Ulzurrun de Asanza i Sàez

Fixing macOS Local Network Privacy for launchd Agents

Apple introduced a new security feature called Local Network Privacy in macOS 15 Sequoia that blocks apps from accessing the local network by default until the user manually allows them. The limit applies to both prebuilt binaries and anything built locally.

This is particularly annoying with Nix, since it’s very easy to end up with many custom binaries and launchd agents, and macOS doesn’t show the “allow LAN access” dialog for them. Furthermore, every time the derivation changes, the custom binaries end up in a different path that needs to be allowlisted again. Fortunately, we can overcome this limitation with a simple proxy script.

Read more →

Pulumi vs Terraform: honest retrospective after a full migration

This post is part of my series on migrating my Homelab from Terraform to Pulumi. In this article, I will sum up the experience, highlight the highs and lows of Pulumi, and share a few things I wish I had known beforehand.

Read more →

Rookie mistakes I made with Pulumi dependency tracking

This post is part of my series on migrating my Homelab from Terraform to Pulumi. In this article, I’ll walk through a few rookie mistakes I made when modelling dependencies in Pulumi, why they caused problems, and how to avoid them.

Read more →

How to manage Pulumi Secrets with 1Password

This post is part of my series on migrating my homelab IaC from Terraform to Pulumi. In this article, I explain how I manage secrets in my Pulumi setup using 1Password and what I learned along the way.

Read more →

Migrating Proxmox LXC containers from Terraform to Pulumi

This post is part of my series on migrating my Homelab from Terraform to Pulumi. In this article I walk through how I’m migrating my LXC containers and how I imported them from Terraform without any data loss.

Read more →

New React 18 and 19 features for promise handling

use, useOptimistic (React 19), useTransition, useDeferredValue, Transition, Actions (React 18), and <Suspense> form a powerful toolkit for managing asynchrony in React. This post walks through how these APIs work in practice and how they fit together, especially useful if you skipped React 18 or 19.

Read more →

Migrating OVH DNS records from Terraform to Pulumi

This post is part of my series on migrating my Homelab from Terraform to Pulumi. Here, I’ll walk through how I manage DNS records in Pulumi and how I imported them from Terraform so the migration can be fully automated.

Read more →

Why I am migrating my Homelab IaC from Terraform to Pulumi

Last year, I repurposed an old PC as a home server. Before that, I was already running a few Docker containers on a Synology NAS, but I wanted something more cost-effective—especially when it came to storage capacity.

One of my goals was to define the entire setup as code. I wanted to avoid clicking around in the UI and waiting for pages to load every time I needed to change a setting. So I installed Proxmox (manually), set up API credentials, and jumped on the Terraform bandwagon. With it, I defined all my containers, firewall rules, and the public and private domain names needed to access my services.

Read more →

2026 New Year’s resolutions

Every end of the year, I think about getting back to writing regularly on this blog. And every year, it somehow slips away. Sometimes I lack inspiration. Sometimes I’m unsure what to write about. Other times I worry that what I share might be too obvious or not worth posting.

This year, however, I want to do things differently. Over the past few months, I’ve been working on a couple of projects that have sparked new ideas. I now have notes, discoveries, and stories worth sharing—both about the work itself and the motivation behind it. Writing this down publicly should also help keep me accountable.

I’ll begin with my Homelab and its migration from Terraform to Pulumi. I’m also planning to redesign this website and potentially move away from WordPress on the client side. Expect a few posts on each project, along with regular progress updates.

Although I’m writing mainly for myself, as a kind of learning journal, I hope some of it proves useful to you as well.

See you around!

How to write type-safe nested key paths in TypeScript

Recently I had to write a type-safe function that allowed to update (nested) paths of a JavaScript object. I wanted the function to prevent setting a wrong value to the requested path, even nested ones with optional values.

After playing a bit with TypeScript type system I came up with these types which I think can be useful and will be using for sure in future projects. You can play with it in this playground or see the code right below:

export type KeyPath<
    T extends string,
    K extends string,
    Separator extends string = ".",
> = `${T}${"" extends T ? "" : Separator}${K}`;

export type KeyPaths<T extends object, P extends string = "", Separator extends string = "."> = {
    [K in keyof T]-?: K extends string
        ? NonNullable<T[K]> extends object
            ? KeyPath<P, K, Separator> | KeyPaths<NonNullable<T[K]>, KeyPath<P, K, Separator>, Separator>
            : KeyPath<P, K, Separator>
        : never;
}[keyof T & string];

export type GetTypeAtKeyPath<T, Path extends string, Separator extends string = "."> = Path extends keyof T
    ? T[Path]
    : Path extends `${infer K}${Separator}${infer Rest}`
      ? K extends keyof T
          ? NonNullable<T[K]> extends object
              ? GetTypeAtKeyPath<NonNullable<T[K]>, Rest, Separator>
              : never
          : never
      : never;
Code language: TypeScript (typescript)

Let’s dig into how to use it and how KeyPath, KeyPaths and GetTypeAtKeyPath work and how to use it.

Read more →