url;
          };
          break;
        };
      };

      let response;

      if (redirectUrl) {
        response = {
          status: '301',
          statusDescription: 'Moved Permanently',
          headers: {
            location: [{
              key: 'Location',
              value: redirectUrl
            }],
          }
        };
      } else {
        response = {
          status: '404',
          statusDescription: 'Not Found'
        };
      };

      callback(null, response);
    };
  </code>
</pre>


Multiple Rails development environments using nix-shell
2020-11-29T12:21:00+00:00
I've continued to make slow but steady progress with my experiment to setup Rails development environments using nix-shell on a Vagrant VM running Ubuntu. I've now got to the stage where I have four Rails apps using combinations of Ruby versions, Rails versions, PostgreSQL versions, and MySQL versions which I'm pretty happy about!</p>


  Ruby v2.5, Rails v5.2.4.4, PostgreSQL v10</li>
  
Ruby v2.5, Rails v5.2.4.4, MySQL v5.7</li>
  
Ruby v2.6, Rails v6.0.3.4, PostgreSQL v11</li>
  Ruby v2.6, Rails v6.0.3.4, MySQL v8.0</li>
</ul>

</p>

I've continued to use bash scripts as Vagrant provisioners to do this in a reproducible way, although the code</a> is currently a bit messier than I would like.</p>

Creating the Rails apps</h3>

I've improved the way that rails new</code> is run so that it works correctly for different versions of Ruby. The new approach closely based on this answer</a> to a question I asked on the NixOS forums.</p>

Some of the complications around having a suitable environment to run rails new</code> for a particular version of Ruby and of Rails has reminded me that I don't have a particularly good solution for this in my current non-Nix MacOS setup.</p>

In fact I tend to do something analagous to what I've done with Nix, i.e. I use rbenv</code> to switch to the relevant version of Ruby, create a Gemfile</code> containing just a reference to the version of the Rails gem that I want, run bundle install</code> and then rails new</code>. I'd be interested to hear if anyone has a better/simpler way of doing this.</p>

At this point, it's probably instructive to show you the relevant files for one of the four Rails apps. A bundler.nix</code> is used only to run bundle lock</code> to generate Gemfile.lock</code>. Previously I had been using bundix</code> itself to generate Gemfile.lock</code>, but I couldn't work out how to do this for different versions of Ruby.</p>

# Gemfile
source 'https://rubygems.org'
gem 'rails', '= 6.0.3.4'

# bundler.nix
with (import <nixpkgs> {});
let
  myBundler = bundler.override { ruby = ruby_2_6; };
in
mkShell {
  name = "bundler-shell";
  buildInputs = [ myBundler ];
}
</code></pre>

A shell.nix</code> is used to run bundix</code> to generate a gemset.nix</code> and to run rails new</code> using this gemset.</p>

# shell.nix
with (import <nixpkgs> {});
let
  env = bundlerEnv {
    name = "ruby2.6-rails6.0.3.4-mysql8.0";
    ruby = ruby_2_6;
    gemdir = ./.;
  };
in mkShell { buildInputs = [ env env.wrappedRuby ]; }
</code></pre>

Inside the rails app directory there's another bundler.nix</code> (exactly the same as the one above) which is again only used to run bundle lock</code> and another shell.nix</code> which is used both to run bundix</code> and to provide the actual development environment including all the relevant dependencies:</p>

# shell.nix
with (import <nixpkgs> {});
let
  env = bundlerEnv {
    name = "ruby2.6-rails6.0.3.4-mysql8.0";
    ruby = ruby_2_6;
    gemdir = ./.;
  };
in mkShell {
  buildInputs = [ env env.wrappedRuby nodejs yarn mysql80 ];
}
</code></pre>

One other thing I had to deal with to handle Rails v5 was to run rails yarn:install</code> instead of rails webpacker:install</code> for Rails v6 when initally setting up the app.</p>

Setting up databases</h3>

I've added a shellHook</a> to the development environment shell.nix</code> to configure and run an instance of a database server for each Rails app. I'm now less sure that configuring and running a database on entering the nix-shell is very sensible. I suspect it might make more sense to have a separate script to do this.</p>

This time I've made a couple of changes to improve the level of isolation between the apps. Firstly I've configured each database to store their data in a Rails app sub-directory rather than in a global location. And secondly I've configured each database to only accept connections via a unix domain socket</a> also stored in a Rails app sub-directory.</p>

I managed to achieve the former by moving the Rails apps under the Vagrant user's home directory. This avoided the problem I had previously with hard links in a VirtualBox shared directory. Although this means the Rails app source code is not available from the guest OS, that seems like just a temporary inconvenience since I'm only using the Vagrant VM to simulate a fresh machine. Eventually my aim is to run Nix natively and not use Vagrant at all.</p>

