tape-rotation freezed

nix flake update
tape rotation added
2026-10-07 20:47:14 +03:00 · 2026-09-23 22:05:13 +03:00 · 2026-09-23 22:03:40 +03:00 · 2026-09-23 21:58:39 +03:00
5 changed files with 228 additions and 29 deletions
@@ -33,11 +33,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "lastModified": 1789770686,
+        "narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "725ea35e410ad83be4931d1bff7e090eacaf3563",
        "type": "github"
      },
      "original": {
@@ -109,11 +109,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1789482455,
-        "narHash": "sha256-pD3qVlQ4mUCFoTWrYtxecpSitQMsgJvJIN0FUIDZoEU=",
+        "lastModified": 1790128814,
+        "narHash": "sha256-6Gm9q+wW3E4Ey4F6wEbJAwaMsEK6hvCYfTW7yY64ZfA=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "efa3ccb4c3cc90d832eab232976379058fa75aa3",
+        "rev": "0b2f1129177f70c5f0f5d88bb53c49ca47d0bfc0",
        "type": "github"
      },
      "original": {
@@ -130,11 +130,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1789450388,
-        "narHash": "sha256-30EGO2CUKyJ6VOJF9Zw3B5myrXRjjEmFXpkJOWC3KHI=",
+        "lastModified": 1790165840,
+        "narHash": "sha256-nQ3uCXiUGTLD/UtuChc2XlStYg9a33PYrkDitmmqxW8=",
        "owner": "luynrs",
        "repo": "justray",
-        "rev": "cbe71cb1e71c9f29f7384e9039af4eca9af8ab3a",
+        "rev": "4073f3fb223613e4d780dafad6f93b5c266061a2",
        "type": "github"
      },
      "original": {
@@ -198,11 +198,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1789446796,
-        "narHash": "sha256-dsgZ/cC/ZcbvAM4ZZK2USpS5e34AVo0OlBkuBvzJufQ=",
+        "lastModified": 1790137578,
+        "narHash": "sha256-luzO2Bo/RxUHqTPxBttSB1QVzM9Y5s+Iwpip6SjWdWo=",
        "owner": "Infinidoge",
        "repo": "nix-minecraft",
-        "rev": "9552774a584b6fb0e3981f8b73372d65f36e68cf",
+        "rev": "2e6a1d1ceb4da6b6ffb3980bc7993b3d057cd4db",
        "type": "github"
      },
      "original": {
@@ -259,11 +259,11 @@
        "nixpkgs": "nixpkgs"
      },
      "locked": {
-        "lastModified": 1789417814,
-        "narHash": "sha256-xV9fcqtH6jJLVBF3ocqBBwZkPKEke+BujhEwT4Ye9Tc=",
+        "lastModified": 1789978172,
+        "narHash": "sha256-FIRXajv1pPZ+l6On6ekkmcQ6le0Zi0ncRUoR3nB0vKA=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "d40fd26f323c898b0c195d41aa5efadd85f57832",
+        "rev": "9ebcb7766700d7e006d9505247bd7ce0426f4232",
        "type": "github"
      },
      "original": {
@@ -299,11 +299,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1767892417,
-        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "lastModified": 1789546076,
+        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
        "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.xz"
      },
      "original": {
        "type": "tarball",
@@ -344,11 +344,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1789286504,
-        "narHash": "sha256-eiEK7cKZORNEvX0GeF3RtNEF/JXhgf2RqSp3230q13E=",
+        "lastModified": 1790046670,
