That project is underrated.

I have built my agent harness around smolvm and it has been working wonderfully.

I have seen a single bug up to now (iirc you cannot take a snapshot from a machine you rehydrate from a pack) but found a workaround.

I think the only thing I would love a solution for is the ability to bind credentials even when you use tailscale. You cannot right now because the traffic goes through the tailscale interface.

Anyway. smolvm is simply amazing.

The answer from them : we are unimpressed by world politics.

Man… they are on my short list now.

Lot’s of ISP have moved to CGNAT where port forwarding has become a nightmare. That’s one reason. You can look at it as if your router moved from your home behind a public CGNAT, dynamic, shared IP to a public non-shared, static, stable IP on the internet.

In a workplace setting, connecting to your residential IP will raise suspicions or alarms. That being said, if you go for a cheap VPS, it also might raise alarms. Maybe your 'VPS' should be with whichever cloud provider your employer goes with so you don’t even register as a blip.

It is added complexity, but it is really very simple. Using Wireguard, you connect from a always on server in your home to your VPS. Then, using Wireguard, you configure your laptop to always connect to your VPS. Any local LLM can generate the wg-quick config files in seconds.

Also, not opening a port has become a security checkbox. If your home router isn’t a hardened Linux box, why would you prefer to let a ASUS 'WiFi Router' handle that critical networking function instead of a Linux box you can easily update and audit?

DPI immediately can tell it is ssh.

Connect from your home to a public VPS and connect your public devices to that VPS.

I really liked it. I like the idea of embedding firewall rules in a certificate.

But , like you observed, it does not scale as well as tailscale.

{tail,head}scale is the best there is for wireguard at more than 3 nodes.

Wireguard is the building block for higher level tools like Tailscale to build on.

I understand port 443 is always opened but nowadays you can’t just run ssh traffic on 443 without it being detected as not being https

My boss would never dream asking I crank more because I now have AI help.

That guy saying there were only two possible outcomes doesn’t know about the beauty of unions.

There’s a lot of yous…

That person was then politely told to rtfa and given more substance than they thought was in there.

And what did you do?

That’s quite ironic.

I think this bill is absolutely horrible.

What do you want me to do?

But I am not sure I will stick with gpg though.

Even with my system to extend their expiration or renew them. I have found handling them to be a pain.

I use them for 2 things: encrypt/decrypt gopass secrets and sign git commits.

Gopass now has more than decent age support. A yubikey can hold an age key.

Most git forges accept a ssh key to sign commits. A yubikey can hold a ssh key.

So, for my needs, I think I could leave the operational complexities (to me) of gpg and go for alternatives that are simpler.