feat: add fitdata Nomad job

Static port 5311 for MCP access (5/3/1 reference).
OIDC protected via Traefik middleware.

Setup: sudo mkdir -p /data/services/fitdata && sudo chown 1000:1000 /data/services/fitdata

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

common/ham-radio.nix

@@ -0,0 +1,8 @@
+# ABOUTME: Ham radio tools profile for amateur radio operators.
+# ABOUTME: Provides CLI tools for logging and processing ham radio contacts.
+{ pkgs, ... }:
+{
+  environment.systemPackages = [
+    pkgs.custom.flecli
+  ];
+}

flake.lock

@@ -25,11 +25,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1767987169,
+        "lastModified": 1769196967,
-        "narHash": "sha256-HRydj8HYesU+zGVf+g+tS9vTHMZpZU+MgnTjq8AYYXk=",
+        "narHash": "sha256-js2jXLzaZbXNFkYTszQntIS8QUJYJumSFK+3bR5nhlo=",
         "owner": "nix-community",
         "repo": "browser-previews",
-        "rev": "2e9b12d065f95b4c670316baa572376e5d9a8d32",
+        "rev": "edc3b1c0455abc74bfe2d6e029abe5fc778b0d62",
         "type": "github"
       },
       "original": {
@@ -68,11 +68,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764011051,
+        "lastModified": 1768818222,
-        "narHash": "sha256-M7SZyPZiqZUR/EiiBJnmyUbOi5oE/03tCeFrTiUZchI=",
+        "narHash": "sha256-460jc0+CZfyaO8+w8JNtlClB2n4ui1RbHfPTLkpwhU8=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "17ed8d9744ebe70424659b0ef74ad6d41fc87071",
+        "rev": "255a2b1725a20d060f566e4755dbf571bbbb5f76",
         "type": "github"
       },
       "original": {
@@ -88,11 +88,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766150702,
+        "lastModified": 1768923567,
-        "narHash": "sha256-P0kM+5o+DKnB6raXgFEk3azw8Wqg5FL6wyl9jD+G5a4=",
+        "narHash": "sha256-GVJ0jKsyXLuBzRMXCDY6D5J8wVdwP1DuQmmvYL/Vw/Q=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "916506443ecd0d0b4a0f4cf9d40a3c22ce39b378",
+        "rev": "00395d188e3594a1507f214a2f15d4ce5c07cb28",
         "type": "github"
       },
       "original": {
@@ -115,11 +115,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1767776044,
+        "lastModified": 1769298686,
-        "narHash": "sha256-yNLLrf4qKubvO11vTH6FjfPV2iCcNusivuzngEEuc+w=",
+        "narHash": "sha256-ZwsxXeLyrb5VinFsdjrjt/J7Tp5O2A9yy7lxWaw/h78=",
         "owner": "nix-community",
         "repo": "ethereum.nix",
-        "rev": "34217e7d20d6ed04170a1347db346df068669090",
+        "rev": "d52663e0592ced611098f80224b45e57d7223453",
         "type": "github"
       },
       "original": {
@@ -149,11 +149,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1763759067,
+        "lastModified": 1768135262,
-        "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
         "type": "github"
       },
       "original": {
@@ -170,11 +170,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1765835352,
+        "lastModified": 1768135262,
-        "narHash": "sha256-XswHlK/Qtjasvhd1nOa1e8MgZ8GS//jBoTqWtrS1Giw=",
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "a34fae9c08a15ad73f295041fec82323541400a9",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1764753179,
+        "lastModified": 1767517855,
-        "narHash": "sha256-2u7C/aKEcCpND60JfREYhKaMg/0cZ/pk1HviizWrCl8=",
+        "narHash": "sha256-LnZosb07bahYAyFw07JFzSXslx9j1dCe+npWDZdPFZg=",
         "owner": "shazow",
         "repo": "foundry.nix",
-        "rev": "8c21d3ac7a03da27af55d3c94fe95620c9d6f316",
+        "rev": "ee376e8a93f537c2865dda9811e748e4567a7aaf",
         "type": "github"
       },
       "original": {
@@ -258,11 +258,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1767910483,
+        "lastModified": 1768949235,
-        "narHash": "sha256-MOU5YdVu4DVwuT5ztXgQpPuRRBjSjUGIdUzOQr9iQOY=",
+        "narHash": "sha256-TtjKgXyg1lMfh374w5uxutd6Vx2P/hU81aEhTxrO2cg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "82fb7dedaad83e5e279127a38ef410bcfac6d77c",
+        "rev": "75ed713570ca17427119e7e204ab3590cc3bf2a5",
         "type": "github"
       },
       "original": {
@@ -280,11 +280,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747978958,
+        "lastModified": 1768598210,
-        "narHash": "sha256-pQQnbxWpY3IiZqgelXHIe/OAE/Yv4NSQq7fch7M6nXQ=",
+        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7419250703fd5eb50e99bdfb07a86671939103ea",
+        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
         "type": "github"
       },
       "original": {
@@ -299,11 +299,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1767822991,
