From 5e68e6ee96737852818d49b1f4320f254839c5c9 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:31:23 +0100
Subject: [PATCH 01/17] - Services: Added Part-DB - Implementation: Added
 nix-sops based secret version controlling.

---
 .gitignore                                    |  3 +-
 .sops.yaml                                    | 15 +++++
 nix-system-configs/database/configuration.nix |  5 +-
 .../services/part-db/docker-compose.yml       | 61 ------------------
 .../forgejo-localconfig.nix                   |  0
 .../{forgejo => forgejo-deprecated}/pull.zsh  |  0
 .../{forgejo => forgejo-deprecated}/push.zsh  |  0
 .../modules/scripts/compose_two_nix.zsh       |  2 +
 .../modules/secrets/secrets.example.nix       | 19 ------
 .../modules/secrets/sops-nix.nix              | 31 +++++++++
 .../songsheet/wavelog/docker-compose.nix      | 54 +++++++++++++++-
 .../songsheet/wavelog/docker-compose.yml      | 63 ++++++++++++++++++-
 .../modules/system/compose-songsheet.nix      |  1 +
 .../secrets/songsheet/example.yaml            | 31 +++++++++
 .../secrets/songsheet/secrets.yaml            | 25 ++++++++
 nix-system-configs/secrets/traefik/test.yaml  | 34 ++++++++++
 .../{traefik => traefik-deprecated}/pull.zsh  |  0
 .../{traefik => traefik-deprecated}/push.zsh  |  0
 .../traefik-config.nix                        |  0
 19 files changed, 258 insertions(+), 86 deletions(-)
 create mode 100644 .sops.yaml
 delete mode 100644 nix-system-configs/docker-containers/services/part-db/docker-compose.yml
 rename nix-system-configs/{forgejo => forgejo-deprecated}/forgejo-localconfig.nix (100%)
 rename nix-system-configs/{forgejo => forgejo-deprecated}/pull.zsh (100%)
 rename nix-system-configs/{forgejo => forgejo-deprecated}/push.zsh (100%)
 create mode 100644 nix-system-configs/modules/scripts/compose_two_nix.zsh
 delete mode 100644 nix-system-configs/modules/secrets/secrets.example.nix
 create mode 100644 nix-system-configs/modules/secrets/sops-nix.nix
 create mode 100644 nix-system-configs/secrets/songsheet/example.yaml
 create mode 100644 nix-system-configs/secrets/songsheet/secrets.yaml
 create mode 100644 nix-system-configs/secrets/traefik/test.yaml
 rename nix-system-configs/{traefik => traefik-deprecated}/pull.zsh (100%)
 rename nix-system-configs/{traefik => traefik-deprecated}/push.zsh (100%)
 rename nix-system-configs/{traefik => traefik-deprecated}/traefik-config.nix (100%)

diff --git a/.gitignore b/.gitignore
index 6508bc9..20ed6f0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,4 @@
 /target
 
 # Secrets and local env
-/nix-system-configs/modules/secrets/secrets.nix
-/.env
+.env
diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..6f03331
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,15 @@
+keys:
+  - &admin_christine age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+  - &server_songsheet age1es0va2hjshgsv8tfyfjw6sfu6dm7q9u6wza3t9nevlakxzmxr4lqn2q7r6
+  - &server_traefik age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p
+creation_rules:
+  - path_regex: nix-system-configs/secrets/songsheet/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+        - *admin_christine
+        - *server_songsheet
+  - path_regex: nix-system-configs/secrets/traefik/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+        - *admin_christine
+        - *server_traefik
\ No newline at end of file
diff --git a/nix-system-configs/database/configuration.nix b/nix-system-configs/database/configuration.nix
index 1f503a0..2332e32 100644
--- a/nix-system-configs/database/configuration.nix
+++ b/nix-system-configs/database/configuration.nix
@@ -136,13 +136,14 @@
   services.postgresql = {
     enable = true;
     enableTCPIP = true;
-    ensureDatabases = ["forgejo"];
+    ensureDatabases = ["forgejo" "part_db_database"];
     settings = {
       listen_addresses = "*";
     };
     authentication = pkgs.lib.mkOverride 10 ''
       local   all             all                                 trust
       host    all             all             10.1.1.4/32         scram-sha-256
+      host    all             all             10.1.1.249/32       scram-sha-256
       host    all             all             127.0.0.1/32        trust
       host    all             all             ::1/128             trust
     '';
@@ -158,7 +159,7 @@
   services.openssh.enable = true;
 
   # Open ports in the firewall.
-  networking.firewall.allowedTCPPorts = [5432 3306]; # PostgreSQL default port
+  networking.firewall.allowedTCPPorts = [5432 3306]; # PostgreSQL and MariaDB default port
   # networking.firewall.allowedUDPPorts = [ ... ];
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;
diff --git a/nix-system-configs/docker-containers/services/part-db/docker-compose.yml b/nix-system-configs/docker-containers/services/part-db/docker-compose.yml
deleted file mode 100644
index 6c87b36..0000000
--- a/nix-system-configs/docker-containers/services/part-db/docker-compose.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-version: '3.3'
-services:
-  partdb:
-    container_name: partdb
-    # By default Part-DB will be running under Port 8080, you can change it here
-    ports:
-      - '633:80'
-    volumes:
-      # By default
-      - ./uploads:/var/www/html/uploads
-      - ./public_media:/var/www/html/public/media
-      - ./db:/var/www/html/var/db
-    restart: unless-stopped
-    image: jbtronics/part-db1:latest
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.myservice.rule=Host(`myservice.YOUR.DOMAIN`)"
-      - "traefik.http.routers.myservice.entrypoints=websecure"
-      - "traefik.http.services.myservice.loadbalancer. server.port=80"
-    depends_on:
-      - database
-    environment:
-      # Replace 4321112sss with the value of MYSQL_PASSWORD from below
-      - DATABASE_URL=mysql://partdb:4321112sss@database:3306/partdb
-      # In docker env logs will be redirected to stderr
-      - APP_ENV=docker
-
-        # Uncomment this, if you want to use the automatic database migration feature. With this you do not have to
-        # run the doctrine:migrations:migrate commands on installation or upgrade. A database backup is written to the uploads/
-        # folder (under .automigration-backup), so you can restore it, if the migration fails.
-        # This feature is currently experimental, so use it at your own risk!
-      - DB_AUTOMIGRATE=true
-
-      # You can configure Part-DB using the webUI or environment variables
-      # However you can add any other environment configuration you want here
-      # See .env file for all available options or https://docs.part-db.de/configuration.html
-
-      # Override value if you want to show a given text on homepage.
-      # When this is commented out the webUI can be used to configure the banner
-      #- BANNER=This is a test banner<br>with a line break
-
-      # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
-      # - COMPOSER_EXTRA_PACKAGES=symfony/mailgun-mailer symfony/sendgrid-mailer
-
-  database:
-    container_name: partdb_database
-    image: mysql:8.0
-    restart: unless-stopped
-    command: --default-authentication-plugin=mysql_native_password --log-bin-trust-function-creators=1
-    environment:
-      # Change this Password
-      MYSQL_ROOT_PASSWORD: jijoioajdiojasdas1123
-      MYSQL_DATABASE: partdb
-      MYSQL_USER: partdb
-      MYSQL_PASSWORD: 4321112sss
-    # Uncomment the following line if you need to access, your MySQL database from outside of docker (e.g. for debugging), normally you should leave that disabled
-    #ports:
-    #  - '4306:3306'
-    volumes:
-      - ./mysql:/var/lib/mysql
-
diff --git a/nix-system-configs/forgejo/forgejo-localconfig.nix b/nix-system-configs/forgejo-deprecated/forgejo-localconfig.nix
similarity index 100%
rename from nix-system-configs/forgejo/forgejo-localconfig.nix
rename to nix-system-configs/forgejo-deprecated/forgejo-localconfig.nix
diff --git a/nix-system-configs/forgejo/pull.zsh b/nix-system-configs/forgejo-deprecated/pull.zsh
similarity index 100%
rename from nix-system-configs/forgejo/pull.zsh
rename to nix-system-configs/forgejo-deprecated/pull.zsh
diff --git a/nix-system-configs/forgejo/push.zsh b/nix-system-configs/forgejo-deprecated/push.zsh
similarity index 100%
rename from nix-system-configs/forgejo/push.zsh
rename to nix-system-configs/forgejo-deprecated/push.zsh
diff --git a/nix-system-configs/modules/scripts/compose_two_nix.zsh b/nix-system-configs/modules/scripts/compose_two_nix.zsh
new file mode 100644
index 0000000..2fac9e7
--- /dev/null
+++ b/nix-system-configs/modules/scripts/compose_two_nix.zsh
@@ -0,0 +1,2 @@
+## Todo, make a proper script for this
+compose2nix   --inputs nix-system-configs/modules/songsheet/wavelog/docker-compose.yml   --sops_file nix-system-configs/secrets/songsheet/secrets.yaml   --project=wavelog   --output nix-system-configs/modules/songsheet/wavelog/docker-compose.nix   --root_path nix-system-configs/modules/songsheet/wavelog
\ No newline at end of file
diff --git a/nix-system-configs/modules/secrets/secrets.example.nix b/nix-system-configs/modules/secrets/secrets.example.nix
deleted file mode 100644
index 2738542..0000000
--- a/nix-system-configs/modules/secrets/secrets.example.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  # TODO Figure out a better way to manage secrets.
-  # CHECK OUT https://github.com/ryantm/agenix
-  local.secrets = {
-    gitUserName = "Your Name";
-    gitUserEmail = "you@example.com";
-    codeberg = {
-      username = "your-codeberg-user";
-      password = "your-codeberg-password-or-token";
-    };
-    sshRootPassword = "changeme";
-    tailscaleAuthKey = "";
-  };
-}
diff --git a/nix-system-configs/modules/secrets/sops-nix.nix b/nix-system-configs/modules/secrets/sops-nix.nix
new file mode 100644
index 0000000..6d26972
--- /dev/null
+++ b/nix-system-configs/modules/secrets/sops-nix.nix
@@ -0,0 +1,31 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = let
+    # replace this with an actual commit id or tag
+    commit = "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c";
+  in [
+    "${builtins.fetchTarball {
+      url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
+      # replace this with an actual hash
+      sha256 = "0000000000000000000000000000000000000000000000000000";
+    }}/modules/sops"
+  ];
+
+    # This will add secrets.yml to the nix store
+    # You can avoid this by adding a string to the full path instead, i.e.
+    # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
+    sops.defaultSopsFile = ./secrets/songsheet/secrets.yaml;
+    # This will automatically import SSH keys as age keys
+    sops.age.sshKeyPaths = [ "~/.ssh/ssh_host_ed25519_key" ];
+    # This is using an age key that is expected to already be in the filesystem
+    sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+    # This will generate a new key if the key specified above does not exist
+    sops.age.generateKey = true;
+    # This is the actual specification of the secrets.
+    sops.secrets.example-key = {};
+    sops.secrets."songsheet/database" = {};
+}
diff --git a/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix b/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
index 998500c..be56658 100644
--- a/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
+++ b/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
@@ -25,11 +25,63 @@
   virtualisation.oci-containers.backend = "podman";
 
