feat(bomba): add yamtrack

machines/bomba/secrets.nix

@@ -23,6 +23,7 @@
         indexers_ilcorsaroblu_password = default;
         gitea_registration_token = default;
         navidrome_env = default;
+        yamtrack_env = default;
       };
       templates = {
         "gitea_runner.env".content = ''

machines/bomba/services/caddy.nix

@@ -74,6 +74,9 @@
         "navidrome.patrickcanal.it".extraConfig = ''
           reverse_proxy :${toString config.services.navidrome.settings.Port}
         '';
+        "yamtrack.patrickcanal.it".extraConfig = ''
+          reverse_proxy :8014
+        '';
       };
     };
 

machines/bomba/services/default.nix

@@ -2,14 +2,15 @@
 {
   imports = [
     ./caddy.nix
-    ./navidrome.nix
     ./gitea.nix
+    ./navidrome.nix
     ./nextcloud.nix
     ./nixflix.nix
     ./octoprint.nix
     ./teamspeak.nix
     ./vaultwarden.nix
     ./vikunja.nix
+    ./yamtrack.nix
   ];
 
   services.openssh.enable = true;

machines/bomba/services/yamtrack.nix

@@ -0,0 +1,121 @@
+  # Temporary solution until https://github.com/NixOS/nixpkgs/pull/501051 gets merged
+  # TODO: Once merged change also caddy.nix accordingly
+# Auto-generated by compose2nix.
+
+{ pkgs, lib, config, ... }:
+{
+  # Enable container name DNS for all Podman networks.
+  networking.firewall.interfaces = let
+    matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
+  in {
+    "${matchAll}".allowedUDPPorts = [ 53 ];
+  };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  # Containers
+  virtualisation.oci-containers.containers."yamtrack" = {
+    image = "ghcr.io/fuzzygrim/yamtrack";
+    environmentFiles = [ config.sops.secrets.yamtrack_env.path ];
+    volumes = [
+      "/var/lib/yamtrack:/yamtrack/db:rw"
+    ];
+    ports = [
+      "8014:8000/tcp"
+    ];
+    dependsOn = [
+      "yamtrack_redis"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=yamtrack"
+      "--network=yamtrack_default"
+    ];
+  };
+  systemd.services."podman-yamtrack" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-yamtrack_default.service"
+    ];
+    requires = [
+      "podman-network-yamtrack_default.service"
+    ];
+    partOf = [
+      "podman-compose-yamtrack-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-yamtrack-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."yamtrack_redis" = {
+    image = "redis:8-alpine";
+    volumes = [
+      "yamtrack_redis_data:/data:rw"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=yamtrack_redis"
+      "--network=yamtrack_default"
+    ];
+  };
+  systemd.services."podman-yamtrack_redis" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+    };
+    after = [
+      "podman-network-yamtrack_default.service"
+      "podman-volume-yamtrack_redis_data.service"
+    ];
+    requires = [
+      "podman-network-yamtrack_default.service"
+      "podman-volume-yamtrack_redis_data.service"
+    ];
+    partOf = [
+      "podman-compose-yamtrack-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-yamtrack-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."podman-network-yamtrack_default" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "podman network rm -f yamtrack_default";
+    };
+    script = ''
+      podman network inspect yamtrack_default || podman network create yamtrack_default
+    '';
+    partOf = [ "podman-compose-yamtrack-root.target" ];
+    wantedBy = [ "podman-compose-yamtrack-root.target" ];
+  };
+
+  # Volumes
+  systemd.services."podman-volume-yamtrack_redis_data" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect yamtrack_redis_data || podman volume create yamtrack_redis_data
+    '';
+    partOf = [ "podman-compose-yamtrack-root.target" ];
+    wantedBy = [ "podman-compose-yamtrack-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-yamtrack-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

machines/bomba/virtualisation.nix

@@ -1,11 +1,15 @@
 { pkgs, ... }:
 {
   virtualisation = {
-    docker.enable = true;
     spiceUSBRedirection.enable = true;
     libvirtd = {
       enable = true;
       package = pkgs.qemu_kvm;
     };
+    podman = {
+      enable = true;
+      autoPrune.enable = true;
+      dockerCompat = true;
+    };
   };
 }