+        "lastModified": 1768941735,
-        "narHash": "sha256-iyrn9AcPZCoyxX4OT8eMkBsjG7SRUQXXS/V1JzxS7rA=",
+        "narHash": "sha256-OyxsfXNcOkt06/kM+4bnuC8moDx+t7Qr+RB0BBa83Ig=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "82e5bc4508cab9e8d5a136626276eb5bbce5e9c5",
+        "rev": "69ecf31e8fddc9354a4b418f3a517445d486bb54",
         "type": "github"
       },
       "original": {
@@ -353,11 +353,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1767185284,
+        "lastModified": 1769302137,
-        "narHash": "sha256-ljDBUDpD1Cg5n3mJI81Hz5qeZAwCGxon4kQW3Ho3+6Q=",
+        "narHash": "sha256-QEDtctEkOsbx8nlFh4yqPEOtr4tif6KTqWwJ37IM2ds=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "40b1a28dce561bea34858287fbb23052c3ee63fe",
+        "rev": "a351494b0e35fd7c0b7a1aae82f0afddf4907aa8",
         "type": "github"
       },
       "original": {
@@ -369,11 +369,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748026106,
+        "lastModified": 1768564909,
-        "narHash": "sha256-6m1Y3/4pVw1RWTsrkAK2VMYSzG4MMIj7sqUy7o8th1o=",
+        "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "063f43f2dbdef86376cc29ad646c45c46e93234c",
+        "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f",
         "type": "github"
       },
       "original": {
@@ -385,11 +385,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1761765539,
+        "lastModified": 1765674936,
-        "narHash": "sha256-b0yj6kfvO8ApcSE+QmA6mUfu8IYG6/uU28OFn4PaC8M=",
+        "narHash": "sha256-k00uTP4JNfmejrCLJOwdObYC9jHRrr/5M/a/8L2EIdo=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "719359f4562934ae99f5443f20aa06c2ffff91fc",
+        "rev": "2075416fcb47225d9b68ac469a5c4801a9c4dd85",
         "type": "github"
       },
       "original": {
@@ -415,11 +415,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1765270179,
+        "lastModified": 1769092226,
-        "narHash": "sha256-g2a4MhRKu4ymR4xwo+I+auTknXt/+j37Lnf0Mvfl1rE=",
+        "narHash": "sha256-6h5sROT/3CTHvzPy9koKBmoCa2eJKh4fzQK8eYFEgl8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "677fbe97984e7af3175b6c121f3c39ee5c8d62c9",
+        "rev": "b579d443b37c9c5373044201ea77604e37e748c8",
         "type": "github"
       },
       "original": {
@@ -431,11 +431,11 @@
     },
     "nixpkgs-unstable_2": {
       "locked": {
-        "lastModified": 1767892417,
+        "lastModified": 1769170682,
-        "narHash": "sha256-dhhvQY67aboBk8b0/u0XB6vwHdgbROZT3fJAjyNh5Ww=",
+        "narHash": "sha256-oMmN1lVQU0F0W2k6OI3bgdzp2YOHWYUAw79qzDSjenU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "rev": "c5296fdd05cfa2c187990dd909864da9658df755",
         "type": "github"
       },
       "original": {
@@ -447,11 +447,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1767799921,
+        "lastModified": 1769089682,
-        "narHash": "sha256-r4GVX+FToWVE2My8VVZH4V0pTIpnu2ZE8/Z4uxGEMBE=",
+        "narHash": "sha256-9yA/LIuAVQq0lXelrZPjLuLVuZdm03p8tfmHhnDIkms=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d351d0653aeb7877273920cd3e823994e7579b0b",
+        "rev": "078d69f03934859a181e81ba987c2bb033eebfc5",
         "type": "github"
       },
       "original": {
@@ -470,11 +470,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1767906546,
+        "lastModified": 1769247851,
-        "narHash": "sha256-AoSWS8+P+7hQ/jIdv0wBjgH1MvnerdWBFXO4GV3JoQs=",
+        "narHash": "sha256-fbsopU0qWfqq1WRKjWYpYCMxmEYyq+Cmw++VXVke5Ns=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "7eb8f36f085b85a2aeff929aff52d0f6aa14e000",
+        "rev": "34a7d94cdcd2b034eb06202992bed1345aa046c9",
         "type": "github"
       },
       "original": {
@@ -507,11 +507,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768032389,
+        "lastModified": 1769314333,
-        "narHash": "sha256-BVpTd93G0XmAK1iXiBdhUA5Uvt+WmM1YL0mA4REcT68=",
+        "narHash": "sha256-+Uvq9h2eGsbhacXpuS7irYO7fFlz514nrhPCSTkASlw=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "a8cfe238b93166f9f96c0df67a94e572554ee624",
+        "rev": "2eb9eed7ef48908e0f02985919f7eb9d33fa758f",
         "type": "github"
       },
       "original": {
@@ -588,11 +588,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1766000401,
+        "lastModified": 1768158989,
-        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
+        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
         "type": "github"
       },
       "original": {