   # Containers
+  virtualisation.oci-containers.containers."partdb" = {
+    image = "jbtronics/part-db1:latest";
+    environment = {
+      "ALLOW_ATTACHMENT_DOWNLOADS" = "0";
+      "APP_ENV" = "docker";
+      "BASE_CURRENCY" = "EUR";
+      "DATABASE_URL" = "postgresql://:@:/?charset=utf8";
+      "DEFAULT_LANG" = "en";
+      "DEFAULT_TIMEZONE" = "Europe/Berlin";
+      "INSTANCE_NAME" = "Part-DB";
+      "POSTGRES_DB" = "part_db_database";
+      "POSTGRES_HOST" = "10.1.1.251";
+      "POSTGRES_PORT" = "5432";
+      "USE_GRAVATAR" = "0";
+    };
+    environmentFiles = [
+      config.sops.secrets."songsheet/database".path
+    ];
+    volumes = [
+      "nix-system-configs/modules/songsheet/wavelog/db:/var/www/html/var/db:rw"
+      "nix-system-configs/modules/songsheet/wavelog/public_media:/var/www/html/public/media:rw"
+      "nix-system-configs/modules/songsheet/wavelog/uploads:/var/www/html/uploads:rw"
+    ];
+    ports = [
+      "8087:80/tcp"
+    ];
+    labels = {
+      "compose2nix.settings.sops.secrets" = "songsheet/database";
+    };
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=partdb"
+      "--network=wavelog_default"
+    ];
+  };
+  systemd.services."podman-partdb" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-wavelog_default.service"
+    ];
+    requires = [
+      "podman-network-wavelog_default.service"
+    ];
+    partOf = [
+      "podman-compose-wavelog-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-wavelog-root.target"
+    ];
+  };
   virtualisation.oci-containers.containers."wavelog-db" = {
     image = "mariadb:11.3";
     environment = {
       "MARIADB_DATABASE" = "wavelog";
-      "MARIADB_PASSWORD" = "oijawfjiojoijoiawf";
+      "MARIADB_PASSWORD" = "THIS_IS_NOT_IN_USE_yes";
       "MARIADB_RANDOM_ROOT_PASSWORD" = "yes";
       "MARIADB_USER" = "wavelog";
     };
diff --git a/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml b/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
index 3294ca6..bcf3cfb 100644
--- a/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
+++ b/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
@@ -1,4 +1,65 @@
 services:
+  partdb:
+    container_name: partdb
+    # By default Part-DB will be running under Port 8080, you can change it here
+    ports:
+      - '8087:80'
+    volumes:
+      # By default
+      - ./uploads:/var/www/html/uploads
+      - ./public_media:/var/www/html/public/media
+      - ./db:/var/www/html/var/db
+    restart: unless-stopped
+    labels:
+      - "compose2nix.settings.sops.secrets=songsheet/database"
+    image: jbtronics/part-db1:latest
+    environment:
+      # Put SQLite database in our mapped folder. You can configure some other kind of database here too.
+      - POSTGRES_HOST=10.1.1.251
+      - POSTGRES_PORT=5432
+      - POSTGRES_DB=part_db_database
+      - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}?charset=utf8
+      # In docker env logs will be redirected to stderr
+      - APP_ENV=docker
+
+      # Uncomment this, if you want to use the automatic database migration feature. With this you have you do not have to
+      # run the doctrine:migrations:migrate commands on installation or upgrade. A database backup is written to the uploads/
+      # folder (under .automigration-backup), so you can restore it, if the migration fails.
+      # This feature is currently experimental, so use it at your own risk!
+      # - DB_AUTOMIGRATE=true
+
+      # You can configure Part-DB using environment variables
+      # Below you can find the most essential ones predefined
+      # However you can add any other environment configuration you want here
+      # See .env file for all available options or https://docs.part-db.de/configuration.html
+      # !!! Do not use quotes around the values, as they will be interpreted as part of the value and this will lead to errors !!!
+
+      # The language to use serverwide as default (en, de, ru, etc.)
+      - DEFAULT_LANG=en
+      # The default timezone to use serverwide (e.g. Europe/Berlin)
+      - DEFAULT_TIMEZONE=Europe/Berlin
+      # The currency that is used inside the DB (and is assumed when no currency is set). This can not be changed later, so be sure to set it the currency used in your country
+      - BASE_CURRENCY=EUR
+      # The name of this installation. This will be shown as title in the browser and in the header of the website
+      - INSTANCE_NAME=Part-DB
+
+      # Allow users to download attachments to the server by providing an URL
+      # This could be a potential security issue, as the user can retrieve any file the server has access to (via internet)
+      - ALLOW_ATTACHMENT_DOWNLOADS=0
+      # Use gravatars for user avatars, when user has no own avatar defined
+      - USE_GRAVATAR=0
+
+      # Override value if you want to show a given text on homepage.
+      # When this is empty the content of config/banner.md is used as banner
+      #- BANNER=This is a test banner<br>with a line break
+
+      # If you use a reverse proxy in front of Part-DB, you must configure the trusted proxies IP addresses here (see reverse proxy documentation for more information):
+      # - TRUSTED_PROXIES=127.0.0.0/8,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+
+      # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
+      # The packages will be installed automatically when the container starts
+      # - COMPOSER_EXTRA_PACKAGES=symfony/mailgun-mailer symfony/sendgrid-mailer
+
   wavelog-db: # THIS IS NOW DANGLING BUT WILL BE THERE TO PREVENT BREAKAGE OF THE MAIN COMPOSE FILE
     image: mariadb:11.3
     container_name: wavelog-db
@@ -6,7 +67,7 @@ services:
       MARIADB_RANDOM_ROOT_PASSWORD: yes
       MARIADB_DATABASE: wavelog
       MARIADB_USER: wavelog
-      MARIADB_PASSWORD: oijawfjiojoijoiawfoij191229888dajkvhiuviuaiuhvaihuauis1123312 # THIS DATABASE IS NOW MIGRATED PROPERLY
+      MARIADB_PASSWORD: THIS_IS_NOT_IN_USE_yes # THIS DATABASE IS NOW MIGRATED PROPERLY
     volumes:
       - wavelog-dbdata:/var/lib/mysql
     restart: unless-stopped
diff --git a/nix-system-configs/modules/system/compose-songsheet.nix b/nix-system-configs/modules/system/compose-songsheet.nix
index 6ac040b..065e47b 100644
--- a/nix-system-configs/modules/system/compose-songsheet.nix
+++ b/nix-system-configs/modules/system/compose-songsheet.nix
@@ -38,6 +38,7 @@
     #
     ## Compose modules for Portainer service
     ./modules/songsheet/wavelog/docker-compose.nix
+    ./modules/secrets/sops-nix.nix
   ];
 