+        "narHash": "sha256-MYiI+CzL0tuWgRPjGsKCDHqYs2T3OzMlMQWOYWG0qso=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "ef34387ddd751e1ab8857adf4676492d32eb24ec",
+        "rev": "6774f7bc253789b113a4f39285dc0fa100abeacc",
        "type": "github"
      },
      "original": {
@@ -429,11 +429,11 @@
        "zapret": "zapret"
      },
      "locked": {
-        "lastModified": 1789400583,
-        "narHash": "sha256-X7gKuUiIJOZQghNl2n7yO+XqHF0nayvrx+sXjJCFMxQ=",
+        "lastModified": 1790130850,
+        "narHash": "sha256-k7c+KGZmNLP0ZB9jnKKJUXUTvEJC8A6kHQmZlcN8kNQ=",
        "owner": "FUFSoB",
        "repo": "proxy-suite-flake",
-        "rev": "8ed4ab9a8d4650e43585e10ce51f5ffa790c4a54",
+        "rev": "8f65fa9c255e9350fb09f3d3cc9054034918bf49",
        "type": "github"
      },
      "original": {
@@ -486,11 +486,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1788914643,
-        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
+        "lastModified": 1789890976,
+        "narHash": "sha256-GKwH3zpy7tartuJMG0Rv/xUsdetG1QLmTVv8UKgJLmA=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
+        "rev": "7214124c20c1542c90deb54af50e2f53ae02711f",
        "type": "github"
      },
      "original": {
@@ -0,0 +1,17 @@
+TAPE_ROTATION_JWT_SECRET=ENC[AES256_GCM,data:xFtVR+6TalkDOlcsUB52QAP1eeZAUzHkCdUTC0eg9oLtXxCtOHNKDynpxWiPdqFCFWmFisOESmNEPgqXkfTThw==,iv:auPyYNpuzBV0YL/RG8DYDTim9N72J6cChWTIQMYgs/0=,tag:yN67SlnBPKzzIqet8IgBXw==,type:str]
+TAPE_ROTATION_ADMIN_PASSWORD=ENC[AES256_GCM,data:JCOgdAyDP+7m7lOTXGoCSA==,iv:5WSnfpTyjDO+q59YsFWmgdvajzf5CxfPjpeSkYHMjgg=,tag:tvvm4HWUw71/HcDbIpHu5w==,type:str]
+TAPE_ROTATION_APP_URL=ENC[AES256_GCM,data:GJ5klFIFwJm7/7ts+U6KUy5FYbwkXIipHWTMqT8I,iv:JheRMunpnDcCetLGCa91xYYaMYM92H9UYVtphAOP5IE=,tag:edwFhSXRCV9ZHTQaF2huyw==,type:str]
+TAPE_ROTATION_CORS_ORIGINS=ENC[AES256_GCM,data:TRWO02hfNBHE4rS5s5qvA1L4gAjTP8yqHDmva2k5,iv:oSNVYZEYwheZQW4KPm8aGq73wr3Ol2E7PS0pU7ra7dM=,tag:J21t12mCWJ6Y2bv0ypCdqA==,type:str]
+SMTP_HOST=
+SMTP_PORT=ENC[AES256_GCM,data:LCQ=,iv:WLAbIdlHOj3rewluMXWVzilqvDSV/AJWSCX2r1aKs20=,tag:4Epi95JuDt+hpK5SrgZ/Eg==,type:str]
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_FROM=ENC[AES256_GCM,data:ojS087+VQNecRLOgkiwDooR53SV3,iv:kGpy74EoXEDGnyo706MEJd2JY5FpJmN9Gy6+f7jOwBM=,tag:FaeLO08Prlk8cC84QFpWLw==,type:str]
+NOTIFY_EMAIL=
+TAPE_LABEL_REGEX=
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsSUtSTnJtWHo3WXZWME4r\nNU51dk1rb3NmN3lFT1BMc3E1eVBOTDJUNlZrCkJBT2w2dkpXeEgvMWhWcGVNME8w\nSDZ1ekpUTmxJV0kyb2UrRC9XUTBiUFkKLS0tIGx2MCtxcG9lYjY0dmU4Wld4eEND\neFRRNUd3Rm9iYUg2dWh5elFEaW9wZUUKCvTvSHheiciexXbNXNAI9oioTHUSvreX\nIdOHyjfBfcjgfVIMrp5HQkQCC6labOHRcYgmT4WRkXJ11uTLvgLu1Q==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+sops_lastmodified=2026-09-23T18:58:25Z
+sops_mac=ENC[AES256_GCM,data:iLT3sVq0aV+UEztCdnbTBZraER3kXtksEOHl6AaiINTU6BHM0gTmpn5GdjbJykZDJweYdKVk6vYLB+k8JS33hWS9EoPUtme+FIGkbY6duMGpbVP/DZ5rqol1R+ihChfjmsXpnleVY6kWfnt67CH7LrP2HnsQj5njLF/3Qa4DMe8=,iv:yl8HB2E2Dm5LL1B7eLXXXTxJmEOp6HFvgIb3Ah+zVFg=,tag:iKTWq136tkMDgT4aFqGzmQ==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.3
@@ -0,0 +1,177 @@
+{
+  config,
+  lib,
+  pkgs,
+  xlib,
+  ...
