fix: add port mapping for fitdata (5311 -> 5000)

App listens on 5000 internally, need to map external 5311 to it.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

common/ham-radio.nix

@@ -0,0 +1,8 @@
+# ABOUTME: Ham radio tools profile for amateur radio operators.
+# ABOUTME: Provides CLI tools for logging and processing ham radio contacts.
+{ pkgs, ... }:
+{
+  environment.systemPackages = [
+    pkgs.custom.flecli
+  ];
+}

flake.lock

@@ -25,11 +25,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1768419206,
+        "lastModified": 1769196967,
-        "narHash": "sha256-KcWUgRnXHtqinFK7S5E9QqOqZIU9Q6eNBPZ8ANfA4aI=",
+        "narHash": "sha256-js2jXLzaZbXNFkYTszQntIS8QUJYJumSFK+3bR5nhlo=",
         "owner": "nix-community",
         "repo": "browser-previews",
-        "rev": "f89850712e7bbf566499c28303a668a19bf552b1",
+        "rev": "edc3b1c0455abc74bfe2d6e029abe5fc778b0d62",
         "type": "github"
       },
       "original": {
@@ -68,11 +68,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764011051,
+        "lastModified": 1768818222,
-        "narHash": "sha256-M7SZyPZiqZUR/EiiBJnmyUbOi5oE/03tCeFrTiUZchI=",
+        "narHash": "sha256-460jc0+CZfyaO8+w8JNtlClB2n4ui1RbHfPTLkpwhU8=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "17ed8d9744ebe70424659b0ef74ad6d41fc87071",
+        "rev": "255a2b1725a20d060f566e4755dbf571bbbb5f76",
         "type": "github"
       },
       "original": {
@@ -88,11 +88,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766150702,
+        "lastModified": 1768923567,
-        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
+        "narHash": "sha256-GVJ0jKsyXLuBzRMXCDY6D5J8wVdwP1DuQmmvYL/Vw/Q=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
+        "rev": "00395d188e3594a1507f214a2f15d4ce5c07cb28",
         "type": "github"
       },
       "original": {
@@ -115,11 +115,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1768520184,
+        "lastModified": 1769298686,
-        "narHash": "sha256-DiGuzTdnO3npTHAOPD7jio72+DCanvOSi1tUcnJiRWI=",
+        "narHash": "sha256-ZwsxXeLyrb5VinFsdjrjt/J7Tp5O2A9yy7lxWaw/h78=",
         "owner": "nix-community",
         "repo": "ethereum.nix",
-        "rev": "c3be57074b6d03c7f880578537bfc3d6ca6a1c53",
+        "rev": "d52663e0592ced611098f80224b45e57d7223453",
         "type": "github"
       },
       "original": {
@@ -170,11 +170,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765835352,
+        "lastModified": 1768135262,
-        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
         "type": "github"
       },
       "original": {
@@ -258,11 +258,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767910483,
+        "lastModified": 1768949235,
-        "narHash": "sha256-MOU5YdVu4DVwuT5ztXgQpPuRRBjSjUGIdUzOQr9iQOY=",
+        "narHash": "sha256-TtjKgXyg1lMfh374w5uxutd6Vx2P/hU81aEhTxrO2cg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "82fb7dedaad83e5e279127a38ef410bcfac6d77c",
+        "rev": "75ed713570ca17427119e7e204ab3590cc3bf2a5",
         "type": "github"
       },
       "original": {
@@ -280,11 +280,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747978958,
+        "lastModified": 1768598210,
-        "narHash": "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=",
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7419250703fd5eb50e99bdfb07a86671939103ea",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
         "type": "github"
       },
       "original": {
@@ -299,11 +299,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1767822991,
+        "lastModified": 1768941735,
-        "narHash": "sha256-iyrn9AcPZCoyxX4OT8eMkBsjG7SRUQXXS/V1JzxS7rA=",