   config = {
diff --git a/nix-system-configs/secrets/songsheet/example.yaml b/nix-system-configs/secrets/songsheet/example.yaml
new file mode 100644
index 0000000..2eb56e9
--- /dev/null
+++ b/nix-system-configs/secrets/songsheet/example.yaml
@@ -0,0 +1,31 @@
+#ENC[AES256_GCM,data:WivH9NVGw2eQUc+4xk3IXc355x7dddo3f/C0f8Pl0JJJCBhvmGI=,iv:5g32fF7BGOUO5/5GkelUBeTP7d0oyIPhAajZHpXIKiY=,tag:fNlYIPKPH8CiZsPvQmgODg==,type:comment]
+example-key: ENC[AES256_GCM,data:aoCe/3ALWztLUQ9wyQ==,iv:BFDhmeK5LqqVvh5lBoPIaAXkV0Qi0K2maEwSFuOLO2Q=,tag:PIKqisBResQh7nhv8kxXAg==,type:str]
+#ENC[AES256_GCM,data:QMlHRBS1gtTdUMs/gzvekyAAnDHqE9KA+deYvxP18aIln5vX/aFoi/heQp/9W33hiqv5Oc4nepg=,iv:ceJjaqud+qbMWmfJHDmKJeGtO/2BsWQEzeMtQL1WZI0=,tag:QlR7GZ3Om3mT0Ycq3UdJCA==,type:comment]
+#ENC[AES256_GCM,data:E1y/QQ1q5u1nC0gjutZuiA1TN6zLWD3EI9qdu8phRZ34GNIytQ5FJpTv+P9JGUN19wpj8S/ZFX3SxqGLIxq5eCr8Zl4gL5bc,iv:3mdIV8+2BEX9NX2PfWtjqKZmR45CpEKvGrd5FqvgMhM=,tag:x5aAWNR/M3OqLRmCAx8frg==,type:comment]
+myservice:
+    my_subdir:
+        my_secret: ENC[AES256_GCM,data:mTlHHpNvgJGz,iv:Nb3HWXKMI8DopwB020lYBJc/wsLAxl+6ZpYtrtDc4Ic=,tag:sV/2xqwdWzAdcKo6Z1aS+A==,type:str]
+sops:
+    age:
+        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArMmt5dzBaOHV2ZXJNVjUx
+            Smdxc2w0QXBuQlVZZzYwK0h6Ry9ydnEyWFFNCkdZLzk5RkV0U0I0dmROdUZNUHND
+            YWRlQnRadWh4YWVHRFF4N0JsanJjc00KLS0tIFlNWG9nSUVRRnJJY0xVZDNzNVE1
+            MU5xUGlNcWxYZUR5bnI4NXlzZ1F1ejAK+jaAVZ1ePZNWzyIRNZQwLn1YIbQ6czTw
+            jOO6XHvDJAFzJotjPRqjstiB6aWzGoNXsE2DzWu0MXSIpeGpn9d3tQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1es0va2hjshgsv8tfyfjw6sfu6dm7q9u6wza3t9nevlakxzmxr4lqn2q7r6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCSGFBTktSaHorcE9iOEhh
+            NDhFbGpySXRYeGhkb1BqTjU3M0V4M0srL1ZFCk81OVRnUzhZMVNnMzlkbTc0ZDh0
+            akJqMHRXV0xvY3JqczNsV0lQeVRGNEUKLS0tIDgwYk9vOTB2aUVxWnpzRTZMQUZx
+            UzdHOG0yUGFLZnVGeExwMEp3LzJ6QncKDGGZ1LvafbZ52GOIk8SyhvPIU9hayd+G
+            FGOgC5n0pbBhk7/OM6JQrc+I5df5Kg4mAaTZ+ANgPBDUrfwFA0EyqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-07T15:38:34Z"
+    mac: ENC[AES256_GCM,data:xZg0gY7K1scWgZ4ITRLVPqx3igffvcQTf0/UyUPO7y0AEmxWpPt5sAdHJujjTjXAuSiLV8+XlEAH9ePh6gx8NZDXfscMsjyyOXGcDpYzwSfoWpFsSB4oeDkOw/vy0YTmEbs9R9pXU6Kc3TRnXbZNYzwZqgoI20GXxBesDxDrp4k=,iv:KCKtqUfdi8alD7wxVgF/wTjUoHfYC48r7Ar8NKy4TFM=,tag:U0RU11e/I4C361dDe5jH8Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
diff --git a/nix-system-configs/secrets/songsheet/secrets.yaml b/nix-system-configs/secrets/songsheet/secrets.yaml
new file mode 100644
index 0000000..b5bdf11
--- /dev/null
+++ b/nix-system-configs/secrets/songsheet/secrets.yaml
@@ -0,0 +1,25 @@
+songsheet/database: ENC[AES256_GCM,data:cNZsgTmTSjHXK7k0R7/Kz7kW6MacTkzcqZrZd/DswVm1yPQEm9oJyPNCv39LqEvKKNBa4XA0HmjaHzOBHMAr1zSG1vRRB7Fe3ZSQaxAeamRh7X7BxkxXkdvnCtcQ6wNe,iv:aF7skRVNlvoJp9UNBNMEZSMI/hRXnZ6GaDX+GOvVqdQ=,tag:Kytf5ciAd1uSUZVwfOJpbA==,type:str]
+sops:
+    age:
+        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMZE9QbHFZUGFBa0V6dVha
+            YUQ1a2FKdG96dTVvbW91VzVQL2tkZ3pKdFJBCmJmUWZYaVRmWkM3ZUNxbzhrRXg4
+            L1p1SXhvQXFzUmNaYUVhRm5PNmVzcFUKLS0tIEl0aXJGcmRPVmpmMVlSb3BZVnhL
+            K3BpOGZQbG0wR1UveGkwWUU3SjV6NU0K1ThvPddlKv/KaZceGuGv8DDKgdAi7+yZ
+            rmRI6b9IibZ7F7ECMjEB5Ks+ETi4Voi2lm8UhxlTaL8SDfJc4tCiIw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1es0va2hjshgsv8tfyfjw6sfu6dm7q9u6wza3t9nevlakxzmxr4lqn2q7r6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2NEs3NjR4Ty8xeG1HQ0JT
+            REVBN1VWRlJ3UlhsTk5BUTN2TStBMTdVa21RCkhtQWFXeXQyMFlMSnpBWnExWHR1
+            WGhMZUMzdWZlWXRkdEY4Wm5xVllIUUUKLS0tIDRyaVpLUEFKNk05SnZJZ3N6N3Vv
+            OVZNS1ErTm9hN3IvSHB3bkY1SE5OQlEK1g4PhqXmqIlDLYBiHnH7Z4hgDyhJLH8H
+            yxfbmpCb9eF3qDhTVD7Cw20sO4YX32OujkCrbnEYS5/tRxEiOyoNHQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-07T16:09:47Z"
+    mac: ENC[AES256_GCM,data:BR7Vh6P+BseiL7kiK7aHDyV8P5yWxZH3FCX4ubUevOZyGqv+J7CwO+Ezz/E6N3V5E15krfqTPJZtsA+5lXxf8Jl13ylZ/kR27iOOLFy4XTOaQ5aKMGLIjJ7Mz/V4axdfvW/rNgpKAYXth1OaGrl054ua6i6AQ95LHphbofihtTo=,iv:YUku5Nu8xA5E9vNvcGp1M/3x3ug8yNDpciGhXneUtAQ=,tag:AM0rl4ScEji9jkykYoJvzA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
diff --git a/nix-system-configs/secrets/traefik/test.yaml b/nix-system-configs/secrets/traefik/test.yaml
new file mode 100644
index 0000000..d65c93a
--- /dev/null
+++ b/nix-system-configs/secrets/traefik/test.yaml
@@ -0,0 +1,34 @@
+hello: ENC[AES256_GCM,data:Ht0+7vR6M8YQn3AiMd8VRXX8r5LIjIy/lA8wDytdZwJI8aj8NmJxgC5a5llBSA==,iv:7nmFM2BZYX//LVEdCOCtMSOJL15an/A3UOGtTjma57c=,tag:1GxNe1Kh5v4KNJAoi8TKmA==,type:str]
+example_key: ENC[AES256_GCM,data:DPLNFkv40KHgypLLWg==,iv:c3LfkDlckJbSiWBmfD6O6MXvIPM8ps8Rv1h2W9DDyOs=,tag:d+e23wPKvwFySmevmULMdQ==,type:str]
+#ENC[AES256_GCM,data:arG8CBMdLjfBCjmdyTP/lw==,iv:9PcE6aokqhUp/+j3QaJSPJ6H+YjnFOkztinI9sSTZ+k=,tag:+KNsGsKIf8XRNf2V3FRRUg==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:/nVGqCjXBoYAkdCHOrRO93/jJg==,iv:rdONhvd1j8AvWi9M19pR1p00QwuB3bz/Q/S4U8ZfjBQ=,tag:iWDJ7o4ChllJJcNDvhGthQ==,type:str]
+    - ENC[AES256_GCM,data:/Kgmo6PFheSZbNlKnUVG4rEAwA==,iv:WSEH0q234nDkiGcM3gs/vztWiV6UlkLSSy57kJWKt9c=,tag:d+hu8tM2LOSNn2orVxQZhA==,type:str]
+example_number: ENC[AES256_GCM,data:qfxirRhQiqU5XN9iRg==,iv:dTiPBUs5RCEYD04DQZxoXB8lPDrAu+Ra4NvLBmx3X9E=,tag:w43whPCNQmUumBdZ2sD5pw==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:+1KdwA==,iv:8JXmEdeukxQIDfy4eacQ48Ayl3cCRfPNcSjzQYC/Yuw=,tag:erCKahtbNDD1S8MilF09Jg==,type:bool]
+    - ENC[AES256_GCM,data:Y0eWzvE=,iv:MjhUjfHcE+WPkxnwK7m1RMujVcauo6Ftx496R+wdJ7c=,tag:FqiTsd4UinkJ1hnST20Ekw==,type:bool]
+sops:
+    age:
+        - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoaHlPc3ZZWVZJQXhXaG1u
+            OHFDVGxmcWVZbHpmRUlqYlZMRkp0WlU4L25ZCkRGbzJvRDRKOE82bUVlTFVJcTQy
+            R20rRklCZnMwbVEwQ3FtZGpYNlI3VEkKLS0tIFVLdkp1SEM1Mm1xRi9ZV0o5RlA1
+            cWtGaTJkdU12NkI4WVREOEt1VHVYYVkKs4lPeAhAazGAo5MZp7gKVYlrYBoNKBid
+            91ayxAbJKVrUnapd+QNDFG2+apDuirbWhKSxCPnLUEed+YMKNzQVgQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUWmpCTGtoS3NpdDVrMS9V
+            ZG9mZHgzeUpTWVRLVDVMbzFybmF3Q09KekJrCjlBdEZzcmxWcFUxdnNNZ2FuK3Nn
+            d1RZLytJK0RNVjdTVzFRWHpwMUMzRnMKLS0tIHFMdjErdzNDc2I1czVCRzBlR3o0
+            NkMrTEtzK3BSVWN0bk1ITHlORVd0bWcKSN/WwEZ2KJwYr3WLShF2gAG/ECKYk8ut
+            Ay3lMgsQJERQ5xQnauEqinELaN/FQHJgBFYkRgIAb/JU14a6viwDoA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-07T16:28:39Z"
+    mac: ENC[AES256_GCM,data:CK6lT9nrLAE6r+6C5vadtYr6/uP9WcbpRM1QZnNjOblaDvgfGQvQMc3u3Ddu93d9sg5M6bVIh8gUDz+f5KkqMEAnLD+thy1Zl05lDUQFm0TCy1X1uHks3V/XvMl3m5kZYFf6sq4fpN3dwdP2NdofbffyTeD8mqA9j6YHTID4yxk=,iv:GhgePFxI0L83aOaoW5LB/5Q8h730GTcmvQdktrDmRls=,tag:AzOPttDhfJmw2JfnquoAjQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0
diff --git a/nix-system-configs/traefik/pull.zsh b/nix-system-configs/traefik-deprecated/pull.zsh
similarity index 100%
rename from nix-system-configs/traefik/pull.zsh
rename to nix-system-configs/traefik-deprecated/pull.zsh
diff --git a/nix-system-configs/traefik/push.zsh b/nix-system-configs/traefik-deprecated/push.zsh
similarity index 100%
rename from nix-system-configs/traefik/push.zsh
rename to nix-system-configs/traefik-deprecated/push.zsh
diff --git a/nix-system-configs/traefik/traefik-config.nix b/nix-system-configs/traefik-deprecated/traefik-config.nix
similarity index 100%
rename from nix-system-configs/traefik/traefik-config.nix
rename to nix-system-configs/traefik-deprecated/traefik-config.nix