+}:
+# TapeRotation — web app for tracking and rotation of backup tape
+# cartridges. https://github.com/ElizarovEugene/TapeRotation
+#
+# Podman adaptation of the upstream docker-compose deployment. Two
+# containers on a shared "taperotation_default" network (mirrors the
+# compose project network):
+#   - taperotation-backend:  FastAPI/uvicorn on :8001, SQLite at /data,
+#                            file attachments at /app/uploads
+#   - taperotation-frontend: nginx serving the built React app on :80,
+#                            proxying /api to http://backend:8001
+# The backend container gets the network alias "backend" so the
+# frontend's baked-in nginx upstream (compose service name) resolves.
+#
+# Published host port 5174 → container:80 for the web UI. Keep it out
+# of networking.firewall like the other panel ports and front it with an
+# nginx vhost, e.g. in server/nginx.nix:
+#   { domain = "tape-rotation.zeroq.su"; port = 5174; }
+# and set APP_URL / CORS_ORIGINS in the sops-encrypted env file.
+#
+# Instance config lives in one sops-encrypted .env file (mirrors the
+# upstream .env.example, sops-nix format = "dotenv", key = "" → whole
+# file):  sops modules/containers/secrets/tape-rotation.env
+# On first boot the admin account is created from ADMIN_USERNAME /
+# ADMIN_PASSWORD from that file.
+let
+  panel = "${xlib.dirs.services-nodes-folder}/${xlib.device.hostname}/tape-rotation";
+in
+{
+  virtualisation = {
+    podman = {
+      enable = true;
+      autoPrune = {
+        enable = true;
+        flags = [ "--all" ];
+      };
+      dockerCompat = true;
+      defaultNetwork.settings.dns_enabled = true;
+    };
+    oci-containers = {
+      backend = "podman";
+      containers = {
+        "taperotation-backend" = {
+          image = "elizaroveugene/taperotation-backend:latest";
+          environment = {
+            "DATABASE_URL" = "sqlite:////data/taperotation.db";
+            "JWT_EXPIRE_MINUTES" = "480";
+            "ADMIN_USERNAME" = "admin";
+            "ADMIN_LANGUAGE" = "en";
+            "NOTIFY_DAYS_BEFORE" = "7";
+            "TZ" = "Europe/Moscow";
+          };
+          environmentFiles = [ "/run/secrets/tape-rotation-env" ];
+          volumes = [
+            "${panel}/db:/data:rw"
+            "${panel}/uploads:/app/uploads:rw"
+          ];
+          log-driver = "journald";
+          extraOptions = [
+            "--network=taperotation_default"
+            # frontend nginx proxies /api to http://backend:8001
+            "--network-alias=backend"
+          ];
+        };
+        "taperotation-frontend" = {
+          image = "elizaroveugene/taperotation-frontend:latest";
+          ports = [
+            "0.0.0.0:5174:80/tcp"
+          ];
+          log-driver = "journald";
+          extraOptions = [
+            "--network=taperotation_default"
+          ];
+        };
+      };
+    };
+  };
+
+  # Enable container name DNS for all Podman networks.