+        "narHash": "sha256-OyxsfXNcOkt06/kM+4bnuC8moDx+t7Qr+RB0BBa83Ig=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "82e5bc4508cab9e8d5a136626276eb5bbce5e9c5",
+        "rev": "69ecf31e8fddc9354a4b418f3a517445d486bb54",
         "type": "github"
       },
       "original": {
@@ -353,11 +353,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1768499669,
+        "lastModified": 1769302137,
-        "narHash": "sha256-jJr/zDxu5evfQxlXtMrFFF68/RNj1UrctS/eIsay4k0=",
+        "narHash": "sha256-QEDtctEkOsbx8nlFh4yqPEOtr4tif6KTqWwJ37IM2ds=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "7297dfc69ae9b06e984a6f69900ce25e67c76f46",
+        "rev": "a351494b0e35fd7c0b7a1aae82f0afddf4907aa8",
         "type": "github"
       },
       "original": {
@@ -369,11 +369,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748026106,
+        "lastModified": 1768564909,
-        "narHash": "sha256-6m1Y3/4pVw1RWTsrkAK2VMYSzG4MMIj7sqUy7o8th1o=",
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "063f43f2dbdef86376cc29ad646c45c46e93234c",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
         "type": "github"
       },
       "original": {
@@ -415,11 +415,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1768395095,
+        "lastModified": 1769092226,
-        "narHash": "sha256-ZhuYJbwbZT32QA95tSkXd9zXHcdZj90EzHpEXBMabaw=",
+        "narHash": "sha256-6h5sROT/3CTHvzPy9koKBmoCa2eJKh4fzQK8eYFEgl8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "13868c071cc73a5e9f610c47d7bb08e5da64fdd5",
+        "rev": "b579d443b37c9c5373044201ea77604e37e748c8",
         "type": "github"
       },
       "original": {
@@ -431,11 +431,11 @@
     },
     "nixpkgs-unstable_2": {
       "locked": {
-        "lastModified": 1768305791,
+        "lastModified": 1769170682,
-        "narHash": "sha256-AIdl6WAn9aymeaH/NvBj0H9qM+XuAuYbGMZaP0zcXAQ=",
+        "narHash": "sha256-oMmN1lVQU0F0W2k6OI3bgdzp2YOHWYUAw79qzDSjenU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1412caf7bf9e660f2f962917c14b1ea1c3bc695e",
+        "rev": "c5296fdd05cfa2c187990dd909864da9658df755",
         "type": "github"
       },
       "original": {
@@ -447,11 +447,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1768323494,
+        "lastModified": 1769089682,
-        "narHash": "sha256-yBXJLE6WCtrGo7LKiB6NOt6nisBEEkguC/lq/rP3zRQ=",
+        "narHash": "sha256-9yA/LIuAVQq0lXelrZPjLuLVuZdm03p8tfmHhnDIkms=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2c3e5ec5df46d3aeee2a1da0bfedd74e21f4bf3a",
+        "rev": "078d69f03934859a181e81ba987c2bb033eebfc5",
         "type": "github"
       },
       "original": {
@@ -470,11 +470,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1768486009,
+        "lastModified": 1769247851,
-        "narHash": "sha256-I7ymDe6UQooHy9I9wrafKCCDnRbox/EMWAgJgpm7fGs=",
+        "narHash": "sha256-fbsopU0qWfqq1WRKjWYpYCMxmEYyq+Cmw++VXVke5Ns=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "03a638205b5cb04ba9c2ed6c604e137b15f07fa1",
+        "rev": "34a7d94cdcd2b034eb06202992bed1345aa046c9",
         "type": "github"
       },
       "original": {
@@ -507,11 +507,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768481291,
+        "lastModified": 1769314333,
-        "narHash": "sha256-NjKtkJraCZEnLHAJxLTI+BfdU//9coAz9p5TqveZwPU=",
+        "narHash": "sha256-+Uvq9h2eGsbhacXpuS7irYO7fFlz514nrhPCSTkASlw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "e085e303dfcce21adcb5fec535d65aacb066f101",
+        "rev": "2eb9eed7ef48908e0f02985919f7eb9d33fa758f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -67,6 +67,8 @@
         browser-previews = browser-previews.packages.${prev.stdenv.hostPlatform.system};
       };
 
