System/Servenix: Enable arcane service

system/servenix/default.nix

@@ -22,6 +22,7 @@
     ../services/statespaces.nix
 
     # General services
+    ../services/arcane.nix
     ../services/authelia.nix
     ../services/bazarr.nix
     ../services/fileflows.nix
@@ -29,7 +30,7 @@
     ../services/immich.nix
     ../services/jellyfin.nix
     ../services/kiwix.nix
-    ../services/kopia.nix
+    # ../services/kopia.nix
     ../services/nextcloud.nix
     ../services/ntfy.nix
     ../services/nginx-proxy-manager.nix

system/services/arcane.nix

@@ -0,0 +1,55 @@
+{
+  mylib,
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  arcaneVersion = "v2.3.0";
+in {
+  # If we need to pass secrets to containers we can't use plain env variables.
+  sops.templates."arcane_secrets.env".content = ''
+    ENCRYPTION_KEY=${config.sops.placeholder.arcane-encryption-key}
+    JWT_SECRET=${config.sops.placeholder.arcane-jwt-secret}
+  '';
+
+  virtualisation.oci-containers.containers = {
+    arcane = {
+      image = "ghcr.io/getarcaneapp/manager:${arcaneVersion}";
+      autoStart = true;
+
+      login = mylib.containers.mkDockerLogin config;
+
+      dependsOn = [];
+
+      ports = [
+        # "3552:3552"
+      ];
+
+      volumes = [
+        "/var/run/docker.sock:/var/run/docker.sock"
+
+        "arcane_data:/app/data"
+        "/media/synology-syncthing:/backups"
+      ];
+
+      environment = {
+        APP_URL = "https://arcane.local.chriphost.de";
+
+        PUID = "1000";
+        PGID = "1000";
+        TZ = "Europe/Berlin";
+      };
+
+      environmentFiles = [
+        config.sops.templates."TEMPLATE_secrets.env".path
+      ];
+
+      extraOptions = [
+        # "--privileged"
+        # "--device=nvidia.com/gpu=all"
+        "--net=behind-nginx"
+      ];
+    };
+  };
+}

system/systemmodules/sops-nix/secrets.yaml

@@ -21,14 +21,15 @@ kopia-user-password: ENC[AES256_GCM,data:jPWeru4e2w9qzA==,iv:WpZS3Qmx8v12v3q1Lq1
 paperless-nextcloud-sync-password: ENC[AES256_GCM,data:pfLg3OVBqLsM4R7mSgLQEachj9gMkexPjBMSyzU=,iv:XBe1cdwlTjPfQW70NIEjD8CikK58iGErI9ZTlLWtCA4=,tag:qO35GdjljgS3/z5/1fCOFg==,type:str]
 ntfy-auth-users: ENC[AES256_GCM,data:IHnJJgUL9RqkEAoJ2Q9Oo0RkfgLXG7vih5NFPrPNBoIzMafdLXxHqNOAd1oRaOUd6AKmWdQ3uKAZINj7oGZEKMsMxUEv1WW6IXUuPnDeJe5EthINWCuaW2Z64PJl+uqgnWr4wDi7QT0zwjb/oL3gYfjH1xtfMadTzkWbmnxQ9jlP/nXe9JR1/oCrHv3dio5uU017cA==,iv:JmWnu25ZB/qqI2RsgHQ0bcat69V7p5MJ6cf5eFcSsns=,tag:6Z2LseCav/qyLh2nn+7uuw==,type:str]
 ntfy-auth-tokens: ENC[AES256_GCM,data:C23r9djvEukUgDDloFGm52spwcW1DB5Jcwt9kxghLjL3vNiQ9HzGrvlSl5oEppoNa23BF0+t,iv:O9LepUKGbyXTHMvwn1avdJEhcMgtr2Sb1imIJ8ALMYY=,tag:o3g6f7YZL2VfgfeymzJK1g==,type:str]
+arcane-encryption-key: ENC[AES256_GCM,data:4H2kaQwIV5m0FVv+3IlNaw85V00r8W4SQ5cOSOskljtaUkFUteHzamj9KH7NxdKY+pxFkrvwIOIAhNYQTMRBSQ==,iv:FDx8IYu7B7jENtGnFiS7U7W2pDIwz9ibfuCNL0UBX6c=,tag:WSm/SwCs8sSynXeXi3+muw==,type:str]
+arcane-jwt-secret: ENC[AES256_GCM,data:BMC/Hju/FkHxXjdZrVr9xjiqs9Uny/w/k14K+b+DYgPOlPYMH+YSZQ/3/yyw5j52FNcm+lDG2drTaO0NfBKJsQ==,iv:gHU78Fw1L6Igp+Jewq5xqW39tSGvGh/HREcd+HX/nO4=,tag:KTL21t2kKWsB3zm7x+T0SA==,type:str]
 #
 #ENC[AES256_GCM,data:Gdh/hjCaOuAE,iv:XjPXn3SskpUPUkDIEDl5701/g9QhuS83fACMaoPMiIM=,tag:Q7s8xZG/GsOtQrasekBnkQ==,type:comment]
 #
 wireguard-vps-private-key: ENC[AES256_GCM,data:B6IWYuzKV9YZ+G9GIjOsXVEVugwMY14PrwmYyHsFAJEb1OJRXMg8+zeFnqs=,iv:2QroGA10UVSmNIBHFSTeCgMBD3VjtiUnng3pkR/mPVQ=,tag:FGlCrmdccgsObyut6E5ggA==,type:str]
 sops:
     age:
-        - recipient: age14ph8vrj657e7s35d60xehzuq46t9zd6pzcm6pw4jragzrvf6xs9s77usnm
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWSVRhVDREMXduZElrRklE
             R2s3Y081TGVTOCtKWVVWN0RLb0ZIT3lmMTNZCjFaNmRqb2hRVXFDSU12dFhDNmJo
@@ -36,7 +37,8 @@ sops:
             SURMTmh1TGIrRmtENzc0Sk4rNFJNUE0KOpjN6jkEHO+lvdWdp4P++r9SNSPWaT0h
             FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-17T12:17:23Z"
-    mac: ENC[AES256_GCM,data:YEHM2ebPhV6ycj8OxNy7mOlpy6VrvV6Gz9sHEWc9alnrwZ0qLzp5m4AUMuWBSfFTMtVgeAFdJ8Nf4X5b+AzQXahlHWJVAwiMiE8KqhRLGWF21OyDN2aIdwd4ue2vYyPDGYP43mC+19v9SW5isF901G28e5Q9SxmGJjNOkiVuiCI=,iv:WFvCN/7YGQnCSqjXBkkfiuPoNQ37bpxHx9jreZDc3EM=,tag:AUjFpbJ6//eScnn6P2QMgA==,type:str]
+          recipient: age14ph8vrj657e7s35d60xehzuq46t9zd6pzcm6pw4jragzrvf6xs9s77usnm
+    lastmodified: "2026-07-02T14:10:41Z"
+    mac: ENC[AES256_GCM,data:Vz3yNBRZCBbbYEfydArDGHYyHMFipe3n1i9o8hg/uo5Vuj09SCBj8kdemVW9O6mlAWBsQ4BVqG18xi0/HEAmN37N9FGSyPecak+3h/OvveNeJUFl5sfiGDQH4aln9ytJ1+PkgVHP/cBjHVZv20IpgzVW5z3jb/qYGBaWpx2qIPQ=,iv:OUf5gwnSGVuvEZSNJp+pzd3kHGLSodRa5HAvo3pOlMk=,tag:6CRpctUHyuIkAQIAUBrfMg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.1