Shun's org notes

Rust devshell on macOS

Sat, 29 Aug 2026 00:00:00 +0000

When I develop something, I want a devshell that needs nothing but Nix: no Xcode Command Line Tools, no homebrew, no impure global state. Here's my setup for Rust with fenix:

devshells.default = {
  packages =
    with pkgs;
    [
      # ...
      clang
      inputs'.fenix.packages.stable.toolchain
      # ...
    ];

  env = lib.optionals pkgs.stdenv.isDarwin [
    # Without Xcode, clang can't find the macOS SDK, so get it from nixpkgs
    {
      name = "SDKROOT";
      value = pkgs.apple-sdk_26;
    }
    # Some crates (e.g. aws-lc-sys) need -liconv at link time
    {
      name = "LIBRARY_PATH";
      value = "${pkgs.libiconv}/lib";
    }
  ];
};

magit forge auth: gh token in pass

Fri, 28 Aug 2026 00:00:00 +0000

Forge gives you PRs, issues, and code reviews inside Magit, but it needs a GitHub token to hit the API. I don't like either of the stock options:

(Recommended by Forge) Classic tokens are repo-wide at best and account-wide at worst, and a lot of orgs ban them outright.
Fine-grained tokens are scoped per-owner, so I'd need separate tokens for each org, plus a way to switch between them in Forge.

The gh CLI already solved the hard part of auth: browser-based OAuth with device flow, SSO included. I don't want to reinvent that, so my (slightly cursed) approach is: let gh do the heavy-lifting, then capture the token, and stash it in password-store (pass):

#!/usr/bin/env bash

tmp=$(mktemp -d)

trap 'rm -rf $tmp' EXIT

export GH_CONFIG_DIR=$tmp

# --insecure-storage stores the token as plaintext in GH_CONFIG_DIR instead
# of the native keychain. I don't want to pollute the global state, and the
# token is persisted in pass.
gh auth login --web --insecure-storage --git-protocol ssh --skip-ssh-key --clipboard

token=$(gh auth token)

<<<"$token" pass insert -mf "ApiKeys/GH_TOKEN"

Now Emacs reads it back out, using auth-source's native pass support. Forge's API client, ghub, asks for a token, and I override ghub--token to pull it from pass:

;; Enable pass for auth-source
(auth-source-pass-enable)

(use-package forge
  :after magit
  :config
  (advice-add 'ghub--token :override
              (lambda (&rest _)
                (string-trim (auth-source-pass-get 'secret "ApiKeys/GH_TOKEN")))))

ghq 🤝 project.el

Tue, 18 Aug 2026 00:00:00 +0000

I use ghq for remote repository management, and I make it integrate with project.el's project switcher (C-x p p) like this:

(use-package
  project
  :config
  ;; Populate the project switcher list from `ghq`
  (dolist
    (project
      (split-string (shell-command-to-string "ghq list --full-path")
        "\n"
        t))
    (project--remember-dir (file-name-as-directory project)))

(macOS) Suppress annoying `xcrun` popup

Fri, 14 Aug 2026 00:00:00 +0000

macOS puts a stub at /usr/bin/python3 (and friends) that shells out to xcrun to find the real binary. If Xcode Command Line Tools aren't installed, this triggers an annoying GUI popup - which I really don't want since I manage everything through Nix devShells and avoid impure global installs.

I looked at the manpage, and found that xcrun respects the envvar DEVELOPER_DIR, and wondered if pointing this envvar to a stub xcrun could suppress the popup.

let
# Suppress annoying `xcrun` popups
stubDeveloperDir = "${pkgs.linkFarm "stub-developer-dir" [
    {
      name = "usr/bin/xcrun";
      path = pkgs.writeShellScript "stub-xcrun" ''
        >&2 echo "$1: command not found"
        exit 127
      '';
    }
  ]}";
in
...
environment = {
  shells = [ pkgs.bash ];
  variables = {
    DEVELOPER_DIR = stubDeveloperDir;
  };
};
launchd.user.envVariables = {
  DEVELOPER_DIR = stubDeveloperDir;
};

And voila!

$ python3
python3: command not found

Learning Emacs & Nix

Wed, 05 Aug 2026 00:00:00 +0000

Very helpful tutorials that helped me get started:

(macOS) Manage display resolution via CLI

Fri, 31 Jul 2026 00:00:00 +0000

There seem to be no official way to change display resolution from the cli on macOS, but p00ya/displaymode worked really well for me. I've fixed few stuffs & Nixified it, so feel free to try it out:

nix run github:shunueda/monorepo#displaymode

I put this in Home Manager's activation:

home = {
  activation = {
    # Darwin-specific activation script
    darwin = lib.mkIf pkgs.stdenv.hostPlatform.isDarwin (
      lib.hm.dag.entryAfter [ "writeBoundary" ] ''
        # Set display resolution, mine is 14-inch.
        ${lib.getExe pkgs.displaymode} t 1800 1169
      ''
    );
  };
};

p00ya/displaymode is licensed under the Apache-2.0 license.