From 2536831d4a8bcdb3ce40baffc1d8167ce9b19ca2 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:36:54 +0100
Subject: [PATCH 02/17] Added sha and almost forgor to open port :3

---
 nix-system-configs/modules/secrets/sops-nix.nix         | 2 +-
 nix-system-configs/modules/system/compose-songsheet.nix | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/nix-system-configs/modules/secrets/sops-nix.nix b/nix-system-configs/modules/secrets/sops-nix.nix
index 6d26972..470539c 100644
--- a/nix-system-configs/modules/secrets/sops-nix.nix
+++ b/nix-system-configs/modules/secrets/sops-nix.nix
@@ -11,7 +11,7 @@
     "${builtins.fetchTarball {
       url = "https://github.com/Mic92/sops-nix/archive/${commit}.tar.gz";
       # replace this with an actual hash
-      sha256 = "0000000000000000000000000000000000000000000000000000";
+      sha256 = "ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=";
     }}/modules/sops"
   ];
 
diff --git a/nix-system-configs/modules/system/compose-songsheet.nix b/nix-system-configs/modules/system/compose-songsheet.nix
index 065e47b..e2ac055 100644
--- a/nix-system-configs/modules/system/compose-songsheet.nix
+++ b/nix-system-configs/modules/system/compose-songsheet.nix
@@ -51,11 +51,13 @@
       80
       443
       8086 # Wavelog
+      8087 # PartDB
     ];
     networking.firewall.allowedUDPPorts = [
       80
       443
       8086 # Wavelog
+      8087 # PartDB
     ];
 
     system.stateVersion = "25.11";

From 2ce94b0e7abd4138d6d661ca4fb623d53d3d38fa Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:39:33 +0100
Subject: [PATCH 03/17] Fix pathing issues

---
 nix-system-configs/modules/secrets/sops-nix.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nix-system-configs/modules/secrets/sops-nix.nix b/nix-system-configs/modules/secrets/sops-nix.nix
index 470539c..c624d10 100644
--- a/nix-system-configs/modules/secrets/sops-nix.nix
+++ b/nix-system-configs/modules/secrets/sops-nix.nix
@@ -18,9 +18,9 @@
     # This will add secrets.yml to the nix store
     # You can avoid this by adding a string to the full path instead, i.e.
     # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
-    sops.defaultSopsFile = ./secrets/songsheet/secrets.yaml;
+    sops.defaultSopsFile = ../../secrets/songsheet/secrets.yaml;
     # This will automatically import SSH keys as age keys
-    sops.age.sshKeyPaths = [ "~/.ssh/ssh_host_ed25519_key" ];
+    sops.age.sshKeyPaths = [ "~/.ssh/id_ed25519.pub" ];
     # This is using an age key that is expected to already be in the filesystem
     sops.age.keyFile = "/var/lib/sops-nix/key.txt";
     # This will generate a new key if the key specified above does not exist

From a3274fd9010a3c00b07d2275af3dcd4cc29d2420 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:42:51 +0100
Subject: [PATCH 04/17] Derp. I frogot to check assumption. Sync secrets
 directory to target location

---
 nix-system-configs/modules/scripts/pull.zsh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nix-system-configs/modules/scripts/pull.zsh b/nix-system-configs/modules/scripts/pull.zsh
index 6c61cfd..6a15763 100644
--- a/nix-system-configs/modules/scripts/pull.zsh
+++ b/nix-system-configs/modules/scripts/pull.zsh
@@ -117,6 +117,17 @@ else
     exit 1
 fi
 
+# Step 2.1: Sync secrets directory
+SECRETS_DIR="${SCRIPT_DIR}/../secrets"
+SECRETS_TARGET="/etc/nixos/secrets"
+
+if [[ -d "$SECRETS_DIR" ]]; then
+    print_info "Syncing secrets to ${BOLD}${SECRETS_TARGET}${RESET}..."
+    if sudo rsync -av --delete "${SECRETS_DIR}/" "${SECRETS_TARGET}/"; then
+        print_success "Secrets synced"
+    else
+        print_error "Failed to sync secrets"
+
 # Step 3: Copy configuration
 source_file="${SYSTEM_DIR}/${selected_system}.nix"
 print_info "Copying ${BOLD}${source_file}${RESET} to ${BOLD}${CONFIG_TARGET}${RESET}..."

From 4148c4bd07a41b5411f07a7027a0df1b0515a423 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:44:17 +0100
Subject: [PATCH 05/17] Fixed the hanging block

---
 nix-system-configs/modules/scripts/pull.zsh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nix-system-configs/modules/scripts/pull.zsh b/nix-system-configs/modules/scripts/pull.zsh
index 6a15763..15548fb 100644
--- a/nix-system-configs/modules/scripts/pull.zsh
+++ b/nix-system-configs/modules/scripts/pull.zsh
@@ -127,6 +127,12 @@ if [[ -d "$SECRETS_DIR" ]]; then
         print_success "Secrets synced"
     else
         print_error "Failed to sync secrets"
+        exit 1
+    fi
+else
+    print_warn "Secrets directory not found: ${SECRETS_DIR}"
+fi
+
 
 # Step 3: Copy configuration
 source_file="${SYSTEM_DIR}/${selected_system}.nix"

From 35c7b7e56c59fe357dc246b41a27b4e1a5008364 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:47:53 +0100
Subject: [PATCH 06/17] Fixed pathing and hard to comprehend file names due to
 homonyms.

---
 nix-system-configs/modules/scripts/pull.zsh                   | 4 +++-
 .../modules/{secrets => secrets-config}/sops-nix.nix          | 0
 2 files changed, 3 insertions(+), 1 deletion(-)
 rename nix-system-configs/modules/{secrets => secrets-config}/sops-nix.nix (100%)

diff --git a/nix-system-configs/modules/scripts/pull.zsh b/nix-system-configs/modules/scripts/pull.zsh
index 15548fb..3b0883e 100644
--- a/nix-system-configs/modules/scripts/pull.zsh
+++ b/nix-system-configs/modules/scripts/pull.zsh
@@ -118,7 +118,9 @@ else
 fi
 
 # Step 2.1: Sync secrets directory
-SECRETS_DIR="${SCRIPT_DIR}/../secrets"
+# nix-system-configs/modules/scripts  /pull.zsh
+# nix-system-configs/secrets/songsheet/secrets.yaml
+SECRETS_DIR="${SCRIPT_DIR}/../../secrets"
 SECRETS_TARGET="/etc/nixos/secrets"
 
 if [[ -d "$SECRETS_DIR" ]]; then
diff --git a/nix-system-configs/modules/secrets/sops-nix.nix b/nix-system-configs/modules/secrets-config/sops-nix.nix
similarity index 100%
rename from nix-system-configs/modules/secrets/sops-nix.nix
rename to nix-system-configs/modules/secrets-config/sops-nix.nix

From 2443b09af18fd929a44a3796cc92683db7498d1c Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:49:15 +0100
Subject: [PATCH 07/17] Am impressed that JetBrains wasn't overly sensitive and
 instead blind - fixed a typo after having fixed the homonyms.

---
 nix-system-configs/modules/system/compose-songsheet.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix-system-configs/modules/system/compose-songsheet.nix b/nix-system-configs/modules/system/compose-songsheet.nix
index e2ac055..928ecff 100644
--- a/nix-system-configs/modules/system/compose-songsheet.nix
+++ b/nix-system-configs/modules/system/compose-songsheet.nix
@@ -38,7 +38,7 @@
     #
     ## Compose modules for Portainer service
     ./modules/songsheet/wavelog/docker-compose.nix
-    ./modules/secrets/sops-nix.nix
+    ./modules/secrets-config/sops-nix.nix
   ];
 
   config = {

From ae8632b3dc977833be1c63e70e21a0c30e8ce0fb Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:50:25 +0100
Subject: [PATCH 08/17] Ok... fine... full-path it is... Nix... :sulk:

---
 nix-system-configs/modules/secrets-config/sops-nix.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix-system-configs/modules/secrets-config/sops-nix.nix b/nix-system-configs/modules/secrets-config/sops-nix.nix
index c624d10..c749d36 100644
--- a/nix-system-configs/modules/secrets-config/sops-nix.nix
+++ b/nix-system-configs/modules/secrets-config/sops-nix.nix
@@ -20,7 +20,7 @@
     # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
     sops.defaultSopsFile = ../../secrets/songsheet/secrets.yaml;
     # This will automatically import SSH keys as age keys
-    sops.age.sshKeyPaths = [ "~/.ssh/id_ed25519.pub" ];
+    sops.age.sshKeyPaths = [ "/home/songsheetprg/.ssh/id_ed25519.pub" ];
     # This is using an age key that is expected to already be in the filesystem
     sops.age.keyFile = "/var/lib/sops-nix/key.txt";
     # This will generate a new key if the key specified above does not exist

From 04e069542bcd571f079caa5db42871a290718482 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:53:59 +0100
Subject: [PATCH 09/17] Remove unused example key from sops secrets
 specification

---
 nix-system-configs/modules/secrets-config/sops-nix.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/nix-system-configs/modules/secrets-config/sops-nix.nix b/nix-system-configs/modules/secrets-config/sops-nix.nix
index c749d36..fb6f398 100644
--- a/nix-system-configs/modules/secrets-config/sops-nix.nix
+++ b/nix-system-configs/modules/secrets-config/sops-nix.nix
@@ -25,7 +25,5 @@
     sops.age.keyFile = "/var/lib/sops-nix/key.txt";
     # This will generate a new key if the key specified above does not exist
     sops.age.generateKey = true;
-    # This is the actual specification of the secrets.
-    sops.secrets.example-key = {};
     sops.secrets."songsheet/database" = {};
 }

From a110fa37bc43b75c93c02f6df46da0b29d34fc7a Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 17:58:25 +0100
Subject: [PATCH 10/17] sops-nix and compose2nix my beloveloathed

---
 nix-system-configs/modules/secrets-config/sops-nix.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/nix-system-configs/modules/secrets-config/sops-nix.nix b/nix-system-configs/modules/secrets-config/sops-nix.nix
index fb6f398..1bf326c 100644
--- a/nix-system-configs/modules/secrets-config/sops-nix.nix
+++ b/nix-system-configs/modules/secrets-config/sops-nix.nix
@@ -25,5 +25,8 @@
     sops.age.keyFile = "/var/lib/sops-nix/key.txt";
     # This will generate a new key if the key specified above does not exist
     sops.age.generateKey = true;
-    sops.secrets."songsheet/database" = {};
-}
+    # Use the flat key name with quotes
+    sops.secrets."songsheet/database" = {
+      key = "songsheet/database";
+   };
+ }

From fc1ab7ce9cafa6aaedaa8cb68a198b202e65898f Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 18:16:35 +0100
Subject: [PATCH 11/17] Oeh, will this work...?