I'm particularly pleased with the unix domain socket solution, because it means there's no need to identify an unused port for each Rails app to connect over TCP/IP. Here's the shellHook code for PostgreSQL and MySQL databases:</p>

PostgreSQL</h4>

export PGHOST=/home/vagrant/ruby2.6-rails6.0.3.4-postgres11/tmp/postgres
export PGDATA=$PGHOST/data
export PGDATABASE=postgres
export PGLOG=$PGHOST/postgres.log

mkdir -p $PGHOST

if [ ! -d $PGDATA ]; then
  initdb --auth=trust --no-locale --encoding=UTF8
fi

if ! pg_ctl status
then
  pg_ctl start -l $PGLOG -o "--unix_socket_directories='$PGHOST' --listen_addresses='''"
fi
</code></pre>

MySQL</h4>

MYSQL_HOME=/home/vagrant/ruby2.6-rails6.0.3.4-mysql8.0/tmp/mysql
MYSQL_DATA=$MYSQL_HOME/data
export MYSQL_UNIX_PORT=$MYSQL_HOME/mysql.sock

mkdir -p $MYSQL_HOME

if [ ! -d $MYSQL_DATA ]; then
  mysqld --initialize-insecure --datadir=$MYSQL_DATA
fi

if ! mysqladmin status --user=root
then
  mysqld_safe --datadir=$MYSQL_DATA --skip-networking &
  while ! mysqladmin status --user=root; do
    sleep 1
  done
fi
</code></pre>

I'm definitely no expert on setting up databases, so if you can suggest any improvements, I'd love to hear from you!</p>

Summary</h3>

I'm pretty happy with where I've got to. It's starting to feel as if I have a solid basis for using Nix to create decent isolated development environments using various versions of Ruby, Rails, PostgreSQL & MySQL on the same machine.</p>

One nice side-benefit is the way dependencies on OS package are made more explicit. And I don't think it would take much more work to have reproducible configurations to share with other developers and/or for use in continuous integration and/or deployments.</p>

As usual the source code is available in a GitHub repository</a> and there are instructions on how to run it yourself in the README</a>.</p>

Next steps</h3>


  
    Come up with a better way to manage each database instance, i.e. not in a shellHook - either using a separate script (or possibly using systemd</a>?).</p>
  </li>
  

    Use specific patch versions of Ruby or minor versions of Ruby not available in the current set of nix packages. I'm pretty confident this is possible by pinning the version of nix packages</a> or it might be worth investigating nix flakes</a>.</p>
  </li>
  

    Use specific versions of Bundler. I haven't really looked into this at all yet, because I'm not sure it's a deal-breaker.</p>
  </li>
  

    Investigate how hard it is to upgrade a gem in one of these Rails apps, i.e. regenerating the Gemfile.lock</code> and gemset.nix</code> files.</p>
  </li>
  

    Investigate using direnv in conjunction with nix</a> or lorri</a> to seamlessly move between different Rails app directories without having to explicitly enter/exit the relevant nix-shell.</p>
  </li>
  

    Investigate using Nix to somehow make Node packages available to the environment in a similar way to Bundix instead of using Yarn directly, i.e. also automatically installing any OS package dependencies.</p>
  </li>
  

    Investigate using Nix home-manager</a> or custom scripting to make it easy to be able to run rails new</code> for a specified version of Ruby and Rails.</p>
  </li>
</ul>

Further reading</h3>


  This is the third article in a series:
    
      A simple Rails development environment using nix-shell</a></li>
      
Generating and running a Rails app with PostgreSQL using Nix on Ubuntu</a></li>
    </ol>
  </li>
  

    Lightning Introduction to Nix for Developers</a> by Robin Schroer.</p>
  </li>
  

    An introduction to nix-shell</a> by Mattia Gheda.</p>
  </li>
  

    Easy Reproducible Development Environments with Nix and direnv</a> by Tom Feron.</p>
  </li>
  

    Nix package versions</a> by Marcelo Lazaroni. Find all versions of a package that were available in a channel and the revision you can download it from.</p>
  </li>
  
Man pages for Nix command line tools</a>.</li>
</ul>


Automatically sending Webmentions from a static website
2020-10-13T08:29:00+00:00
A few months back I wrote about indieweb-ifying this website</a>. I attempted to follow the excellent indiewebify.me guide</a>, but I skipped step 2 of Level 2, i.e. adding the ability to send Webmentions to other IndieWeb sites</a>. My excuse</a> at the time was:</p>


  I decided to skip this step for now given that it's relatively easy to send a Webmention manually using curl</code></a> and it's not as if I currently blog that frequently!</p>
</blockquote>