TIL: Sieve (mail filtering language)

Tue, 21 Jul 2026 00:00:00 +0000

I use Fastmail for my emails, and today I found that you can set a custom mail filtering rule using language called Sieve.

Apparently there is also a protocol to manage Sieve script, but Fastmail doesn't support it :( I thought of writing a Just script or a Terraform provider, but too bad.

However: Fastmail supports JMAP API (!) so if I really wanted to, I can use SieveScript/set - but I'm too lazy. JMAP is crazytown.

Side note, Fastmail is awesome. Highly recommend.

histsync: sync shell history with pass

Thu, 16 Jul 2026 00:00:00 +0000

Atuin is super cool: it let's you sync shell history across machine, but few issues for me:

Requires a server. I distrust managed public servers and don't want to host my own.
Heavy LLM usage for development. I have nothing against LLMs but I try to avoid them.

I use password-store (pass), so why don't I leverage this:

bash = {
  enable = true;
  # ...
  initExtra = ''
    histsync() {
      # Append currently history to HISTFILE
      history -a

      # Entry name in pass - I separate history by host
      local passentry="ShellHistories/$HOSTNAME"

      # Merge HISTFILE and pass entries, remove duplicates, update HISTFILE
      (cat "$HISTFILE" 2>/dev/null; pass show "$passentry" 2>/dev/null) |
        awk '!a[$0]++' |
        ${pkgs.moreutils}/bin/sponge "$HISTFILE"

      # Update pass entry with the merged history
      <"$HISTFILE" pass insert -mf "$passentry"

      # Reload history for current session
      history -c
      history -r
    }

    # ...
  '';
};

Note: the merge logic will not work if you use timestamps.

Does anyone find Google's AI search useful?

Mon, 06 Jul 2026 00:00:00 +0000

I've never found Google's "AI Overview" particularly helpful. It's been more distracting than useful, and worse still, there seems to be no way to turn it off.

Since then, I've switched to DuckDuckGo's “No AI” search at https://noai.duckduckgo.com/, and that has worked well for me.

Here's how to configure it in Home Manager. I use Librewolf, but this should work the same way in Firefox:

librewolf = {
  enable = true;
  policies = {
    GenerativeAI.Enabled = false; # Bonus: turn off other Firefox AI features
  };
  profiles. = {
    search = {
      force = true;
      default = "ddg-noai";
      engines = {
        "ddg-noai" = {
          urls = [
            {
              template = "https://noai.duckduckgo.com/";
              params = [ (lib.nameValuePair "q" "{searchTerms}") ];
            }
          ];
          definedAliases = [ "@noai" ];
        };
      };
    };
    ...
  };
...
};

password-store: nerd snipe quagmire

Thu, 02 Jul 2026 00:00:00 +0000

I've been using Apple's Passwords.app, but password-store (pass) seemed very cool, and since I already did the heavy-lifting of setting up the YubiKey, I decided to migrate.

Another reason that convinced me: Emacs supports pass as an auth-source natively! Here is a sample:

(auth-source-pass-enable)

(auth-source-pass-get 'secret "foo/bar")

You can also use password-store.el to interact with pass via Emacs.

Setting up my YubiKey

Fri, 26 Jun 2026 00:00:00 +0000

To manage my GPG key, I set up my YubiKey (5C NFC). This guide was extremely helpful: https://github.com/drduh/YubiKey-Guide.

One note: if you're using ed25519 for your signing key, make sure to set KEY_TYPE=cv25519 before creating the encryption (E) subkey - GPG will complain otherwise.

Using S3 as a Nix cache

Sat, 20 Jun 2026 00:00:00 +0000

Cachix is too expensive so I use S3 (well, technically Cloudflare R2 because it's S3-compatible and egress-free) as a Nix cache, with a following script:

#!/usr/bin/env bash

set -euo pipefail

signkey=$(mktemp)

trap 'rm -f $signkey' EXIT

echo "$NIX_CACHE_SIGNING_KEY" >"$signkey"

nix store sign --key-file "$signkey" --all

nix path-info --all |
  grep -v -E '\.(drv|check|drv\.chroot|lock)$' |
  xargs -n 50 -P 8 sudo -i nix copy --to "$NIX_CACHE_SUBSTITUTER"

Intended for use in CI. Signs everything is the store, filters things we're interested in, and nix copy (in chunks to avoid command being too long) to the backend. Pretty straight forward but works well for me.

Side note: if you're using S3 as a Nix store, check this out: anteriorcore/terraform-aws-s3-nix-lru-cache. It uses S3 access logs to GC. Pretty neat.