flake.nix

@@ -58,15 +58,17 @@
 
       overlay-unstable = final: prev: {
         unstable = import nixpkgs-unstable {
-          inherit (prev) system;
+          system = prev.stdenv.hostPlatform.system;
           config.allowUnfree = true;
         };
       };
 
       overlay-browser-previews = final: prev: {
-        browser-previews = browser-previews.packages.${prev.system};
+        browser-previews = browser-previews.packages.${prev.stdenv.hostPlatform.system};
       };
 
+      overlay-custom = import ./pkgs;
+
       mkHost =
         system: profile: modules:
         let
@@ -79,7 +81,7 @@
             (
               { config, pkgs, ... }:
               {
-                nixpkgs.overlays = [ overlay-unstable overlay-browser-previews ];
+                nixpkgs.overlays = [ overlay-unstable overlay-browser-previews overlay-custom ];
                 nixpkgs.config.allowUnfree = true;
               }
             )

home/profiles/workstation.nix

@@ -5,6 +5,8 @@ let
   cliPkgs = with pkgs; [
     ast-grep
     yq
+    unstable.amp-cli
+    unstable.beads
     unstable.claude-code
     unstable.codex
     unstable.gemini-cli

home/programs/desktop/hyprland/input.nix

@@ -15,9 +15,5 @@
         natural_scroll = false;
       };
     };
-
-    gestures = lib.mkDefault {
-      workspace_swipe = false;
-    };
   };
 }

home/programs/server.nix

@@ -339,6 +339,16 @@
         set pure_show_prefix_root_prompt true
         set sponge_regex_patterns 'password|passwd'
       '';
+
+      functions = {
+        brain = ''
+          echo "🧠 Brain session starting..."
+          echo "   • wrap - end session with notes"
+          echo "   • inbox: <thought> - quick capture"
+          echo ""
+          cd ~/brain && claude
+        '';
+      };
     };
 
     fzf = {
@@ -347,8 +357,12 @@
 
     git = {
       enable = true;
-      userEmail = "petru@paler.net";
+      settings = {
-      userName = "Petru Paler";
+        user = {
+          email = "petru@paler.net";
+          name = "Petru Paler";
+        };
+      };
     };
 
     home-manager = {

hosts/beefy/default.nix

@@ -6,6 +6,8 @@
     # Desktop environment is imported via flake.nix for desktop profile
     ../../common/cluster-member.nix  # Consul + storage clients
     ../../common/cluster-tools.nix    # Nomad CLI (no service)
+    ../../common/docker.nix           # Docker daemon
+    ../../common/ham-radio.nix        # Ham radio tools (FLEcli)
     ./hardware.nix
   ];
 

pkgs/default.nix

@@ -0,0 +1,7 @@
+# ABOUTME: Custom packages overlay for packages not in nixpkgs.
+# ABOUTME: Adds packages under pkgs.custom.* namespace.
+final: prev: {
+  custom = {
+    flecli = final.callPackage ./flecli.nix { };
+  };
+}

