Linux on Tom Meurs

Talos Linux Vendor Lock-In: Five Questions, Run on My Own Nodes

Tue, 06 Oct 2026 09:00:00 +0200

TL;DR I ran the five questions from my licence post on the OS under my own cluster. The licence holds. The Talos Linux vendor lock-in sits in two defaults that point at Sidero’s servers, the BSL code Sidero keeps adding around the MPL core, and a company Yardi has owned since 14 September.

Linux Is for Everyone: Why This Blog Now Welcomes Beginners Too

Thu, 11 Jun 2026 20:28:00 +0100

My neighbour is 70 years old. He’s used Windows his whole life. Last month he asked me: “Tom, I keep hearing about Linux. Is that something for me too?”

He’s not the first. Over the past year I’ve had the same question from friends, family and colleagues, each in their own shape. “I want to get off Windows, but where do I start?” “Is Linux hard?” “Can I still use my normal programs?” To me these are easy questions. I’ve been running Linux since SuSE 6.0, back when you picked your hardware by whether a Linux driver existed for it. If you’ve never seen a terminal, they’re not easy at all.

KVM/QEMU Scripts and Aliases: Making Virtualization Actually Usable

Wed, 03 Jun 2026 21:17:00 +0100

I run VMs all day. A Kubernetes deployment I want to test, a distro I read about, Windows for that one stubborn application, an experiment I’d rather not run on my actual machine. KVM/QEMU is the right tool for all of it. It lives in the Linux kernel and runs close to native speed. Nothing in it phones home, and no vendor gets a say in what I do with my own hardware.

Quantum-safe GPG identity with multiple aliases

Sat, 18 Apr 2026 10:47:00 +0200

TL;DR One GPG masterkey that only certifies, kept offline. Three aliases bound to it, so anyone can check they’re the same person. Ed25519 subkeys for signing and SSH, an ML-KEM plus X448 subkey for encryption so recorded ciphertext stays closed after a quantum computer shows up, and three backups that each assume the other two are gone. Needs GnuPG 2.5.

A cryptographic signature still means exactly what it says. If the key is yours and the signature verifies, the content came from you. No vendor handed you that identity, no CA can pull it, no platform can suspend it. It exists because you generated the key, and it’s yours for as long as you hold the private half. Most of what gets called “online identity” is borrowed. A handle someone can ban, an email address the domain owner can take back the day they feel like it. A GPG signature sits outside all of that.

NixOS as a Hypervisor: KVM and QEMU Can Do Everything

Thu, 19 Mar 2026 21:52:00 +0100

TL;DR KVM and QEMU are the engine inside Proxmox and most of the cloud you rent. On NixOS, with libvirt on top, that engine is one block of config, and live migration, memory ballooning, GPU passthrough, SR-IOV and CPU pinning are each a command or an XML snippet away. What Proxmox adds is the dashboard and the delegation, and I’m honest below about how much that’s worth.

Ask around how to run a “real” hypervisor at home and you get the same shortlist. VMware, Hyper-V, or at minimum Proxmox. Something with a web UI, a clustering tab and a marketing page full of enterprise features. The shortlist is so well worn that running VMs without one of those products feels like cutting corners. I don’t blame anyone for that. The marketing is good.

NixOS vs Talos for Kubernetes Nodes: Two Flavors of Immutable Infrastructure

Sun, 15 Mar 2026 20:37:00 +0100

TL;DR Talos and NixOS are both declarative and both can be immutable, and that’s about where the resemblance stops. Talos runs Kubernetes and nothing else, with no shell to drift in. NixOS is a full Linux where the whole machine is one Nix config. I run Talos on my cluster nodes and NixOS on the machines around them, and this post is how I got to that split.

I’ve written about Talos Linux as the immutable Kubernetes OS, and I’ve compared Arch vs NixOS for workstations. After both, the same question kept arriving in my inbox. Why not NixOS on the Kubernetes nodes too?