+      overlay-custom = import ./pkgs;
+
       mkHost =
         system: profile: modules:
         let
@@ -79,7 +81,7 @@
             (
               { config, pkgs, ... }:
               {
-                nixpkgs.overlays = [ overlay-unstable overlay-browser-previews ];
+                nixpkgs.overlays = [ overlay-unstable overlay-browser-previews overlay-custom ];
                 nixpkgs.config.allowUnfree = true;
               }
             )

home/profiles/workstation.nix

@@ -5,6 +5,8 @@ let
   cliPkgs = with pkgs; [
     ast-grep
     yq
+    unstable.amp-cli
+    unstable.beads
     unstable.claude-code
     unstable.codex
     unstable.gemini-cli

home/programs/server.nix

@@ -339,6 +339,16 @@
         set pure_show_prefix_root_prompt true
         set sponge_regex_patterns 'password|passwd'
       '';
+
+      functions = {
+        brain = ''
+          echo "🧠 Brain session starting..."
+          echo "   • wrap - end session with notes"
+          echo "   • inbox: <thought> - quick capture"
+          echo ""
+          cd ~/brain && claude
+        '';
+      };
     };
 
     fzf = {

hosts/beefy/default.nix

@@ -6,6 +6,8 @@
     # Desktop environment is imported via flake.nix for desktop profile
     ../../common/cluster-member.nix  # Consul + storage clients
     ../../common/cluster-tools.nix    # Nomad CLI (no service)
+    ../../common/docker.nix           # Docker daemon
+    ../../common/ham-radio.nix        # Ham radio tools (FLEcli)
     ./hardware.nix
   ];
 

pkgs/default.nix

@@ -0,0 +1,7 @@
+# ABOUTME: Custom packages overlay for packages not in nixpkgs.
+# ABOUTME: Adds packages under pkgs.custom.* namespace.
+final: prev: {
+  custom = {
+    flecli = final.callPackage ./flecli.nix { };
+  };
+}

pkgs/flecli.nix

@@ -0,0 +1,28 @@
+# ABOUTME: FLEcli - Fast Log Entry CLI for amateur radio logging.
+# ABOUTME: Processes FLE-formatted files into ADIF for SOTA, POTA, WWFF, etc.
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "flecli";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "on4kjm";
+    repo = "FLEcli";
+    rev = "v${version}";
+    hash = "sha256-6OFcShgUaK9RwonP6cl8eOD6Cu+F5LHZEUFPjCfWNV0=";
+  };
+
+  vendorHash = "sha256-6m01rcewPyy8pUXnIMwjyW+7I08pyJaTDliwTNp3fOM=";
+
+  meta = with lib; {
+    description = "Fast Log Entry CLI - process amateur radio logs";
+    homepage = "https://github.com/on4kjm/FLEcli";
+    license = licenses.mit;
+    mainProgram = "FLEcli";
+  };
+}

services/brain.hcl

@@ -0,0 +1,50 @@
+# ABOUTME: Brain - Petre's externalized executive function system
+# ABOUTME: SilverBullet for markdown web UI + ttyd for web terminal
+
+job "brain" {
+  datacenters = ["alo"]
+
+  group "web" {
+    volume "services" {
+      type      = "host"
+      read_only = false
+      source    = "services"
+    }
+
+    network {
+      port "silverbullet" {
+        to = 3000
+      }
+    }
+
+    task "silverbullet" {
+      driver = "docker"
+      user   = "1000"
+
+      config {
+        image = "zefhemel/silverbullet:latest"
+        ports = ["silverbullet"]
+        volumes = ["/data/services/brain:/space"]
+      }
+
+      resources {
+        memory = 512
+      }
+
+      service {
+        name = "brain"
+        port = "silverbullet"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.brain.entryPoints=websecure",
+          "traefik.http.routers.brain.middlewares=oidc-auth@file",
+        ]
+      }
+    }
+
+    # TODO: terminal task with ttyd for web-based amp/claude access
+    # Needs custom image with tmux + amp + claude-code installed
+    # For now, use SSH or local terminal for amp sessions
+  }
+}