+  networking.firewall.interfaces =
+    let
+      matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+    in
+    {
+      "${matchAll}".allowedUDPPorts = [ 53 ];
+    };
+
+  systemd = {
+    services = {
+      "podman-taperotation-backend" = {
+        serviceConfig.Restart = lib.mkOverride 90 "always";
+        after = [ "podman-network-taperotation_default.service" ];
+        requires = [ "podman-network-taperotation_default.service" ];
+        partOf = [ "podman-compose-tape-rotation-root.target" ];
+        wantedBy = [ "podman-compose-tape-rotation-root.target" ];
+      };
+      "podman-taperotation-frontend" = {
+        serviceConfig.Restart = lib.mkOverride 90 "always";
+        after = [
+          "podman-network-taperotation_default.service"
+          "podman-taperotation-backend.service"
+        ];
+        requires = [ "podman-network-taperotation_default.service" ];
+        partOf = [ "podman-compose-tape-rotation-root.target" ];
+        wantedBy = [ "podman-compose-tape-rotation-root.target" ];
+      };
+      "podman-network-taperotation_default" = {
+        path = [ pkgs.podman ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStop = "podman network rm -f taperotation_default";
+        };
+        script = ''
+          podman network inspect taperotation_default || podman network create taperotation_default
+        '';
+        partOf = [ "podman-compose-tape-rotation-root.target" ];
+        wantedBy = [ "podman-compose-tape-rotation-root.target" ];
+      };
+      "podman-update-taperotation" = {
+        path = [ pkgs.podman ];
+        serviceConfig = {
+          Type = "oneshot";
+          TimeoutSec = 300;
+        };
+        script = ''
+          podman pull elizaroveugene/taperotation-backend:latest
+          podman pull elizaroveugene/taperotation-frontend:latest
+          systemctl restart podman-taperotation-backend.service podman-taperotation-frontend.service
+        '';
+      };
+    };
+    # Starts/stops together with all TapeRotation containers.
+    targets."podman-compose-tape-rotation-root" = {
+      unitConfig.Description = "Root target generated by compose2nix.";
+      wantedBy = [ "multi-user.target" ];
+    };
+    # Enable automatic image updates:
+    # systemd.timers."podman-update-taperotation" = {
+    #   wantedBy = [ "timers.target" ];
+    #   timerConfig = {
+    #     OnCalendar = "weekly";
+    #     Persistent = true;
+    #   };
+    # };
+    tmpfiles.rules = [
+      (xlib.helpers.mkTmpfile "d" xlib.dirs.services-mnt-folder "0755" "root" "root")
+      (xlib.helpers.mkTmpfile "d" xlib.dirs.services-nodes-folder "0755" "root" "root")
+      (xlib.helpers.mkTmpfile "d" "${xlib.dirs.services-nodes-folder}/${xlib.device.hostname}"
+        "0755"
+        "root"
+        "root"
+      )
+      (xlib.helpers.mkTmpfile "d" panel "0755" "root" "root")
+      (xlib.helpers.mkTmpfile "d" "${panel}/db" "0755" "root" "root")
+      (xlib.helpers.mkTmpfile "d" "${panel}/uploads" "0755" "root" "root")
+      # Relabel panel dir for SELinux so containers can access it.
+      (xlib.helpers.mkTmpfile "Z" panel "0755" "root" "root")
+    ];
+  };
+
+  sops.secrets."tape-rotation-env" = {
+    # key = "" → decrypt the whole file, not a single key.
+    # format = "dotenv" → the file IS one .env ready for environmentFiles:
+    # every non-comment KEY=VALUE line lands in the container environment.
+    key = "";
+    format = "dotenv";
+    sopsFile = ./secrets/tape-rotation.env;
+    mode = "0400";
+  };
+}
@@ -6,6 +6,7 @@
 {
  imports = [
    ../containers/3x-ui.nix
+    # ../containers/tape-rotation.nix
    ../pkgs/beets.nix
    ./acme.nix
    ./bentopdf.nix
@@ -16,7 +17,6 @@
    ./glances.nix
    ./homebox.nix
    ./immich.nix
-    # ./minecraft.nix
    ./miniflux.nix
    ./navidrome.nix
    ./nextcloud.nix
@@ -33,6 +33,7 @@
    # ./coturn.nix
    # ./mealie.nix
    # ./memos.nix
+    # ./minecraft.nix
    # ./n8n.nix
    # ./netdata.nix
    # ./nfs.nix
@@ -61,6 +61,10 @@ let
      domain = "flux.zeroq.su";
      port = 6061;
    }
+    {
+      domain = "tape-rotation.zeroq.su";
+      port = 5174;
+    }
    {
      domain = "navidrome.zeroq.su";
      port = 4533;
Author	SHA1	Message	Date
oqyude	0fdf6c965c	tape-rotation freezed	2026-09-23 22:05:13 +03:00
oqyude	5bccf7586d	nix flake update	2026-09-23 22:03:40 +03:00
oqyude	2912581b99	tape rotation added	2026-09-23 21:58:39 +03:00