---
 .../modules/scripts/compose_two_nix.zsh       |  1 +
 .../modules/secrets-config/sops-nix.nix       | 28 +++++++++----------
 .../secrets/songsheet/secrets.yaml            |  9 ++++--
 3 files changed, 20 insertions(+), 18 deletions(-)

diff --git a/nix-system-configs/modules/scripts/compose_two_nix.zsh b/nix-system-configs/modules/scripts/compose_two_nix.zsh
index 2fac9e7..b0e71b0 100644
--- a/nix-system-configs/modules/scripts/compose_two_nix.zsh
+++ b/nix-system-configs/modules/scripts/compose_two_nix.zsh
@@ -1,2 +1,3 @@
 ## Todo, make a proper script for this
+EDITOR=micro nix-shell -p sops --run "SOPS_AGE_KEY_FILE=$HOME/.config/sops/age/keys.txt sops nix-system-configs/secrets/songsheet/secrets.yaml"
 compose2nix   --inputs nix-system-configs/modules/songsheet/wavelog/docker-compose.yml   --sops_file nix-system-configs/secrets/songsheet/secrets.yaml   --project=wavelog   --output nix-system-configs/modules/songsheet/wavelog/docker-compose.nix   --root_path nix-system-configs/modules/songsheet/wavelog
\ No newline at end of file
diff --git a/nix-system-configs/modules/secrets-config/sops-nix.nix b/nix-system-configs/modules/secrets-config/sops-nix.nix
index 1bf326c..23cb2ed 100644
--- a/nix-system-configs/modules/secrets-config/sops-nix.nix
+++ b/nix-system-configs/modules/secrets-config/sops-nix.nix
@@ -15,18 +15,16 @@
     }}/modules/sops"
   ];
 
-    # This will add secrets.yml to the nix store
-    # You can avoid this by adding a string to the full path instead, i.e.
-    # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
-    sops.defaultSopsFile = ../../secrets/songsheet/secrets.yaml;
-    # This will automatically import SSH keys as age keys
-    sops.age.sshKeyPaths = [ "/home/songsheetprg/.ssh/id_ed25519.pub" ];
-    # This is using an age key that is expected to already be in the filesystem
-    sops.age.keyFile = "/var/lib/sops-nix/key.txt";
-    # This will generate a new key if the key specified above does not exist
-    sops.age.generateKey = true;
-    # Use the flat key name with quotes
-    sops.secrets."songsheet/database" = {
-      key = "songsheet/database";
-   };
- }
+  # This will add secrets.yml to the nix store
+  # You can avoid this by adding a string to the full path instead, i.e.
+  # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
+  sops.defaultSopsFile = ../../secrets/songsheet/secrets.yaml;
+  # This will automatically import SSH keys as age keys
+  sops.age.sshKeyPaths = ["/home/songsheetprg/.ssh/id_ed25519.pub"];
+  # This is using an age key that is expected to already be in the filesystem
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  # This will generate a new key if the key specified above does not exist
+  sops.age.generateKey = true;
+  # Use the flat key name with quotes
+  sops.secrets."songsheet/database" = {};
+}
diff --git a/nix-system-configs/secrets/songsheet/secrets.yaml b/nix-system-configs/secrets/songsheet/secrets.yaml
index b5bdf11..e6ef588 100644
--- a/nix-system-configs/secrets/songsheet/secrets.yaml
+++ b/nix-system-configs/secrets/songsheet/secrets.yaml
@@ -1,4 +1,7 @@
-songsheet/database: ENC[AES256_GCM,data:cNZsgTmTSjHXK7k0R7/Kz7kW6MacTkzcqZrZd/DswVm1yPQEm9oJyPNCv39LqEvKKNBa4XA0HmjaHzOBHMAr1zSG1vRRB7Fe3ZSQaxAeamRh7X7BxkxXkdvnCtcQ6wNe,iv:aF7skRVNlvoJp9UNBNMEZSMI/hRXnZ6GaDX+GOvVqdQ=,tag:Kytf5ciAd1uSUZVwfOJpbA==,type:str]
+songsheet:
+    database:
+        - ENC[AES256_GCM,data:XYQGalSgB0tEhyelA5pK/pwa0lz0vgoUP3c=,iv:9AzdjDVi0yexJEYHQh0Opk+j1olZd292b3Uhk7uXLUI=,tag:eeKiekxMkma1qnD3yX1EMw==,type:str]
+        - ENC[AES256_GCM,data:efrpAQ3ulmJjZCj+G3suMkgX8YFRaADNGVHkX6H4VQoR/+ARe5bmfYSDqhrajKr35i7cx5wIzNYj3lxXUFas5Ysh8tY=,iv:rLPAOKfmqxSs1+ZIqMB+f8Q3VTPOoRgtt+2O/FvpRKQ=,tag:gADCX1ClMMQfLasxbfku/w==,type:str]
 sops:
     age:
         - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
@@ -19,7 +22,7 @@ sops:
             OVZNS1ErTm9hN3IvSHB3bkY1SE5OQlEK1g4PhqXmqIlDLYBiHnH7Z4hgDyhJLH8H
             yxfbmpCb9eF3qDhTVD7Cw20sO4YX32OujkCrbnEYS5/tRxEiOyoNHQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-07T16:09:47Z"
-    mac: ENC[AES256_GCM,data:BR7Vh6P+BseiL7kiK7aHDyV8P5yWxZH3FCX4ubUevOZyGqv+J7CwO+Ezz/E6N3V5E15krfqTPJZtsA+5lXxf8Jl13ylZ/kR27iOOLFy4XTOaQ5aKMGLIjJ7Mz/V4axdfvW/rNgpKAYXth1OaGrl054ua6i6AQ95LHphbofihtTo=,iv:YUku5Nu8xA5E9vNvcGp1M/3x3ug8yNDpciGhXneUtAQ=,tag:AM0rl4ScEji9jkykYoJvzA==,type:str]
+    lastmodified: "2026-02-07T17:12:12Z"
+    mac: ENC[AES256_GCM,data:pGADihksdyIGUiADiiLxtN9rdVDHBlsW3tDmfdPy1dweNRnogdv9U11nvBJyGLaHATEshDTk+uod27u85aD0mzNGFuBss8IFOVw0e2/MZMqwmQoKpyxCiyTB7y8uAY+TUAnDsU0O8xlKQa0nuAvvnCq9hUtRMq9OFYkxMO3nn2c=,iv:GO6BccK79WMbkKH6kQiooyxMgv4HqCfI7hvxEaDUd7A=,tag:NiaRtvkLtzVfj4wzV2GSNw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

From 9db0f6672723051d2f896dcdad90d1b3c1e66eda Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 18:20:54 +0100
Subject: [PATCH 12/17] Fixed the formatting.

---
 nix-system-configs/secrets/songsheet/secrets.yaml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/nix-system-configs/secrets/songsheet/secrets.yaml b/nix-system-configs/secrets/songsheet/secrets.yaml
index e6ef588..eb74475 100644
--- a/nix-system-configs/secrets/songsheet/secrets.yaml
+++ b/nix-system-configs/secrets/songsheet/secrets.yaml
@@ -1,7 +1,5 @@
 songsheet:
-    database:
-        - ENC[AES256_GCM,data:XYQGalSgB0tEhyelA5pK/pwa0lz0vgoUP3c=,iv:9AzdjDVi0yexJEYHQh0Opk+j1olZd292b3Uhk7uXLUI=,tag:eeKiekxMkma1qnD3yX1EMw==,type:str]
-        - ENC[AES256_GCM,data:efrpAQ3ulmJjZCj+G3suMkgX8YFRaADNGVHkX6H4VQoR/+ARe5bmfYSDqhrajKr35i7cx5wIzNYj3lxXUFas5Ysh8tY=,iv:rLPAOKfmqxSs1+ZIqMB+f8Q3VTPOoRgtt+2O/FvpRKQ=,tag:gADCX1ClMMQfLasxbfku/w==,type:str]
+    database: ENC[AES256_GCM,data:ftGaGQIoauJ9FPvGwK9Els4Je6rhZxgRPdaH4mx5r6a4KInE9N/3r6JB3AzPzixfG1ODm9qjUy9vTzs8Wr+fITfGlwFN0qI5NQZNQjoJ4vhNwEZiuL/d62fMC2Vc7uBt,iv:R06wyMDQF26yWIyMXQpzcHwhTmMJokeRJa2Hk2ZPRF8=,tag:6DWPfmxo1vVO8JL0LdCmxQ==,type:str]
 sops:
     age:
         - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
@@ -22,7 +20,7 @@ sops:
             OVZNS1ErTm9hN3IvSHB3bkY1SE5OQlEK1g4PhqXmqIlDLYBiHnH7Z4hgDyhJLH8H
             yxfbmpCb9eF3qDhTVD7Cw20sO4YX32OujkCrbnEYS5/tRxEiOyoNHQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-07T17:12:12Z"
-    mac: ENC[AES256_GCM,data:pGADihksdyIGUiADiiLxtN9rdVDHBlsW3tDmfdPy1dweNRnogdv9U11nvBJyGLaHATEshDTk+uod27u85aD0mzNGFuBss8IFOVw0e2/MZMqwmQoKpyxCiyTB7y8uAY+TUAnDsU0O8xlKQa0nuAvvnCq9hUtRMq9OFYkxMO3nn2c=,iv:GO6BccK79WMbkKH6kQiooyxMgv4HqCfI7hvxEaDUd7A=,tag:NiaRtvkLtzVfj4wzV2GSNw==,type:str]
+    lastmodified: "2026-02-07T17:20:38Z"
+    mac: ENC[AES256_GCM,data:kJjVQTEdmciQ+bmVK9D3gkPHIIHx7BdnlS/UYHu51UmgRJnWd/Zlf/Az9QV9SX4jBNa6dKsyb1mLjNAhmV0AmAtEKjhr13UsrUq+9spZSGFV9t8+eD/SOE9/zUrQbfu8ynOIGVm42+eBri8acS3KVmJkmfLkEctGKaPVq0wp1wA=,iv:wQE/EMTJgIiy0/TNaU2xEwbCwE2I98H0LgXK7DBYt3I=,tag:RAT2TeWg/U6FEW7cX8EWNQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