services/fitdata.hcl

@@ -0,0 +1,75 @@
+# ABOUTME: Nomad job for Fitdata - fitness data analysis and MCP server.
+# ABOUTME: Runs FastHTML Python app with SQLite, static port for MCP access.
+
+# Setup required before running:
+#   sudo mkdir -p /data/services/fitdata && sudo chown 1000:1000 /data/services/fitdata
+
+job "fitdata" {
+  datacenters = ["alo"]
+
+  meta {
+    uuid = uuidv4()
+  }
+
+  update {
+    max_parallel      = 1
+    health_check      = "checks"
+    min_healthy_time  = "30s"
+    healthy_deadline  = "5m"
+    progress_deadline = "10m"
+    auto_revert       = true
+  }
+
+  group "web" {
+    network {
+      port "http" {
+        static = 5311
+        to     = 5000
+      }
+    }
+
+    task "app" {
+      driver = "docker"
+      user   = "1000"
+
+      config {
+        image      = "gitea.v.paler.net/alo/fitdata:latest"
+        ports      = ["http"]
+        force_pull = true
+        volumes    = ["/data/services/fitdata:/var/lib/fitdata"]
+      }
+
+      env {
+        FITDATA_DATA_DIR = "/var/lib/fitdata"
+        FITDATA_DB_PATH  = "/var/lib/fitdata/fitdata.db"
+      }
+
+      resources {
+        memory = 512
+      }
+
+      service {
+        name = "fitdata"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.fitdata.entryPoints=websecure",
+          "traefik.http.routers.fitdata.middlewares=oidc-auth@file",
+        ]
+
+        check {
+          type     = "http"
+          path     = "/healthz"
+          interval = "10s"
+          timeout  = "5s"
+
+          check_restart {
+            limit = 3
+            grace = "60s"
+          }
+        }
+      }
+    }
+  }
+}

services/phaseflow-cron.hcl

@@ -1,52 +0,0 @@
-# ABOUTME: Periodic batch job for PhaseFlow Garmin sync.
-# ABOUTME: Triggers daily sync at 6 AM to fetch fitness data and generate training recommendations.
-
-job "phaseflow-cron" {
-  datacenters = ["alo"]
-  type        = "batch"
-
-  periodic {
-    crons            = ["0 6 * * *"]
-    prohibit_overlap = true
-    time_zone        = "Europe/Lisbon"
-  }
-
-  group "garmin-sync" {
-    task "trigger" {
-      driver = "raw_exec"
-
-      config {
-        command = "/bin/sh"
-        args    = ["local/script.sh"]
-      }
-
-      template {
-        destination = "local/script.sh"
-        data        = <<EOH
-set -e
-RESPONSE=$(/run/current-system/sw/bin/curl -s -w "\n%%{http_code}" -X POST \
-  -H "Authorization: Bearer $CRON_SECRET" \
-  https://phaseflow.v.paler.net/api/cron/garmin-sync)
-
-HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
-BODY=$(echo "$RESPONSE" | sed '$d')
-
-echo "$BODY"
-
-if [ "$HTTP_CODE" -ge 400 ]; then
-  echo "HTTP error: $HTTP_CODE" >&2
-  exit 1
-fi
-EOH
-      }
-
-      template {
-        destination = "secrets/env.env"
-        env         = true
-        data        = <<EOH
-{{- with nomadVar "secrets/phaseflow" -}}CRON_SECRET="{{ .cron_secret }}"{{- end -}}
-EOH
-      }
-    }
-  }
-}