Anyway a couple of recent discoveries led me to fix this omission…</p>

webmention.app</h3>

This lovely little service</a> built by Remy Sharp</a>, not to be confused with webmention.io</a> which is used for receiving</em> incoming Webmentions</a>, makes it easy to send</em> outgoing webmentions for all the links on a given page:</p>


  This is a platform agnostic service that will check a given URL for links to other sites, discover if they support webmentions, then send a webmention to the target.</p>
</blockquote>

Fortunately I still have an RSS feed</a> for my blog and in this case the documentation suggests using IFTTT</a> to automate doing this each time you publish an article.</p>

Actionsflow</h3>

Somewhat serendipitously I recently came across Actionsflow</a> which is a free Zapier/IFTTT alternative for developers to automate workflows based on GitHub Actions.</p>

I have to admit that I was initially quite confused by the Actionsflow documentation and I tried to add my Webmention-sending workflow to the repo for this website</a>. However, once I realised the idea was to create a new repo</a> based on a template, things became a little clearer.</p>

Workflow to send Webmentions</h3>

I created this repo</a> and added this workflow</a> to poll my RSS feed and send an HTTP POST request to the webmention.app API for every new item. I was pleasantly surprised by how simple this was:</p>

name: Send webmentions for new blog posts
on:
  rss:
    url: https://feeds.jamesmead.org/floehopper-blog
    config:
      logLevel: debug
      limit: 1
jobs:
  send_webmentions:
    name: Send webmentions
    runs-on: ubuntu-latest
    steps:
      - name: 'Send webmentions for RSS item link'
        uses: actionsflow/axios@v1
        with:
          url: https://webmention.app/check/
          method: 'POST'
          params: '{ "url": "${{on.rss.outputs.link}}", "token": "${{ secrets.WM_TOKEN }}" }'
          is_debug: true
</code></pre>

It took me a while to realise that the underlying Actionsflow GitHub Action was running every 5 minutes and polling</em> my RSS feed. It seems to use the GitHub Action cache to "remember" which items it has seen before. Since I don't publish blog posts very often, polling every 5 minutes seemed a bit excessive and so I decided to reduce the frequency to hourly</a>.</p>

Observations</h3>


  
    I'm not sure I like the design of Actionsflow which means creating a new repo, but perhaps this would make more sense to me if I had more than one workflow. I suppose this repo is roughly equivalent to a single IFTTT account.</p>
  </li>
  
    Over the course of the last year I've automated some backup jobs for Go Free Range</a> using the ScheduledFargateTask</code> class</a> in the AWS CDK</a> to fire up a container and run a script on a cron schedule. This has worked really well, but it's quite tempting to port these over to Actionsflow so we don't have to maintain anything other than the Dockerfile</code> and associated shell scripts.</p>
  </li>
  

    webmention.app is really nicely implemented with good documentation; it's a classic example of an elegant solution to a tightly scoped problem. Since I'll be making use of the API on a regular basis, I decided to buy Remy a drink</a> to say thank you!</p>
  </li>
  

    I'd also like to find a way to say thank you to Aaron Parecki</a> who built webmention.io and Ryan Barrett</a>, Kyle Mahan</a>, et al who built brid.gy</a>. However, I can't see a way to do either and, indeed, the latter explicitly say</a> "We don't need donations, promise."</p>
  </li>
</ul>

Blog - James Mead

Organisation-specific git authentication and commit signing

1Password configuration</h2> Using these instructions</a>:</p> Generate an Ed25519</a> SSH key for organisation 1</li> Generate an Ed25519</a> SSH key for organisation 2</li> </ul> And then download the public key for each to:</p> ~/.ssh/github-organisation-1.pub</code></li>

GitHub configuration</h2>

SSH configuration</h2> Configure ssh to use 1Password as its agent. And list allowed signers for each organisation to be used as allowedSignersFile</code>.</p>

Git configuration</h2>

Adding human.json to my website

Configuring Zed editor to use HTML Beautifier as a formatter in ERB templates

Configuring Zed editor to use ERB Lint as a formatter

Mocha v2 release

Example with strict matching</h3> With strict matching enabled, the parameters no longer match the expectation and the test fails. This test failure highlights that Example#foo</code> must be called with a set of keyword arguments.</p>

Removal of deprecated functionality</h2> A bunch of deprecated functionality has been removed in Mocha v2. As long as you've previously upgraded to Mocha v1.16.0 and fixed all the deprecation warnings you shouldn't have any trouble.🤞</p>

Acknowledgements</h2> Many thanks to the following:</p>

How to backup Google Drive to S3 using the AWS CDK

Youtube video of my 3D maze game for the ZX Spectrum

Using Lambda@Edge with CloudFront to configure redirect rules for domains

Multiple Rails development environments using nix-shell

Automatically sending Webmentions from a static website