The default docker package is marked insecure; the runner module already
supports Podman natively (DOCKER_HOST -> /run/podman/podman.sock, group
podman), and the socket + group are already present on the host.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Enable Gitea Actions in the container (GITEA__actions__ENABLED)
- Run dockerd alongside podman for job containers
- services.gitea-actions-runner: instance-wide runner "fileserver",
Docker labels, registered against the internal LAN URL; reads the
registration token from /data/secrets/gitea-runner-token
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
No longer in use. Drops the beets containers (cli/web), build +
autoimport services and timer, the beet CLI wrapper, /opt/dj-beets
tmpfiles entry, firewall port 8337, the Makefile copy step, and the
src/dj-beets tree (which contained a Beatport token) so the repo can
be made public safely.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mount /data/filebrowser as /config and point FB_DATABASE at
/config/filebrowser.db so the user/share database survives
container recreations.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace initialPassword with hashedPassword for danlin user, move
FileBrowser admin password to external environmentFile with restricted
secrets directory, update SSH authorized key, and bump nixpkgs to 25.11.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
danlin