services/phaseflow.hcl

@@ -4,7 +4,8 @@
 # Setup required before running:
 #   sudo mkdir -p /data/services/phaseflow/pb_data && sudo chown 1000:1000 /data/services/phaseflow /data/services/phaseflow/pb_data
 #   nomad var put secrets/phaseflow \
-#     resend_api_key="re_xxxx" \
+#     mailgun_api_key="key-xxxx" \
+#     mailgun_domain="paler.net" \
 #     encryption_key="$(openssl rand -hex 16)" \
 #     cron_secret="$(openssl rand -hex 32)" \
 #     pocketbase_admin_email="admin@example.com" \
@@ -89,6 +90,7 @@ job "phaseflow" {
         NEXT_PUBLIC_POCKETBASE_URL = "https://pocketbase-phaseflow.v.paler.net"
         APP_URL                    = "https://phaseflow.v.paler.net"
         EMAIL_FROM                 = "phaseflow@paler.net"
+        MAILGUN_URL                = "https://api.eu.mailgun.net"
       }
 
       # Secrets from Nomad variables
@@ -96,7 +98,8 @@ job "phaseflow" {
         destination = "secrets/env.env"
         env         = true
         data        = <<EOH
-RESEND_API_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .resend_api_key }}{{ end }}
+MAILGUN_API_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .mailgun_api_key }}{{ end }}
+MAILGUN_DOMAIN={{ with nomadVar "secrets/phaseflow" }}{{ .mailgun_domain }}{{ end }}
 ENCRYPTION_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .encryption_key }}{{ end }}
 CRON_SECRET={{ with nomadVar "secrets/phaseflow" }}{{ .cron_secret }}{{ end }}
 POCKETBASE_ADMIN_EMAIL={{ with nomadVar "secrets/phaseflow" }}{{ .pocketbase_admin_email }}{{ end }}

services/urbit.hcl

@@ -4,6 +4,10 @@
 job "urbit" {
   datacenters = ["alo"]
 
+  meta {
+    uuid = uuidv4()
+  }
+
   group "os" {
     network {
       port "http" {
@@ -25,7 +29,7 @@ job "urbit" {
           # You can also set a variable loom size (Urbit memory size) using
           # --loom=$LOOM_SIZE. Passing /bin/start-urbit --loom=32 for example, would set up
           # a 4GiB loom (2^32 bytes = 4GiB). The default loom size is 31 (2GiB).
-          "--loom=31",
+          "--loom=32",
         ]
         volumes = [
           "/data/services/urbit:/urbit",
@@ -45,7 +49,7 @@ job "urbit" {
 
       resources {
         # dependent on --loom setting + some buffer
-        memory = 2100
+        memory = 4200
       }
     }
   }

services/wavelog.hcl

@@ -0,0 +1,48 @@
+# ABOUTME: Nomad job spec for Wavelog amateur radio logging application
+# ABOUTME: Uses MySQL database and OIDC auth via Traefik middleware
+
+job "wavelog" {
+  datacenters = ["alo"]
+
+  group "wavelog" {
+    network {
+      port "http" {
+        to = 80
+      }
+    }
+
+    task "wavelog" {
+      driver = "docker"
+
+      config {
+        image = "ghcr.io/wavelog/wavelog:latest"
+        ports = ["http"]
+        volumes = [
+          "/data/services/wavelog/config:/var/www/html/application/config/docker",
+          "/data/services/wavelog/uploads:/var/www/html/uploads",
+          "/data/services/wavelog/userdata:/var/www/html/userdata",
+        ]
+      }
+
+      env {
+        CI_ENV = "docker"
+      }
+
+      resources {
+        cpu    = 300
+        memory = 512
+      }
+
+      service {
+        name = "wavelog"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.wavelog.entryPoints=websecure",
+          "traefik.http.routers.wavelog.middlewares=oidc-auth@file",
+        ]
+      }
+    }
+  }
+}