From 5696ca0f7c56d0cabd499a3908db3c193dfc685b Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 18:25:42 +0100
Subject: [PATCH 13/17] TIL The SSH based AGE stuff is not as reliable... oeh.

---
 .sops.yaml                                    |  2 +-
 .../secrets/songsheet/secrets.yaml            | 22 +++++++++----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.sops.yaml b/.sops.yaml
index 6f03331..6c76b15 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,6 +1,6 @@
 keys:
   - &admin_christine age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
-  - &server_songsheet age1es0va2hjshgsv8tfyfjw6sfu6dm7q9u6wza3t9nevlakxzmxr4lqn2q7r6
+  - &server_songsheet age1la8yjuc2ws9pyx70rc83jd2084v5e08v8fvh6muvfzrl2ulp8fms6frs86
   - &server_traefik age1rdcs8y4fjfyagwt2q9599ax329thceersh6dg2f0p6nsghm5xufq00qu0p
 creation_rules:
   - path_regex: nix-system-configs/secrets/songsheet/[^/]+\.(yaml|json|env|ini)$
diff --git a/nix-system-configs/secrets/songsheet/secrets.yaml b/nix-system-configs/secrets/songsheet/secrets.yaml
index eb74475..325a0e9 100644
--- a/nix-system-configs/secrets/songsheet/secrets.yaml
+++ b/nix-system-configs/secrets/songsheet/secrets.yaml
@@ -5,20 +5,20 @@ sops:
         - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMZE9QbHFZUGFBa0V6dVha
-            YUQ1a2FKdG96dTVvbW91VzVQL2tkZ3pKdFJBCmJmUWZYaVRmWkM3ZUNxbzhrRXg4
-            L1p1SXhvQXFzUmNaYUVhRm5PNmVzcFUKLS0tIEl0aXJGcmRPVmpmMVlSb3BZVnhL
-            K3BpOGZQbG0wR1UveGkwWUU3SjV6NU0K1ThvPddlKv/KaZceGuGv8DDKgdAi7+yZ
-            rmRI6b9IibZ7F7ECMjEB5Ks+ETi4Voi2lm8UhxlTaL8SDfJc4tCiIw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGTXVNVG93MHA4ODk2cDVM
+            U0ZHOUwxWHJURnBENVA0amFjSGc0ekRrQXdnCllsVldocGFmYXdRRFRkdDRFK3hG
+            b3V5VE8zQy9NQ0RHWldVNTJjVXdNS28KLS0tIFp4TGxwT3cyWW11WWVEK0RaeFp6
+            Qk0ralRxZWxMd2h3RHlUZmFCaUpJOEkKNUEQwieXDgLQa3zQIeY3gZIWb2XWYBHD
+            MDSXzUpccNuNKV8I1w2VOEXy57pof89ZC9/zd2a8Msg+BjacKYlOzg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1es0va2hjshgsv8tfyfjw6sfu6dm7q9u6wza3t9nevlakxzmxr4lqn2q7r6
+        - recipient: age1la8yjuc2ws9pyx70rc83jd2084v5e08v8fvh6muvfzrl2ulp8fms6frs86
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2NEs3NjR4Ty8xeG1HQ0JT
-            REVBN1VWRlJ3UlhsTk5BUTN2TStBMTdVa21RCkhtQWFXeXQyMFlMSnpBWnExWHR1
-            WGhMZUMzdWZlWXRkdEY4Wm5xVllIUUUKLS0tIDRyaVpLUEFKNk05SnZJZ3N6N3Vv
-            OVZNS1ErTm9hN3IvSHB3bkY1SE5OQlEK1g4PhqXmqIlDLYBiHnH7Z4hgDyhJLH8H
-            yxfbmpCb9eF3qDhTVD7Cw20sO4YX32OujkCrbnEYS5/tRxEiOyoNHQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5WGpEdDNJSnJWUGpUeGdD
+            Y2xWT2x5N0p3cXZ3WHFJelhVMGYwa2taQ3hjCjhWRzJNQ1VyMk5QSDBTT0RSMktF
+            SVQxaHRDaThCYzhybzBib1djckNxZ2MKLS0tIG83MVIwSnVTeTVURFJNZkVKbVZB
+            V1F4TVEwaGgvUHcySnVQcXBHNzFuTU0KVNh7si39NVWZH9O52L9+gh1evvjotqK9
+            Zjmb97QR1C2LzEqOrfPuj6Lr86SS4RYSzSq2Oknn9o9SIs/5thR0YQ==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-02-07T17:20:38Z"
     mac: ENC[AES256_GCM,data:kJjVQTEdmciQ+bmVK9D3gkPHIIHx7BdnlS/UYHu51UmgRJnWd/Zlf/Az9QV9SX4jBNa6dKsyb1mLjNAhmV0AmAtEKjhr13UsrUq+9spZSGFV9t8+eD/SOE9/zUrQbfu8ynOIGVm42+eBri8acS3KVmJkmfLkEctGKaPVq0wp1wA=,iv:wQE/EMTJgIiy0/TNaU2xEwbCwE2I98H0LgXK7DBYt3I=,tag:RAT2TeWg/U6FEW7cX8EWNQ==,type:str]

From 9db947284fbd6615585a0eb27a9f45e10f03a413 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 18:30:59 +0100
Subject: [PATCH 14/17] Add partdb service configuration to Traefik

---
 nix-system-configs/modules/system/traefik.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix
index 5f7410b..36abf3f 100644
--- a/nix-system-configs/modules/system/traefik.nix
+++ b/nix-system-configs/modules/system/traefik.nix
@@ -97,6 +97,13 @@
             entryPoints = ["websecure"];
             tls = {};
           };
+
+          partdb = {
+            rule = "Host(`partdb.prg-radio.org`)";
+            service = "partdb";
+            entryPoints = ["websecure"];
+            tls = {};
+          };
         };
         http.services = {
           forgejo.loadBalancer = {
@@ -104,11 +111,18 @@
               {url = "http://10.1.1.4:3000";}
             ];
           };
+
           wavelog.loadBalancer = {
             servers = [
               {url = "http://10.1.1.249:8086";}
             ];
           };
+
+          partdb.loadBalancer = {
+            servers = [
+              {url = "http://10.1.1.249:8087";}
+            ];
+          };
         };
       };
     };

From e7722f83fd68b97750125e30885403a6c2ee5182 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 18:46:43 +0100
Subject: [PATCH 15/17] Fix the Part-DB pathing issues.

---
 .../modules/secrets-config/sops-nix.nix       |  2 +-
 .../songsheet/wavelog/docker-compose.nix      | 62 ++++++++-----------
 .../songsheet/wavelog/docker-compose.yml      | 14 ++---
 .../secrets/songsheet/secrets.yaml            |  7 ++-
 4 files changed, 37 insertions(+), 48 deletions(-)

diff --git a/nix-system-configs/modules/secrets-config/sops-nix.nix b/nix-system-configs/modules/secrets-config/sops-nix.nix
index 23cb2ed..3ef24f1 100644
--- a/nix-system-configs/modules/secrets-config/sops-nix.nix
+++ b/nix-system-configs/modules/secrets-config/sops-nix.nix
@@ -26,5 +26,5 @@
   # This will generate a new key if the key specified above does not exist
   sops.age.generateKey = true;
   # Use the flat key name with quotes
-  sops.secrets."songsheet/database" = {};
+  sops.secrets."songsheet/database/DATABASE_URL" = {};
 }
diff --git a/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix b/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
index be56658..d6bdedc 100644
--- a/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
+++ b/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
@@ -1,10 +1,8 @@
 # Auto-generated by compose2nix.
+
+{ pkgs, lib, config, ... }:
+
 {
-  pkgs,
-  lib,
-  config,
-  ...
-}: {
   # Runtime
   virtualisation.podman = {
     enable = true;
@@ -14,12 +12,9 @@
 
