npm was hit by a series of supply chain attacks recently. The response was to require two-factor authentication for local publishing and OIDC for publishing from continuous integration. The result:

1. For local publishing you now need two-factor auth with a security key. If your computer does not have one built-in, you will need to buy one. Which is not a bad idea, but the fact that it is required is a bit draconian in my opinion (authenticator apps are not supported).

2. As of March 2026, publishing with OIDC is only supported on GitHub and GitLab. Not my new favorite CI provider sourcehut. npm itself is already sort of problematic, because it is a critical piece of infrastructure owned and operated by Microsoft, not allowing¹ publishing from other CI systems is pushing the web infrastructure further towards centralization.

This led me to explore Verdaccio, a relatively simple to host npm registry. In this post I'd like to share how I set it up on my NixOS box.

First I created a standalone verdaccio.nix file, which I will wire up into my configuration.nix later.

{ config, pkgs, ... }:

let
  verdaccioPort = "4873";
  domain = "npm.mydomain.com";
in
{
  # configuration goes here
}

Since there is no NixOS package for Verdaccio yet, I declaratively set up a container.

virtualisation.oci-containers.containers.verdaccio = {
    image = "verdaccio/verdaccio";
    ports = [ "${verdaccioPort}:${verdaccioPort}" ];
    volumes = [
      "/etc/verdaccio:/verdaccio/conf"
      "/var/lib/verdaccio/storage:/verdaccio/storage"
      "/var/lib/verdaccio/plugins:/verdaccio/plugins"
    ];
  };

Then I needed to make sure that these directories exist with the right permissions, for which the systemd-tmpfiles system can be used. NixOS allows a declarative configuration:

systemd.tmpfiles.settings.verdaccio."/var/lib/verdaccio".d = {
  user = "10001";
  group = "65533";
  mode = "2750";
};

systemd.tmpfiles.settings.verdaccio."/etc/verdaccio".d = {
  user = "10001";
  group = "65533";
  mode = "2750";
};

Next, I made sure NixOS generates a configuration file. I used (pkgs.formats.yaml { }).generate to generate YAML from a Nix attribute set. These are mostly the defaults, but I changed the hashing algorithm and set max_users to 1:

environment.etc."verdaccio/config.yaml" = {
  uid = 10001;
  gid = 65533;
  mode = "0644";
  source = (pkgs.formats.yaml { }).generate "verdaccio-config.yml" {
    storage = "/verdaccio/storage";
    web.title = "Verdaccio";
    auth.htpasswd = {
      max_users = 1;
      file = "./htpasswd";
      algorithm = "bcrypt";
      rounds = 10;
    };
    uplinks.npmjs.url = "https://registry.npmjs.org/";
    packages = {
      "@*/*" = {
        access = "$all";
        publish = "$authenticated";
        unpublish = "$authenticated";
        proxy = "npmjs";
      };
      "**" = {
        access = "$all";
        publish = "$authenticated";
        unpublish = "$authenticated";
        proxy = "npmjs";
      };
    };
    server = {
      keepAliveTimeout = 60;
      dotfiles = "ignore";
    };
    middlewares.audit.enabled = true;
    filters."@verdaccio/package-filter" = { };
    log = {
      type = "stdout";
      format = "pretty";
      level = "http";
    };
    i18n.web = "en-US";
  };
};

Then I configured Caddy as a reverse proxy, which can be done very concisely:

services.caddy.virtualHosts.${domain}.extraConfig = ''
  reverse_proxy http://127.0.0.1:${verdaccioPort}
'';

The file needs to be wired up in configuration.nix:

imports = [
  ./hardware-configuration.nix
  ./verdaccio.nix
];

And that's it! With npm register --registry https://npm.mydomain.com an account can be created, npm login is used to log in. You can even add this to your ~/.npmrc:

registry=https://npm.mydomain.com

Verradacio will simply use upstream npmjs.org and cache the result when a package is missing.

I work remotely. That means long days alone behind my computer. It can get a bit lonely sometimes. So I really like to go out there and build in-person connections whenever I get the chance. The perfect opportunity presented itself this weekend.

Dave: The Man, The Myth, The Legend

Last year, at State of the Map Europe in Dundee I met Dave. He is a fascinating guy. He loves MapLibre and created an app called Tour de Orange Juice to share bike/hike tours, pictures and even 3D scans on a map (see for example this map). It was just him and his girlfriend using this app (it doesn't get more small web than this), but I am proud to have become the third user.

Dave was kind enough to let me into his house, introduce me to the sport of frisbee, let me join a jam session with his friend Josh, tour me around the city and put up with my sudden fascination of the wild and weird Berlin party scene¹. Dave if you're reading this, thank you.