secrets/bomba.sops.yaml

@@ -11,6 +11,7 @@ seerr_api_key: ENC[AES256_GCM,data:KDQxxo2W4tz9UokscAUSz7pf7wY2AfsEQpZh2aXGjsQOB
 indexers_ilcorsaroblu_password: ENC[AES256_GCM,data:w3CIGQqLxHEkUHvscZc=,iv:fjsB3zt4Z43MKRECjpa7+gNDzM8D+JK0sbKt2P+Hdiw=,tag:KvLawon+KfrhGmi1TWRHLw==,type:str]
 gitea_registration_token: ENC[AES256_GCM,data:aHoUBwPXtlme9RgGObwWt1V90JU5qeVBUtpINrb1hY6XjKi4+kLxAg==,iv:zkgDdx82Lku7/oNIoSoKUIrxvZuyPaGUI411V/rkW9c=,tag:0eBC0Kd71UwokH9scs/AKA==,type:str]
 navidrome_env: ENC[AES256_GCM,data:SjEg735zoiWNjp0+uYi5CyLadDd7mSXpG1LInLsaqESz0LNgMi+r46ohPjpEC3GD+WbE9D3XRwhB22oIey3K7p3GdB/bYjIR6wOa8MVjj3EDvzdBWbnhkXsGnIhLGuyZwDmMdA==,iv:gHv7lZzU09V3XVjs3nEOEm55xRwD23+sVWfgbuX18p4=,tag:8UAMIGXPGobQfBAao2nI6Q==,type:str]
+yamtrack_env: ENC[AES256_GCM,data:OCx2KlW+yz330wEhEud/NO4CSnyG1+c9C7EUqQa+6+mk9ICjbtzrWucOZ0UG2/WOpb+xpdjCUq3Dam38GrxOIL9ZFwb9O0dWjGv8gzo0fKO6LbRvSLry8aub3M117dFP3j7y7AFqDR49XhhGhD1IomgQna6elJkWMEGUG+4=,iv:rWY5loBqQrDR5/xipRQXpTZr6vuwM9AEgNSFtSnqLhw=,tag:kfpMTc2rAJzhUGKqbxdyTg==,type:str]
 sops:
     age:
         - enc: |
@@ -22,7 +23,7 @@ sops:
             ZQ17gIIOjhKHlGx8Lo5t/PekzFyQKCKdijS7caq74dVib1vO3tk+uQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ynu6zhhy84rr5xqce0flp25x5tnfgskesxfe39u7ewsk900fvagq9sq0lx
-    lastmodified: "2026-07-02T05:25:14Z"
-    mac: ENC[AES256_GCM,data:TUdnr6cRqsw+6/yRLAEN4CljcEtr8W+/4VDs9hV/0UDYwl7d0rhqiJK5n/zEBSoB9xcMLiyZBt7p3LJX/CzQcJ6OptCxLyBPMPsWXHk+VgPDK1mRb76ztzsEOyIWx4NtGImy19Q3ljbqw4YPxCqnVe+OU055NwFoTGTogXr2o1A=,iv:6C6owi9l5/pRaq16T8jgCxa3K5E0f7II+AzJknEt7AA=,tag:/rl388Jl2Uc4nmiOlHeTXg==,type:str]
+    lastmodified: "2026-07-08T03:35:11Z"
+    mac: ENC[AES256_GCM,data:pwofzybpsR2RcOPEIO4g18BOFYZU+o/dqQ5yhiCqQP+rG09y37DeMbCsMukBXAwMMvBWWJRHvr2pesdufw05uq/eWSmQdWdQxqkPkv85c1vQn8RqoZlfhM5IaaxqV+DSjsSy6bh+XZJ8kjwnVJ87zCFRI+1j7l56+Bqosmy+bCs=,iv:U6e5FvD3+vyz1m1KxvFK0e+BbSspNYCqoclTGC5lctk=,tag:0RvZAY6zWHXtQP3PQ4+m+w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1