   # Enable container name DNS for all Podman networks.
   networking.firewall.interfaces = let
-    matchAll =
-      if !config.networking.nftables.enable
-      then "podman+"
-      else "podman*";
+    matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
   in {
-    "${matchAll}".allowedUDPPorts = [53];
+    "${matchAll}".allowedUDPPorts = [ 53 ];
   };
 
   virtualisation.oci-containers.backend = "podman";
@@ -30,18 +25,15 @@
     environment = {
       "ALLOW_ATTACHMENT_DOWNLOADS" = "0";
       "APP_ENV" = "docker";
-      "BASE_CURRENCY" = "EUR";
-      "DATABASE_URL" = "postgresql://:@:/?charset=utf8";
+      "BASE_CURRENCY" = "DKK";
       "DEFAULT_LANG" = "en";
-      "DEFAULT_TIMEZONE" = "Europe/Berlin";
+      "DEFAULT_TIMEZONE" = "Europe/Copenhagen";
       "INSTANCE_NAME" = "Part-DB";
-      "POSTGRES_DB" = "part_db_database";
-      "POSTGRES_HOST" = "10.1.1.251";
-      "POSTGRES_PORT" = "5432";
-      "USE_GRAVATAR" = "0";
+      "TRUSTED_PROXIES" = "10.1.1.250";
+      "USE_GRAVATAR" = "1";
     };
     environmentFiles = [
-      config.sops.secrets."songsheet/database".path
+      config.sops.secrets."songsheet/database/DATABASE_URL".path
     ];
     volumes = [
       "nix-system-configs/modules/songsheet/wavelog/db:/var/www/html/var/db:rw"
@@ -52,7 +44,7 @@
       "8087:80/tcp"
     ];
     labels = {
-      "compose2nix.settings.sops.secrets" = "songsheet/database";
+      "compose2nix.settings.sops.secrets" = "songsheet/database/DATABASE_URL";
     };
     log-driver = "journald";
     extraOptions = [
@@ -161,7 +153,7 @@
 
   # Networks
   systemd.services."podman-network-wavelog_default" = {
-    path = [pkgs.podman];
+    path = [ pkgs.podman ];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -170,13 +162,13 @@
     script = ''
       podman network inspect wavelog_default || podman network create wavelog_default
     '';
-    partOf = ["podman-compose-wavelog-root.target"];
-    wantedBy = ["podman-compose-wavelog-root.target"];
+    partOf = [ "podman-compose-wavelog-root.target" ];
+    wantedBy = [ "podman-compose-wavelog-root.target" ];
   };
 
   # Volumes
   systemd.services."podman-volume-wavelog_wavelog-config" = {
-    path = [pkgs.podman];
+    path = [ pkgs.podman ];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -184,11 +176,11 @@
     script = ''
       podman volume inspect wavelog_wavelog-config || podman volume create wavelog_wavelog-config
     '';
-    partOf = ["podman-compose-wavelog-root.target"];
-    wantedBy = ["podman-compose-wavelog-root.target"];
+    partOf = [ "podman-compose-wavelog-root.target" ];
+    wantedBy = [ "podman-compose-wavelog-root.target" ];
   };
   systemd.services."podman-volume-wavelog_wavelog-dbdata" = {
-    path = [pkgs.podman];
+    path = [ pkgs.podman ];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -196,11 +188,11 @@
     script = ''
       podman volume inspect wavelog_wavelog-dbdata || podman volume create wavelog_wavelog-dbdata
     '';
-    partOf = ["podman-compose-wavelog-root.target"];
-    wantedBy = ["podman-compose-wavelog-root.target"];
+    partOf = [ "podman-compose-wavelog-root.target" ];
+    wantedBy = [ "podman-compose-wavelog-root.target" ];
   };
   systemd.services."podman-volume-wavelog_wavelog-uploads" = {
-    path = [pkgs.podman];
+    path = [ pkgs.podman ];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -208,11 +200,11 @@
     script = ''
       podman volume inspect wavelog_wavelog-uploads || podman volume create wavelog_wavelog-uploads
     '';
-    partOf = ["podman-compose-wavelog-root.target"];
-    wantedBy = ["podman-compose-wavelog-root.target"];
+    partOf = [ "podman-compose-wavelog-root.target" ];
+    wantedBy = [ "podman-compose-wavelog-root.target" ];
   };
   systemd.services."podman-volume-wavelog_wavelog-userdata" = {
-    path = [pkgs.podman];
+    path = [ pkgs.podman ];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -220,8 +212,8 @@
     script = ''
       podman volume inspect wavelog_wavelog-userdata || podman volume create wavelog_wavelog-userdata
     '';
-    partOf = ["podman-compose-wavelog-root.target"];
-    wantedBy = ["podman-compose-wavelog-root.target"];
+    partOf = [ "podman-compose-wavelog-root.target" ];
+    wantedBy = [ "podman-compose-wavelog-root.target" ];
   };
 
   # Root service
@@ -231,6 +223,6 @@
     unitConfig = {
       Description = "Root target generated by compose2nix.";
     };
-    wantedBy = ["multi-user.target"];
+    wantedBy = [ "multi-user.target" ];
   };
 }
diff --git a/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml b/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
index bcf3cfb..3173b59 100644
--- a/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
+++ b/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
@@ -11,14 +11,9 @@ services:
       - ./db:/var/www/html/var/db
     restart: unless-stopped
     labels:
-      - "compose2nix.settings.sops.secrets=songsheet/database"
+      - "compose2nix.settings.sops.secrets=songsheet/database/DATABASE_URL"
     image: jbtronics/part-db1:latest
     environment:
-      # Put SQLite database in our mapped folder. You can configure some other kind of database here too.
-      - POSTGRES_HOST=10.1.1.251
-      - POSTGRES_PORT=5432
-      - POSTGRES_DB=part_db_database
-      - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}?charset=utf8
       # In docker env logs will be redirected to stderr
       - APP_ENV=docker
 
@@ -37,9 +32,9 @@ services:
       # The language to use serverwide as default (en, de, ru, etc.)
       - DEFAULT_LANG=en
       # The default timezone to use serverwide (e.g. Europe/Berlin)
-      - DEFAULT_TIMEZONE=Europe/Berlin
+      - DEFAULT_TIMEZONE=Europe/Copenhagen
       # The currency that is used inside the DB (and is assumed when no currency is set). This can not be changed later, so be sure to set it the currency used in your country
-      - BASE_CURRENCY=EUR
+      - BASE_CURRENCY=DKK
       # The name of this installation. This will be shown as title in the browser and in the header of the website
       - INSTANCE_NAME=Part-DB
 
@@ -47,7 +42,7 @@ services:
       # This could be a potential security issue, as the user can retrieve any file the server has access to (via internet)
       - ALLOW_ATTACHMENT_DOWNLOADS=0
       # Use gravatars for user avatars, when user has no own avatar defined
-      - USE_GRAVATAR=0
+      - USE_GRAVATAR=1
 
       # Override value if you want to show a given text on homepage.
       # When this is empty the content of config/banner.md is used as banner
@@ -55,6 +50,7 @@ services:
 
       # If you use a reverse proxy in front of Part-DB, you must configure the trusted proxies IP addresses here (see reverse proxy documentation for more information):
       # - TRUSTED_PROXIES=127.0.0.0/8,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+      - TRUSTED_PROXIES=10.1.1.250
 
       # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
       # The packages will be installed automatically when the container starts
diff --git a/nix-system-configs/secrets/songsheet/secrets.yaml b/nix-system-configs/secrets/songsheet/secrets.yaml
index 325a0e9..feef841 100644
--- a/nix-system-configs/secrets/songsheet/secrets.yaml
+++ b/nix-system-configs/secrets/songsheet/secrets.yaml
@@ -1,5 +1,6 @@
 songsheet:
-    database: ENC[AES256_GCM,data:ftGaGQIoauJ9FPvGwK9Els4Je6rhZxgRPdaH4mx5r6a4KInE9N/3r6JB3AzPzixfG1ODm9qjUy9vTzs8Wr+fITfGlwFN0qI5NQZNQjoJ4vhNwEZiuL/d62fMC2Vc7uBt,iv:R06wyMDQF26yWIyMXQpzcHwhTmMJokeRJa2Hk2ZPRF8=,tag:6DWPfmxo1vVO8JL0LdCmxQ==,type:str]
+    database:
+        DATABASE_URL: ENC[AES256_GCM,data:eKJ1u+2n59lpvue1Orysn9QEvfICSLncR1txXW3Smp9LhrADMOaEROCP/Cd+qH2p3635XSFhoPpN7E2L6l5GZSk1eNyPYdi41zycJUBzvy5rVMnBjYoBd8e+QFxrgDjZ2U7NunCwejqm5i0/5AwQ/0joJsGVwUiNcoYO,iv:ch4BF6C0qYvkCruysqBTwjZ+9mVx2AORJ2TzGM4BTqw=,tag:HqEmcIEq/Q60CSlwef6vLA==,type:str]
 sops:
     age:
         - recipient: age1746rvsvsc3snxfl7cndm222wd5kck4aqj3x7nednlegq0gdjhfcqx0qv7m
@@ -20,7 +21,7 @@ sops:
             V1F4TVEwaGgvUHcySnVQcXBHNzFuTU0KVNh7si39NVWZH9O52L9+gh1evvjotqK9
             Zjmb97QR1C2LzEqOrfPuj6Lr86SS4RYSzSq2Oknn9o9SIs/5thR0YQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-07T17:20:38Z"
-    mac: ENC[AES256_GCM,data:kJjVQTEdmciQ+bmVK9D3gkPHIIHx7BdnlS/UYHu51UmgRJnWd/Zlf/Az9QV9SX4jBNa6dKsyb1mLjNAhmV0AmAtEKjhr13UsrUq+9spZSGFV9t8+eD/SOE9/zUrQbfu8ynOIGVm42+eBri8acS3KVmJkmfLkEctGKaPVq0wp1wA=,iv:wQE/EMTJgIiy0/TNaU2xEwbCwE2I98H0LgXK7DBYt3I=,tag:RAT2TeWg/U6FEW7cX8EWNQ==,type:str]
+    lastmodified: "2026-02-07T17:44:51Z"
+    mac: ENC[AES256_GCM,data:lCQNNBpkCkzdTX+08eY4sMNFQbXSiNvBqBPro2U+OSaPvxjJRlG79K++mAnkCtFiIElSTACxOe8dTRz9frckVJQc5fL3o4PlDjeX3mzHj8V2F4DwEnQtJleLe63smtMb9ZJD3I0ivlfdcqV6GAIBtg65lQIEjgZ8tLvHSrsSpzs=,iv:PntgUV77KXsc6RLyLUBG0761GSQd/NjMA8XLyx4OBow=,tag:mI3B4aIsSTOQCOgKC6GCCg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

From 3804745fd1a70e2cae29c76b48595563829c2129 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 18:53:57 +0100
Subject: [PATCH 16/17] Fix the volume issue.

