I went native and built ACME support directly into IO. Here are some things that I learned: agent.io/posts/acme/

"You've already used Envoy today. You probably didn't know it." From this beautiful overview by Erica Hughberg: a-decade-of-envoy.netlify.app

Recently I added support for proxying "raw" TCP ports so that IO could proxy SSH and other non-HTTP services. Here's an updated start screen that describes all of IO's modes.

Today I added local service discovery to IO and OMG it's so nice... I didn't realize how good it would feel to write zero-configuration API clients like this example that calls the Google Cloud Translate API...

Is it an agent that you want, or just agency? agent.io/posts/agency/

"By leveraging Envoy as an agent gateway, organizations can decouple security and policy enforcement from agent development code." Google (partially) gets @agent.io -- they understand the potential but, as usual, miss the importance of simplicity! cloud.google.com/blog/product...

People at Google really like Envoy (so do we) cloud.google.com/blog/product...

The slink CLI and code generator is now MIT-licensed. github.com/agentio/slin...

Software Licenses and Workers' Rights agent.io/posts/softwa...

On the decision to write a PDS agent.io/decisions/pds/

Managing a Beta with Bluesky agent.io/posts/managi...

Building a PDS the Hard Way agent.io/posts/buildi...

New in IO: Direct TCP port configuration agent.io/io/config/#t...

Are you worried about DID:PLC? There are reasons to be, but they can be fixed agent.io/posts/risks-...

Finally! The treatise about slink that no one was asking for but everyone needed agent.io/posts/slink

Here's a little CLI that generates itself from Lexicon and calls XRPC APIs. github.com/agentio/slink

Auth scopes are great but they don't always restrict access as much as we want. Here's an IO configuration that *only* allows a couple of authorized API key users to call a few named methods of the Digital Ocean DNS API using a token that it gets from Hashicorp Vault.

Here's IO running on MacOS agent.io/decisions/ma...

Are you familiar with the XDG Base Directory Specification? Here's how we used it to improve IO: agent.io/decisions/xdg/

Recently we started building our own Envoy binaries and IO container images. agent.io/decisions/co...

Envoy requires libc, so it doesn't make sense for IO to make performance sacrifices to avoid depending on libc itself. That lets us build IO with CGO and use the native SQLite library, which has big performance benefits. agent.io/decisions/cgo/

This week IO's configuration language got a revamp and a reference agent.io/io/config/

Tempted by Alpine Linux: agent.io/decisions/al...

In September we created Sidecar, a new Go gRPC implementation that focuses on clarity, simplicity, and security for apps that run with sidecars. It's now how IO does gRPC. Here's a discussion of our decision to switch. agent.io/decisions/si...

Is it an SDK... or a monster infesting your app? agent.io/posts/sdks/

If you use Go, gRPC, and sidecar proxies, I wrote this for you github.com/agentio/sidecar

Echo is a simple gRPC service that we wrote to test and experiment with gRPC and ConnectRPC agent.io/posts/echo/

How IO uses gRPC: agent.io/posts/grpc/

IO was created to work with a set of API management APIs from Google called Service Infrastructure, but now we think we've outgrown it. agent.io/decisions/dr...

What's it like to run an application with Nomad and IO? Here's an example with bonus info about gRPC: agent.io/posts/memos/

Here's a practical benefit of our exploration of @hashicorp.com's Nomad and Vault: all of the configuration for this Nomad-hosted ATProto PDS is now read from secrets in Vault.

I'm getting more and more hooked on Nomad. With the raw_exec driver, I can run pretty much anything on my Nomad-running laptop. Here's how I use it to automatically unseal Vault. agent.io/posts/laptop...

"The caller never sees this secret." IO can read and apply API keys so that applications can securely use secrets without ever directly possessing them. agent.io/posts/vault

Here's IO using an API key that it read from Vault using its Nomad workload identity.

We've been working a lot with HashiCorp's Nomad and Vault. Here's an easy way to run them both on an Ubuntu laptop. agent.io/posts/laptop...

Our preferred JWx library is @lestrrat.bsky.social‬'s lestrrat-go/jwx agent.io/decisions/jwt/

A more general idea behind "No SDKs" and other design decisions is that we work to keep the number of third-party dependencies low and their quality high. agent.io/decisions/de...

Finally (for now), we've been picky about limiting dependencies and controlling the network connections that IO makes. This seems worth noting as a decision, i.e. "No SDKs". agent.io/decisions/sd...

Now we have a small fleet of droplets running Nomad and IO to use for testing and demos. We can manage them all over SSH, and quickly went from bash scripts to a small Go tool that can do things like check versions and trigger restarts. agent.io/decisions/fl...

When we initially thought of adding analytics to the preview, we added a small custom API for sending them. But a little bit of investigation led to Open Telemetry, which we're using in a very basic and direct way (with no SDKs). agent.io/decisions/ot...

Once we had images on DockerHub, we started getting warnings about security vulnerabilities in the standard Envoy releases that we were using as base images. This led us to switch to the Envoy "distroless" images that are published by a team at Google. agent.io/decisions/di...

At this point, the realization that "we've made so many decisions" forced me to stop, come up with a structure, and put as many past decisions that I could think of in it. agent.io/decisions/re...

The preview is based on IO Docker images, and setting up a paid DockerHub account seemed to be the best way to directly manage these and other images that we wanted to publish. agent.io/decisions/do...

Adding SSH support made it clear that it would be easy to add SFTP/SCP support, which has been a great way to read and write configuration of remote IOs. More uses are coming. agent.io/decisions/scp/

Honestly, THIS IS SO COOL. As soon as we discovered that we could use Charm's wish package to SSH into remote running IOs, we had to do it. agent.io/decisions/ssh/

Our first step from the homelab to the cloud was to use Digital Ocean. The big draw was the simplicity of the console experience and Digital Ocean's APIs. agent.io/decisions/di...

We're using Google Workspace for email and docs. agent.io/decisions/wo...

What's the least-commitment way to make IO available to other users? I wasn't ready to go through any "one-way doors", so we decided to start with a private preview. agent.io/decisions/pr...

IO manages secrets so applications never see them. But where should secrets be kept? IO can store them in local storage, but to increase security, we wanted to integrate with a secrets manager. We decided to start with Vault. agent.io/decisions/va...

Importing generated code from other people's repos is a recipe for suffering, so we don't do it. agent.io/decisions/pr...