pkgs/flecli.nix

@@ -0,0 +1,28 @@
+# ABOUTME: FLEcli - Fast Log Entry CLI for amateur radio logging.
+# ABOUTME: Processes FLE-formatted files into ADIF for SOTA, POTA, WWFF, etc.
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "flecli";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "on4kjm";
+    repo = "FLEcli";
+    rev = "v${version}";
+    hash = "sha256-6OFcShgUaK9RwonP6cl8eOD6Cu+F5LHZEUFPjCfWNV0=";
+  };
+
+  vendorHash = "sha256-6m01rcewPyy8pUXnIMwjyW+7I08pyJaTDliwTNp3fOM=";
+
+  meta = with lib; {
+    description = "Fast Log Entry CLI - process amateur radio logs";
+    homepage = "https://github.com/on4kjm/FLEcli";
+    license = licenses.mit;
+    mainProgram = "FLEcli";
+  };
+}

services/brain.hcl

@@ -0,0 +1,50 @@
+# ABOUTME: Brain - Petre's externalized executive function system
+# ABOUTME: SilverBullet for markdown web UI + ttyd for web terminal
+
+job "brain" {
+  datacenters = ["alo"]
+
+  group "web" {
+    volume "services" {
+      type      = "host"
+      read_only = false
+      source    = "services"
+    }
+
+    network {
+      port "silverbullet" {
+        to = 3000
+      }
+    }
+
+    task "silverbullet" {
+      driver = "docker"
+      user   = "1000"
+
+      config {
+        image = "zefhemel/silverbullet:latest"
+        ports = ["silverbullet"]
+        volumes = ["/data/services/brain:/space"]
+      }
+
+      resources {
+        memory = 512
+      }
+
+      service {
+        name = "brain"
+        port = "silverbullet"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.brain.entryPoints=websecure",
+          "traefik.http.routers.brain.middlewares=oidc-auth@file",
+        ]
+      }
+    }
+
+    # TODO: terminal task with ttyd for web-based amp/claude access
+    # Needs custom image with tmux + amp + claude-code installed
+    # For now, use SSH or local terminal for amp sessions
+  }
+}

services/fitdata.hcl

@@ -0,0 +1,74 @@
+# ABOUTME: Nomad job for Fitdata - fitness data analysis and MCP server.
+# ABOUTME: Runs FastHTML Python app with SQLite, static port for MCP access.
+
+# Setup required before running:
+#   sudo mkdir -p /data/services/fitdata && sudo chown 1000:1000 /data/services/fitdata
+
+job "fitdata" {
+  datacenters = ["alo"]
+
+  meta {
+    uuid = uuidv4()
+  }
+
+  update {
+    max_parallel      = 1
+    health_check      = "checks"
+    min_healthy_time  = "30s"
+    healthy_deadline  = "5m"
+    progress_deadline = "10m"
+    auto_revert       = true
+  }
+
+  group "web" {
+    network {
+      port "http" {
+        static = 5311
+      }
+    }
+
+    task "app" {
+      driver = "docker"
+      user   = "1000"
+
+      config {
+        image      = "gitea.v.paler.net/alo/fitdata:latest"
+        ports      = ["http"]
+        force_pull = true
+        volumes    = ["/data/services/fitdata:/var/lib/fitdata"]
+      }
+
+      env {
+        FITDATA_DATA_DIR = "/var/lib/fitdata"
+        FITDATA_DB_PATH  = "/var/lib/fitdata/fitdata.db"
+      }
+
+      resources {
+        memory = 512
+      }
+
+      service {
+        name = "fitdata"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.fitdata.entryPoints=websecure",
+          "traefik.http.routers.fitdata.middlewares=oidc-auth@file",
+        ]
+
+        check {
+          type     = "http"
+          path     = "/healthz"
+          interval = "10s"
+          timeout  = "5s"
+
+          check_restart {
+            limit = 3
+            grace = "60s"
+          }
+        }
+      }
+    }
+  }
+}

services/phaseflow.hcl

@@ -4,9 +4,12 @@
 # Setup required before running:
 #   sudo mkdir -p /data/services/phaseflow/pb_data && sudo chown 1000:1000 /data/services/phaseflow /data/services/phaseflow/pb_data
 #   nomad var put secrets/phaseflow \
-#     resend_api_key="re_xxxx" \
+#     mailgun_api_key="key-xxxx" \
+#     mailgun_domain="paler.net" \
 #     encryption_key="$(openssl rand -hex 16)" \
-#     cron_secret="$(openssl rand -hex 32)"
+#     cron_secret="$(openssl rand -hex 32)" \
+#     pocketbase_admin_email="admin@example.com" \
+#     pocketbase_admin_password="your-admin-password"
 
 job "phaseflow" {
   datacenters = ["alo"]
@@ -58,6 +61,16 @@ job "phaseflow" {
       resources {
         memory = 256
       }
+
+      service {
+        name = "pocketbase-phaseflow"
+        port = "pocketbase"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.pocketbase-phaseflow.entryPoints=websecure",
+        ]
+      }
     }
 
