From 13c500596e06c89b2e351591944f46aab299e29e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Victor=20I=C8=99an?= <victor@isan.ro>
Date: Wed, 8 Jul 2026 13:40:19 +0200
Subject: [PATCH] containers: added specifically clementines

---
 hosts/isengard.nix                            |  1 +
 modules/agenix.nix                            |  6 ++
 .../containers/specificallyclementines.nix    | 71 +++++++++++++++++++
 secrets/clementines.age                       | 24 +++++++
 secrets/secrets.nix                           |  1 +
 5 files changed, 103 insertions(+)
 create mode 100644 modules/containers/specificallyclementines.nix
 create mode 100644 secrets/clementines.age

diff --git a/hosts/isengard.nix b/hosts/isengard.nix
index d17b484..75b78b9 100644
--- a/hosts/isengard.nix
+++ b/hosts/isengard.nix
@@ -22,6 +22,7 @@
         ../modules/containers/radarr.nix
         ../modules/containers/immich.nix
         ../modules/containers/argus.nix
+        ../modules/containers/specificallyclementines.nix
 
     ];
     # Disks
diff --git a/modules/agenix.nix b/modules/agenix.nix
index 6df7bdf..0120fc0 100644
--- a/modules/agenix.nix
+++ b/modules/agenix.nix
@@ -47,5 +47,11 @@
             group = "admin";
             mode = "0440";
         };
+        clementines = {
+            file = ../secrets/clementines.age;
+            owner = "root";
+            group = "admin";
+            mode = "0440";
+        };
     };
 }
diff --git a/modules/containers/specificallyclementines.nix b/modules/containers/specificallyclementines.nix
new file mode 100644
index 0000000..edfe9eb
--- /dev/null
+++ b/modules/containers/specificallyclementines.nix
@@ -0,0 +1,71 @@
+{ config, ... }:
+
+let
+    workDir = "/srv/containers/clementines";
+in
+{
+    systemd.tmpfiles.rules = [
+        "d ${workDir}/dbdata 2770 root admin"
+        "d ${workDir}/dbetclocal 2770 root admin"
+        "d ${workDir}/frontend 2770 root admin"
+    ];
+
+    virtualisation.oci-containers.containers = {
+        clementines-couchdb = { 
+            autoStart = true;
+            image = "couchdb";
+
+            ports = [
+                "0.0.0.0:10010:5984"
+            ];
+
+            volumes = [
+                "${workDir}/dbdata:/opt/couchdb/data"
+                "${workDir}/dbetclocal:/opt/couchdb/etc/local.d"
+            ];
+
+            environmentFiles = [
+                config.age.secrets.clementines.path
+            ];
+
+            extraOptions = [
+                "--group-add=10000"
+            ];
+        };
+
+        clementines-frontend = {
+            autoStart = true;
+
+            image = "ghcr.io/davideshay/groceries-client:latest";
+
+            ports = [
+                "0.0.0.0:10011:8100"
+            ];
+
+            volumes = [
+                "${workDir}/frontend/groceries-web.conf:/etc/nginx/conf.d/default.conf:ro"
+            ];
+
+            extraOptions = [
+                "--group-add=10000"
+            ];
+        };
+
+        clementines-backend = {
+            autoStart = true;
+
+            image = "ghcr.io/davideshay/groceries-server:latest";
+
+            ports = [
+                "0.0.0.0:10012:3333"
+            ];
+
+            environmentFiles = [
+                config.age.secrets.clementines.path
+            ];
+
+            dependsOn = [ "clementines-couchdb" ];
+        };
+
+    };
+}
diff --git a/secrets/clementines.age b/secrets/clementines.age
new file mode 100644
index 0000000..f3a54c4
--- /dev/null
+++ b/secrets/clementines.age
@@ -0,0 +1,24 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFA5bEdnQSBVVURu
+QWxVQnk3bWh1clJrYTJWVkZpN0xqOU81YTl6dWdab29iU1JTYW1zCkI2VkhQakg4
+WmJtZG44Rks5Yk5vMTEyOVp4dmdicDdybldNL0cyQjliOFUKLT4gc3NoLWVkMjU1
+MTkgS0tuNDVBIHdqMjRRdGg4R3ZZSnhDWVEyNWg3YmxnVFFzV2dXQ1o4M3QrT29U
+b2ZyMlkKZndFeDBjUjcyY3N5d0RPZW45Y1JVTTF5T29JcVdLRDY0L0NoTEpNNElY
+cwotPiBsbXB+VS1ncmVhc2UgO3JmICM8fjssRCBuLV4wQXRZegpWWjR0OFR0WWVq
+clJRYk5TSDM3dgotLS0gTlF5NXRkaGpXWVBsZXN0dDJ3VWo5L2g4Z1V3YTZ2eTkv
+QXhBcURPdGs0YwoLyORoEg0qV8QwwHMLFkjWYyzlyOnNRmSNBF0lSsx/mBzywiAa
+nZDnTsLQItVlMtDtZnwHS2g+t2QNfezUUhqiymuQQ9JrG9e1BcVrzr95FZZbWLB0
+Z0eX1ApxHHEfE9PbEfyca5U4se6Ll1Hx0UFe0aBN1HNoFATWz7YI2PnGF+wucc7k
+yOPzsr7lsbT2zufI/MZiyzwXeRXyr2wAWUw8yqKBPh8lbUR5Z0CONQm6Cxw6psDx
+P/PdrjUhR/GU+GcZnAKOJ77iIj9hRhkaveVbb9WPQJcx40PNU59ZChk/puXMRMOR
+moJSTQswdTBV5CEHizB/MXTB75kLUWG8IGhsPozv9ag8Z2a1wxlu0r5fNVHjEgg6
+t1ITfJC45eyA/7pG97NogUSaGki5dUX6rCGvkVV9cRn30fEnHbpOCAIgOuD87nvO
+iAXvcHckwRLPoVSi4WwgyuEAIqU3r19bEL9umouRYzjx7LdUUklO/y8UdqUiFY7g
+MInuXpHVh8zJ2857SlP5N4YS3TXqvlCLsgUfLL6rdi2OtDXV9RvQ8/XGIEl1CzS7
+G+FuRXT+XZAhK+HEvWEPcSpphUDLIbxcSuZ3TJ1ckz0zlAWhTvjftpvaoIuaLKFh
+FbWXEY19GJ7YHIidDpc098F4VMR33xmOFgIoyo6nXX8SGS91JUh1hmIrPTvBwYEw
+DIZ/tqGiNeO+YLt/ZGiXs8ZZVtNOi19oqsjovHQFLUKQvTgsy2Xlj2N+Uku+essI
+b1cvuGH++tll93u2UBSjneNM3crAaK66E+3MnFcp1Jd0NTe5DR6rPg5S0yvF6nxv
+WU9lH9paEx9ia7/R3iT7zc1s7FNhRfNVxEcxuMFInj+XqJ2ytQu2rwV/Oxwu/YeF
+xv69gnS4Fivybsxf7xjf6gi/
+-----END AGE ENCRYPTED FILE-----
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 6b7e1c4..2997b3a 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -12,4 +12,5 @@ in
   "jitsi-env.age".publicKeys = [ victor isengard ];
   "immich.age".publicKeys = [ victor isengard ];
   "argus-conf.age".publicKeys = [ victor isengard ];
+  "clementines.age".publicKeys = [ victor isengard ];
 }