DWeb

Aside from getting to know Dave better, I wanted to learn more about DWeb. I met the DWeb folks at FOSDEM last January. They are a community of hackers pursuing a decentralized web under a set of principles that definitely resonate with me².

Here in Berlin I visited a DWeb unconference held at c-base. One of the main goals was preparing for DWeb Camp, a yearly gathering held for the first time in Europe this Summer. If you are interested in participating (July 8-12, 2026), see the slide below. I plan to give a workshop there to teach people how to create self-contained maps with an open source stack (Planetiler, MapLibre, PMTiles). I think it is mind-blowing how easy this has become. This knowledge needs to be spread far and wide.

Democratizing App Building

Together with Liz Sweigart I led a session on democratizing app building. The basic idea is that thanks to LLMs building apps is now cheaper and more accessible than ever. The question is: how can we bring app development to the masses in a way that is user-respecting (e.g. no vendor lock-in and other shenanigans) and takes into account the shadow side of LLMs?

Brewster Kahle, founder of the Internet Archive, joined the discussion. He shared his vision of public AI. The huge capex of large AI firms may lead you to the depressing conclusion that LLMs are a technology that only large private enterprises can build and operate. Brewster is bullish that hackers will do what hackers do best and make it cheaper to the point where this is no longer the case.

When I pitched my session idea, Liz told me: what you're describing exists and it is called Shakespeare.diy. It is open source (AGPL) and it does not have a strong dependency on a particular backend. You can bring your own LLM API, deploy your app where you want it. Your app is even bundled completely in the browser. To avoid depending on Node.js³, it re-implements a subset of npm for installing dependencies and it uses esbuild-wasm for bundling⁴.

I have actually been thinking about and tinkering with the AI app builder idea. Shakespeare.diy ticks a lot of boxes, but I have some problems with it that I also have with all the proprietary offerings out there that I tried:

1. I do not think generating complicated sprawling codebases with many files is a good idea. The resulting codebase may be 'good' from a software engineering perspective; LLMs are not software engineers.

   You may be able to ‘one shot’ a functioning codebase this way; making changes with an LLM will be harder. It is doable if you are a programmer, and can nudge the LLM towards a solution, but I am interested in AI app builders for the non-technical masses. That means hiding the code by default.

   In my experience it helps if you put everything in one file. My philosophy is: dumb down the generated code as much as you can. This way LLMs can much more reliably make subsequent changes to the app.

2. The persistence story. I want to be able to access app data from multiple devices and not worry about losing it (localStorage and friends are not an option). I want to share access to my app's data. And I want to own my data. It needs to be stored in an open format that I can easily export.

I think I have a solution for these problems, and I will share about it in a follow-up post.

Dave, by the way, thinks building an AI app builder is a bad idea. There is a lot of competition in this space, from players that have way better infrastructure and very deep pockets. Why would anyone use what some scrappy developer built? Dave should consider becoming a venture capitalist. It is a great question.

The answer is: I think the competition is not doing a very good job. I am not impressed by the stuff companies with 100+ million dollar valuations built. They are overcomplicating the generated code and fell for the hype that LLMs are good software engineers. I could be wrong. You bet I will try to find out.

Random Berlin Impressions

I have been living in Germany since 2020, but I had never visited the illustrious capital of the country before. Here are some of my impressions.

• The slogan I came up with for Berlin: "If it broke, don't fix it".

• Despite having a reputation of being a pretty leftist city, with a few exceptions, the bicycle infrastructure is quite underdeveloped.

• There is a huge empty area called Templehof. It used to be an airfield. The locals seem to have a sentimental attachment to the place, so this is pure blasphemy: I think they can create something better there.

• I pulled a woman off the tracks of the U-Bahn (metro). She was not suicidal but she thought it was a good idea to risk her life for a ball. 🤷‍♂️

• FlixTrain is a pretty decent alternative to Deutsche Bahn for long distance travel by train. It can be much cheaper (DB gets crazy expensive close to the departure date, not particularly suitable for spontaneous travel). It can even be a bit faster. The ventilation on board is non-existent or at least very bad, however. Next time I will definitely pick my seat to make sure I am next to a window that can open.

• It has been cold the past few months: many of the canals and ponds were still frozen. The pavements were still full of gravel (which is mandatory to put when its slippery out). I was told it had been downright depressing. I was lucky though: still a bit chilly, but lots of sun this weekend.

• While we huddled together to discuss a free and open internet, bombs were dropping in Iran. The next day, at Brandenburger Tor, Iranians in Berlin were celebrating the violent end of the reign of their Ayatollah.