---
 .../songsheet/wavelog/docker-compose.nix      | 95 ++++++++++++++-----
 .../songsheet/wavelog/docker-compose.yml      | 16 ++--
 2 files changed, 81 insertions(+), 30 deletions(-)

diff --git a/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix b/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
index d6bdedc..e3dd7da 100644
--- a/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
+++ b/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
@@ -1,8 +1,10 @@
 # Auto-generated by compose2nix.
-
-{ pkgs, lib, config, ... }:
-
 {
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
   # Runtime
   virtualisation.podman = {
     enable = true;
@@ -12,9 +14,12 @@
 
   # Enable container name DNS for all Podman networks.
   networking.firewall.interfaces = let
-    matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+    matchAll =
+      if !config.networking.nftables.enable
+      then "podman+"
+      else "podman*";
   in {
-    "${matchAll}".allowedUDPPorts = [ 53 ];
+    "${matchAll}".allowedUDPPorts = [53];
   };
 
   virtualisation.oci-containers.backend = "podman";
@@ -36,9 +41,9 @@
       config.sops.secrets."songsheet/database/DATABASE_URL".path
     ];
     volumes = [
-      "nix-system-configs/modules/songsheet/wavelog/db:/var/www/html/var/db:rw"
-      "nix-system-configs/modules/songsheet/wavelog/public_media:/var/www/html/public/media:rw"
-      "nix-system-configs/modules/songsheet/wavelog/uploads:/var/www/html/uploads:rw"
+      "wavelog_partdb_db_f:/var/www/html/var/db:rw"
+      "wavelog_partdb_media_f:/var/www/html/public/media:rw"
+      "wavelog_partdb_uploads_f:/var/www/html/uploads:rw"
     ];
     ports = [
       "8087:80/tcp"
@@ -58,9 +63,15 @@
     };
     after = [
       "podman-network-wavelog_default.service"
+      "podman-volume-wavelog_partdb_db_f.service"
+      "podman-volume-wavelog_partdb_media_f.service"
+      "podman-volume-wavelog_partdb_uploads_f.service"
     ];
     requires = [
       "podman-network-wavelog_default.service"
+      "podman-volume-wavelog_partdb_db_f.service"
+      "podman-volume-wavelog_partdb_media_f.service"
+      "podman-volume-wavelog_partdb_uploads_f.service"
     ];
     partOf = [
       "podman-compose-wavelog-root.target"
@@ -153,7 +164,7 @@
 
   # Networks
   systemd.services."podman-network-wavelog_default" = {
-    path = [ pkgs.podman ];
+    path = [pkgs.podman];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -162,13 +173,49 @@
     script = ''
       podman network inspect wavelog_default || podman network create wavelog_default
     '';
-    partOf = [ "podman-compose-wavelog-root.target" ];
-    wantedBy = [ "podman-compose-wavelog-root.target" ];
+    partOf = ["podman-compose-wavelog-root.target"];
+    wantedBy = ["podman-compose-wavelog-root.target"];
   };
 
   # Volumes
+  systemd.services."podman-volume-wavelog_partdb_db_f" = {
+    path = [pkgs.podman];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect wavelog_partdb_db_f || podman volume create wavelog_partdb_db_f
+    '';
+    partOf = ["podman-compose-wavelog-root.target"];
+    wantedBy = ["podman-compose-wavelog-root.target"];
+  };
+  systemd.services."podman-volume-wavelog_partdb_media_f" = {
+    path = [pkgs.podman];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect wavelog_partdb_media_f || podman volume create wavelog_partdb_media_f
+    '';
+    partOf = ["podman-compose-wavelog-root.target"];
+    wantedBy = ["podman-compose-wavelog-root.target"];
+  };
+  systemd.services."podman-volume-wavelog_partdb_uploads_f" = {
+    path = [pkgs.podman];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect wavelog_partdb_uploads_f || podman volume create wavelog_partdb_uploads_f
+    '';
+    partOf = ["podman-compose-wavelog-root.target"];
+    wantedBy = ["podman-compose-wavelog-root.target"];
+  };
   systemd.services."podman-volume-wavelog_wavelog-config" = {
-    path = [ pkgs.podman ];
+    path = [pkgs.podman];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -176,11 +223,11 @@
     script = ''
       podman volume inspect wavelog_wavelog-config || podman volume create wavelog_wavelog-config
     '';
-    partOf = [ "podman-compose-wavelog-root.target" ];
-    wantedBy = [ "podman-compose-wavelog-root.target" ];
+    partOf = ["podman-compose-wavelog-root.target"];
+    wantedBy = ["podman-compose-wavelog-root.target"];
   };
   systemd.services."podman-volume-wavelog_wavelog-dbdata" = {
-    path = [ pkgs.podman ];
+    path = [pkgs.podman];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -188,11 +235,11 @@
     script = ''
       podman volume inspect wavelog_wavelog-dbdata || podman volume create wavelog_wavelog-dbdata
     '';
-    partOf = [ "podman-compose-wavelog-root.target" ];
-    wantedBy = [ "podman-compose-wavelog-root.target" ];
+    partOf = ["podman-compose-wavelog-root.target"];
+    wantedBy = ["podman-compose-wavelog-root.target"];
   };
   systemd.services."podman-volume-wavelog_wavelog-uploads" = {
-    path = [ pkgs.podman ];
+    path = [pkgs.podman];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -200,11 +247,11 @@
     script = ''
       podman volume inspect wavelog_wavelog-uploads || podman volume create wavelog_wavelog-uploads
     '';
-    partOf = [ "podman-compose-wavelog-root.target" ];
-    wantedBy = [ "podman-compose-wavelog-root.target" ];
+    partOf = ["podman-compose-wavelog-root.target"];
+    wantedBy = ["podman-compose-wavelog-root.target"];
   };
   systemd.services."podman-volume-wavelog_wavelog-userdata" = {
-    path = [ pkgs.podman ];
+    path = [pkgs.podman];
     serviceConfig = {
       Type = "oneshot";
       RemainAfterExit = true;
@@ -212,8 +259,8 @@
     script = ''
       podman volume inspect wavelog_wavelog-userdata || podman volume create wavelog_wavelog-userdata
     '';
-    partOf = [ "podman-compose-wavelog-root.target" ];
-    wantedBy = [ "podman-compose-wavelog-root.target" ];
+    partOf = ["podman-compose-wavelog-root.target"];
+    wantedBy = ["podman-compose-wavelog-root.target"];
   };
 
   # Root service
@@ -223,6 +270,6 @@
     unitConfig = {
       Description = "Root target generated by compose2nix.";
     };
-    wantedBy = [ "multi-user.target" ];
+    wantedBy = ["multi-user.target"];
   };
 }
diff --git a/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml b/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
index 3173b59..a1f8bf0 100644
--- a/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
+++ b/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
@@ -4,11 +4,6 @@ services:
     # By default Part-DB will be running under Port 8080, you can change it here
     ports:
       - '8087:80'
-    volumes:
-      # By default
-      - ./uploads:/var/www/html/uploads
-      - ./public_media:/var/www/html/public/media
-      - ./db:/var/www/html/var/db
     restart: unless-stopped
     labels:
       - "compose2nix.settings.sops.secrets=songsheet/database/DATABASE_URL"
@@ -55,6 +50,12 @@ services:
       # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
       # The packages will be installed automatically when the container starts
       # - COMPOSER_EXTRA_PACKAGES=symfony/mailgun-mailer symfony/sendgrid-mailer
+    volumes:
+      # By default
+      # Devnote: # use named volumes instead of relative paths ./uploads, etc.
+      - partdb_uploads_f:/var/www/html/uploads
+      - partdb_media_f:/var/www/html/public/media
+      - partdb_db_f:/var/www/html/var/db
 
   wavelog-db: # THIS IS NOW DANGLING BUT WILL BE THERE TO PREVENT BREAKAGE OF THE MAIN COMPOSE FILE
     image: mariadb:11.3
@@ -87,4 +88,7 @@ volumes:
   wavelog-dbdata:
   wavelog-uploads:
   wavelog-userdata:
-  wavelog-config:
\ No newline at end of file
+  wavelog-config:
+  partdb_uploads_f:
+  partdb_media_f:
+  partdb_db_f:
\ No newline at end of file

From 2981721727d1170f8b3b70c855b8a57c66515021 Mon Sep 17 00:00:00 2001
From: Christine Elisabeth Koppel <kuutruu@posteo.net>
Date: Sat, 7 Feb 2026 18:58:52 +0100
Subject: [PATCH 17/17] Add db migrations!

---
 nix-system-configs/modules/songsheet/wavelog/docker-compose.nix | 1 +
 nix-system-configs/modules/songsheet/wavelog/docker-compose.yml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix b/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
index e3dd7da..9a9169c 100644
--- a/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
+++ b/nix-system-configs/modules/songsheet/wavelog/docker-compose.nix
@@ -31,6 +31,7 @@
       "ALLOW_ATTACHMENT_DOWNLOADS" = "0";
       "APP_ENV" = "docker";
       "BASE_CURRENCY" = "DKK";
+      "DB_AUTOMIGRATE" = "true";
       "DEFAULT_LANG" = "en";
       "DEFAULT_TIMEZONE" = "Europe/Copenhagen";
       "INSTANCE_NAME" = "Part-DB";
diff --git a/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml b/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
index a1f8bf0..8036f10 100644
--- a/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
+++ b/nix-system-configs/modules/songsheet/wavelog/docker-compose.yml
@@ -16,7 +16,7 @@ services:
       # run the doctrine:migrations:migrate commands on installation or upgrade. A database backup is written to the uploads/
       # folder (under .automigration-backup), so you can restore it, if the migration fails.
       # This feature is currently experimental, so use it at your own risk!
-      # - DB_AUTOMIGRATE=true
+      - DB_AUTOMIGRATE=true
 
       # You can configure Part-DB using environment variables
       # Below you can find the most essential ones predefined