Personal site. Writing lives under posts.
go-authzen: a Go library for the OpenID AuthZEN wire protocol
OpenID AuthZEN 1.0 went Final on 2026-01-11. It’s a small, focused spec: the wire protocol between a Policy Enforcement Point (the bit of your app that asks “can this user do this?”) and a Policy Decision Point (the bit that answers). Four endpoint families — a single evaluation, a batch evaluations call, and three “search” variants (which subjects can do this? which resources can this subject touch? which actions can this subject perform?) — plus a /.well-known/authzen-configuration metadata document. That’s the whole surface. ...
plane-forge-bridge: bidirectional issue sync for Plane and Forgejo
Plane is a self-hostable project tracker — the open-source bit of it ships under AGPL and the company makes its money on a Commercial Edition plus a handful of paid integrations. Two of those paid integrations are the GitHub and GitLab connectors that keep issues and PRs in sync with your tracker. They live in a closed-source service called silo, distributed as a binary out of artifacts.plane.so and not present in the makeplane/plane repo at all. ...
fj-bellows: ephemeral cloud runners for Forgejo Actions
If you self-host Forgejo Actions today, your options for runners come down to three: Always-on VMs — fast job pickup, but you pay for idle CPU 24/7 and jobs share state. GitHub-hosted-style autoscaling fleets — solves the cost problem, but you usually reach for something Kubernetes-shaped to get there. Local runners installed alongside Forgejo itself — easy and free, but they share state between jobs, don’t isolate well, and your Forgejo box ends up doing CI work it shouldn’t. I wanted a fourth option for my own homelab: small enough to read in an afternoon, single-binary, one ephemeral cloud VM per job, and clever enough to fill the paid billing hour before tearing things down. So I wrote fj-bellows. ...