From 3478e05c49d599af3da88efc6b78b97b37d8b1f2 Mon Sep 17 00:00:00 2001
From: Timothy Kim <timothykim@fastmail.fm>
Date: Thu, 19 Mar 2026 12:13:07 -0400
Subject: [PATCH] add garage service with env-based secret injection

---
 docker/garage/.env.keys   |  2 ++
 docker/garage/Dockerfile  |  7 +++++++
 docker/garage/compose.yml | 19 +++++++++++++++++++
 docker/garage/garage.toml | 24 ++++++++++++++++++++++++
 4 files changed, 52 insertions(+)
 create mode 100644 docker/garage/.env.keys
 create mode 100644 docker/garage/Dockerfile
 create mode 100644 docker/garage/compose.yml
 create mode 100644 docker/garage/garage.toml

diff --git a/docker/garage/.env.keys b/docker/garage/.env.keys
new file mode 100644
index 0000000..0a4d652
--- /dev/null
+++ b/docker/garage/.env.keys
@@ -0,0 +1,2 @@
+RPC_SECRET=hantim-garage-rpc-secret
+ARGENTO_NODE_ID=hantim-garage-argento-node-id
diff --git a/docker/garage/Dockerfile b/docker/garage/Dockerfile
new file mode 100644
index 0000000..bd943c0
--- /dev/null
+++ b/docker/garage/Dockerfile
@@ -0,0 +1,7 @@
+FROM dxflrs/garage:v1.0.1
+
+RUN apk add --no-cache gettext
+
+COPY garage.toml /etc/garage.toml.tpl
+
+CMD envsubst < /etc/garage.toml.tpl > /etc/garage.toml && exec /garage server
diff --git a/docker/garage/compose.yml b/docker/garage/compose.yml
new file mode 100644
index 0000000..6c9daf7
--- /dev/null
+++ b/docker/garage/compose.yml
@@ -0,0 +1,19 @@
+services:
+  garage:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    container_name: garage
+    env_file: .env
+    networks:
+      - shared
+    ports:
+      - '3901:3901'
+    volumes:
+      - ./data:/var/lib/garage/data
+      - ./meta:/var/lib/garage/meta
+
+networks:
+  shared:
+    external: true
diff --git a/docker/garage/garage.toml b/docker/garage/garage.toml
new file mode 100644
index 0000000..658987d
--- /dev/null
+++ b/docker/garage/garage.toml
@@ -0,0 +1,24 @@
+metadata_dir = "/var/lib/garage/meta"
+data_dir = "/var/lib/garage/data"
+
+db_engine = "sqlite"
+replication_factor = 2
+compression_level = 1
+
+rpc_bind_addr = "[::]:3901"
+rpc_public_addr = "hantim.net:3901"
+rpc_secret = "${RPC_SECRET}"
+
+bootstrap_peers = ["${ARGENTO_NODE_ID}"]
+
+[s3_api]
+s3_region = "garage"
+api_bind_addr = "[::]:3900"
+
+[s3_web]
+bind_addr = "[::]:3902"
+root_domain = ".web.garage"
+index = "index.html"
+
+[admin]
+api_bind_addr = "[::]:3903"