Talos Linux: The Immutable Kubernetes OS That Changed How I Think About Nodes

Wed, 11 Mar 2026 21:15:00 +0100

TL;DR Talos Linux is a Linux that runs Kubernetes and nothing else. No SSH, no shell, no package manager. Every change goes through an API and a YAML file in Git. I’ve run my nodes on it for three years, and this post is how I stopped missing the shell.

The first time I tried to SSH into a Talos node, I got nothing. No shell, no connection, not even a login prompt. I sat there for a minute wondering how I was supposed to debug a machine I couldn’t get into.

Arch vs NixOS as a Workstation: Professional and Personal Use

Tue, 03 Mar 2026 21:28:00 +0100

TL;DR I’ve run Arch and NixOS as my daily machine, and today it’s Arch on both desktops and NixOS on the servers. Arch’s reputation for breaking is mostly a missing snapshot. With btrfs, Snapper, dotfiles in git and a package list, a rollback takes 2 minutes and the fear of updates goes away. NixOS earns its learning curve when several machines have to stay identical, and on a server I wouldn’t run anything else.

CTF and Forensics Skills That Make You a Better DevOps Engineer

Fri, 27 Feb 2026 19:52:00 +0100

TL;DR I spend my evenings on Hack The Box and it’s made me better at my day job, which is platform engineering and has nothing to do with pentesting. The first ten minutes on a CTF box and the first ten minutes on a broken production server are the same loop, with “flag” swapped for “incident”. Below is the toolkit that loop runs on, from one host up to a Kubernetes pod, with the CTF use and the work use side by side for every command.

Learn the Defaults: Why Portability Beats Customization

Sun, 15 Feb 2026 19:47:00 +0100

TL;DR I spent years polishing a vim and tmux setup, then sat useless in front of a stock vim on a production server. So I learned the defaults I’d been overriding all along, and moved my customizations on top of them instead of in place of them. What that looks like for vim, tmux and the shell tools, and the four checks I use to find the gaps.

For years my setup was the thing I was proudest of. A dotfiles repo with commits going back further than some of my jobs, a vim config that pulled in thirty plugins, the tmux prefix moved somewhere comfortable, a prompt that took a weekend to get right. Down to the last keybinding, it was mine. On my laptop I was fast, and I hardly thought about the tools at all. Muscle memory did the work.

Dotfile Management with mise and chezmoi: The Perfect Combo

Wed, 11 Feb 2026 20:23:00 +0100

TL;DR Six ways of syncing dotfiles later, the one I kept is chezmoi for the files and mise for the tool versions, with the mise config living inside the chezmoi repo. Templates handle the work laptop against the personal desktop, age handles the secrets, and a fresh machine is one command and about five minutes. The walk-through goes from one managed file to the bootstrap I run for real.

My .zshrc is older than some of my coworkers’ careers. Same for my .vimrc and my tmux config. They’ve grown into a setup that does exactly what I want, and I’d be lost without them. The catch is that I run more than one machine. A laptop, a desktop, now and then a throwaway VM for testing. For years, keeping those in sync was a pile of hacks I didn’t trust.

Pass: the Unix password manager that just works

Sat, 10 Jan 2026 12:00:00 +0100

TL;DR pass keeps each password as a GPG-encrypted file in a directory, and the directory is the whole data model. pass -c email/gmail puts a password in your clipboard from any terminal, pass git push backs the store up, and the fzf script further down is how I look up every password I have. The price is GPG key management, and it’s a real price.

I used KeePass for years. Then 1Password. Then Bitwarden. All decent tools, and every one of them was too much for what I asked of it. Too much UI, too many features, and a password always lived on the other side of an app I had to alt-tab into. A small interruption, and they added up.

GPG explained: from first key to daily use

Tue, 06 Jan 2026 19:00:00 +0100

TL;DR GPG encrypts files and signs things, and it sits under pass, under signed git commits and under the checksums maintainers publish. One command gives you a working keypair in five minutes. Subkeys and a YubiKey come later, if ever, and the UX is bad enough that I complain about it at length below.

GPG is a tool I kept meaning to learn and didn’t, for years. The docs are a wall of text, the terminology is its own dialect, and the error messages are cryptic in both senses of the word.