hoodik v0.1.0

Files & sync

Hoodik — a self-hosted, end-to-end encrypted file storage and sharing app with a clean web UI. Deployed as a single host-networked Nomad service.

nomad-pack run hoodik --registry nomploy

…or one line (add registry + run)

curl -fsSL https://packs.nomploy.com/install.sh | sh -s -- hoodik

Needs nomad-pack on PATH. The script only adds the nomploy registry and runs this pack.

Source ↗ Project ↗ ★ 1.5k ⚑ Report an issue

1 task http 5443 1 volume image hudik/hoodik:latest tracks :latest image bumped today

Variables 10

values.hcl

Save as values.hcl, edit, then run:

nomad-pack run hoodik -f values.hcl --registry nomploy

# The name of the Nomad job.
job_name = "hoodik"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The Hoodik container image. Pin a tag in production.
image = "hudik/hoodik:latest"

# Host port for the Hoodik web UI (HTTPS).
port = 5443

# Named volume mounted at /data (SQLite database, uploaded files, and the self-signed TLS cert).
data_volume = "hoodik_data"

# Public URL Hoodik is reachable at (APP_URL). Required — must be the exact URL users open. Empty = https://localhost:<port>.
base_url = ""

# Secret used to sign session tokens (JWT_SECRET). CHANGE THIS and keep it STABLE (changing it logs everyone out). Generate with: openssl rand -base64 36.
jwt_secret = "change-me-openssl-rand-base64-36"

# Placement constraints. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# The task resources.
resources = {
    cpu    = 300
    memory = 256
  }

Name	Type	Default	Description
job_name	string	"hoodik"	The name of the Nomad job.
namespace	string	"default"	The Nomad namespace to deploy into.
datacenters	list	["*"]	The datacenters to deploy to.
image	string	"hudik/hoodik:latest"	The Hoodik container image. Pin a tag in production.
port	number	5443	Host port for the Hoodik web UI (HTTPS).
data_volume	string	"hoodik_data"	Named volume mounted at /data (SQLite database, uploaded files, and the self-signed TLS cert).
base_url	string	""	Public URL Hoodik is reachable at (APP_URL). Required — must be the exact URL users open. Empty = https://localhost:<port>.
jwt_secret set me	string	"change-me-openssl-rand-base64-36"	Secret used to sign session tokens (JWT_SECRET). CHANGE THIS and keep it STABLE (changing it logs everyone out). Generate with: openssl rand -base64 36.
constraints	list	[]	Placement constraints. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources	object	{ cpu = 300 memory = 256 }	The task resources.

Back up this pack

This pack stores data in one Docker named volume: hoodik_data

restic

# Run on the node hosting this pack. Point restic at your repo first:
#   export RESTIC_REPOSITORY="s3:https://<account>.r2.cloudflarestorage.com/<bucket>"
#   export RESTIC_PASSWORD="<repo-password>"
#   export AWS_ACCESS_KEY_ID=<key>  AWS_SECRET_ACCESS_KEY=<secret>
restic backup \
  /var/lib/docker/volumes/hoodik_data/_data

rclone (sync to S3/R2)

rclone sync /var/lib/docker/volumes/hoodik_data/_data backup:<bucket>/hoodik_data

Paths assume the default Docker volume location (/var/lib/docker/volumes). Restore by stopping the job, restoring files into the same volume, and re-running the pack.

Readme

hoodik

Hoodik — a self-hosted, end-to-end encrypted file storage and sharing app. Files are encrypted in the browser before upload, so the server only ever holds ciphertext; share links stay private too. A lightweight, privacy-first alternative to cloud drives, with a clean web UI.

Single host-networked Nomad service with a persistent data volume. Serves HTTPS directly (self-signed by default).

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run hoodik --registry=nomploy

Configure

Variable	Default	Description
`port`	`5443`	Web UI port (HTTPS, `HTTP_PORT`).
`base_url`	`""`	Set for real use. Public URL (`APP_URL`) — must match what users open. Empty = `https://localhost:<port>`.
`jwt_secret`	`change-me-…`	Change this and keep it stable. Signs session tokens. `openssl rand -base64 36`.
`image`	`hudik/hoodik:latest`	Container image. Pin a tag in production.
`data_volume`	`hoodik_data`	`/data` — database, files and the self-signed TLS cert.
`resources`	`{ cpu = 300, memory = 256 }`	Task resources.

Serves its own HTTPS. Hoodik generates a self-signed certificate in the data volume on first run. Behind a reverse proxy, route to it over HTTPS (allow the self-signed cert), or supply your own via SSL_CERT_FILE/ SSL_KEY_FILE. Set base_url/APP_URL to the exact address users open, and pin the job to the node holding the volume with constraints.