     # Main Next.js application
@@ -72,10 +85,12 @@ job "phaseflow" {
       }
 
       env {
-        NODE_ENV             = "production"
+        NODE_ENV                   = "production"
-        POCKETBASE_URL       = "http://${NOMAD_ADDR_pocketbase}"
+        POCKETBASE_URL             = "http://${NOMAD_ADDR_pocketbase}"
-        APP_URL              = "https://phaseflow.v.paler.net"
+        NEXT_PUBLIC_POCKETBASE_URL = "https://pocketbase-phaseflow.v.paler.net"
-        EMAIL_FROM           = "phaseflow@paler.net"
+        APP_URL                    = "https://phaseflow.v.paler.net"
+        EMAIL_FROM                 = "phaseflow@paler.net"
+        MAILGUN_URL                = "https://api.eu.mailgun.net"
       }
 
       # Secrets from Nomad variables
@@ -83,9 +98,12 @@ job "phaseflow" {
         destination = "secrets/env.env"
         env         = true
         data        = <<EOH
-RESEND_API_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .resend_api_key }}{{ end }}
+MAILGUN_API_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .mailgun_api_key }}{{ end }}
+MAILGUN_DOMAIN={{ with nomadVar "secrets/phaseflow" }}{{ .mailgun_domain }}{{ end }}
 ENCRYPTION_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .encryption_key }}{{ end }}
 CRON_SECRET={{ with nomadVar "secrets/phaseflow" }}{{ .cron_secret }}{{ end }}
+POCKETBASE_ADMIN_EMAIL={{ with nomadVar "secrets/phaseflow" }}{{ .pocketbase_admin_email }}{{ end }}
+POCKETBASE_ADMIN_PASSWORD={{ with nomadVar "secrets/phaseflow" }}{{ .pocketbase_admin_password }}{{ end }}
 EOH
       }
 

services/urbit.hcl

@@ -4,6 +4,10 @@
 job "urbit" {
   datacenters = ["alo"]
 
+  meta {
+    uuid = uuidv4()
+  }
+
   group "os" {
     network {
       port "http" {
@@ -25,7 +29,7 @@ job "urbit" {
           # You can also set a variable loom size (Urbit memory size) using
           # --loom=$LOOM_SIZE. Passing /bin/start-urbit --loom=32 for example, would set up
           # a 4GiB loom (2^32 bytes = 4GiB). The default loom size is 31 (2GiB).
-          "--loom=31",
+          "--loom=32",
         ]
         volumes = [
           "/data/services/urbit:/urbit",
@@ -45,7 +49,7 @@ job "urbit" {
 
       resources {
         # dependent on --loom setting + some buffer
-        memory = 2100
+        memory = 4200
       }
     }
   }

services/wavelog.hcl

@@ -0,0 +1,48 @@
+# ABOUTME: Nomad job spec for Wavelog amateur radio logging application
+# ABOUTME: Uses MySQL database and OIDC auth via Traefik middleware
+
+job "wavelog" {
+  datacenters = ["alo"]
+
+  group "wavelog" {
+    network {
+      port "http" {
+        to = 80
+      }
+    }
+
+    task "wavelog" {
+      driver = "docker"
+
+      config {
+        image = "ghcr.io/wavelog/wavelog:latest"
+        ports = ["http"]
+        volumes = [
+          "/data/services/wavelog/config:/var/www/html/application/config/docker",
+          "/data/services/wavelog/uploads:/var/www/html/uploads",
+          "/data/services/wavelog/userdata:/var/www/html/userdata",
+        ]
+      }
+
+      env {
+        CI_ENV = "docker"
+      }
+
+      resources {
+        cpu    = 300
+        memory = 512
+      }
+
+      service {
+        name = "wavelog"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          "traefik.http.routers.wavelog.entryPoints=websecure",
+          "traefik.http.routers.wavelog.middlewares=oidc-auth@file",
+        ]
+      }
+    }
+  }
+}