feat: migrate m3-atlas from MinIO to RustFS

- Replace minio.nix with rustfs.nix using rustfs-flake NixOS module - Add rustfs flake input (github:rustfs/rustfs-flake) - Reuse same ports (API: 3008, Console: 3007) and data dir (/var/storage/s3) - Add separate agenix secrets for access-key and secret-key - Keep Traefik routes unchanged (s3.m3tam3re.com, minio.m3tam3re.com) - MinIO had 6 unfixed CVEs and is abandoned upstream
2026-05-02 11:44:32 +02:00
parent 90e417525b
commit b7dd7f2bf7
8 changed files with 467 additions and 66 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -21,10 +21,47 @@
        "type": "github"
      }
    },
+    "agenix_2": {
+      "inputs": {
+        "darwin": "darwin_2",
+        "home-manager": "home-manager_4",
+        "nixpkgs": "nixpkgs_6",
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
    "agents": {
      "inputs": {
        "nixpkgs": "nixpkgs_2"
      },
+      "locked": {
+        "lastModified": 1777399938,
+        "narHash": "sha256-xXPqUQezDdDtF8MbpZnwD1HkybOYwF92evx8rJ6OXCU=",
+        "ref": "refs/heads/master",
+        "rev": "9a91f1ee0cf011a7eaf1f16a9e17610b0457e055",
+        "revCount": 85,
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/AGENTS"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/AGENTS"
+      }
+    },
+    "agents_2": {
+      "flake": false,
      "locked": {
        "lastModified": 1777399938,
        "narHash": "sha256-xXPqUQezDdDtF8MbpZnwD1HkybOYwF92evx8rJ6OXCU=",
@@ -39,7 +76,7 @@
        "url": "https://code.m3ta.dev/m3tam3re/AGENTS"
      }
    },
-    "agents_2": {
+    "agents_3": {
      "flake": false,
      "locked": {
        "lastModified": 1777399938,
@@ -71,7 +108,46 @@
        "type": "github"
      }
    },
+    "base16-schemes_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696158499,
+        "narHash": "sha256-5yIHgDTPjoX/3oDEfLSQ0eJZdFL1SaCfb9d6M0RmOTM=",
+        "owner": "tinted-theming",
+        "repo": "base16-schemes",
+        "rev": "a9112eaae86d9dd8ee6bb9445b664fba2f94037a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "base16-schemes",
+        "type": "github"
+      }
+    },
    "basecamp": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "m3ta-nixpkgs",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1774505501,
+        "narHash": "sha256-7UiRrDptj7yuEFwToOfdunUMz/i3jRLR7CmMoYQjq6k=",
+        "owner": "basecamp",
+        "repo": "basecamp-cli",
+        "rev": "f087e6ef84002503d0dbc75ea1c8c928a8928d9e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "basecamp",
+        "ref": "v0.7.2",
+        "repo": "basecamp-cli",
+        "type": "github"
+      }
+    },
+    "basecamp_2": {
      "inputs": {
        "nixpkgs": [
          "m3ta-nixpkgs",
@@ -174,6 +250,29 @@
        "type": "github"
      }
    },
+    "darwin_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
    "disko": {
      "inputs": {
        "nixpkgs": [
@@ -237,6 +336,28 @@
      }
    },
    "flake-parts_3": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "m3ta-home",
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
      "inputs": {
        "nixpkgs-lib": [
          "nur",
@@ -361,13 +482,56 @@
        "type": "github"
      }
    },
+    "home-manager_4": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745494811,
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_5": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-home",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1777679572,
+        "narHash": "sha256-egYNbRrkn+6SwTHinhdb6WUfzzdC3nXfCRqS321VylY=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "9cb587ade2aa1b4a7257f0238d41072690b0ca4f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
    "hyprlang": {
      "inputs": {
        "nixpkgs": [
          "rose-pine-hyprcursor",
          "nixpkgs"
        ],
-        "systems": "systems_4"
+        "systems": "systems_5"
      },
      "locked": {
        "lastModified": 1709914708,
@@ -426,26 +590,76 @@
        "type": "github"
      }
    },
+    "m3ta-home": {
+      "inputs": {
+        "agenix": "agenix_2",
+        "home-manager": "home-manager_5",
+        "m3ta-nixpkgs": "m3ta-nixpkgs",
+        "nix-colors": "nix-colors",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nur": "nur"
+      },
+      "locked": {
+        "lastModified": 1777712073,
+        "narHash": "sha256-pzzvQP3bs56k6pphtdbWtmE23jhJJ1LoGVDmUZOxGhM=",
+        "ref": "refs/heads/master",
+        "rev": "55661c12d4c74e06bb7a86ebede212d26099b00c",
+        "revCount": 14,
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/m3ta-home"
+      }
+    },
    "m3ta-nixpkgs": {
      "inputs": {
        "agents": "agents_2",
        "basecamp": "basecamp",
-        "nixpkgs": "nixpkgs_6",
+        "nixpkgs": [
+          "m3ta-home",
+          "nixpkgs"
+        ],
        "nixpkgs-master": "nixpkgs-master",
        "openspec": "openspec"
      },
      "locked": {
-        "lastModified": 1777486032,
-        "narHash": "sha256-UStORUF67vzXQ1jtORzR2cTv8GCvrxweF7HFHJgPpqw=",
+        "lastModified": 1777687275,
+        "narHash": "sha256-75fbn1g+46RjjsqapKOGAU1hdKyju4qK/p8IVmyBZdM=",
        "ref": "refs/heads/master",
-        "rev": "1da8c96447eb74a316861f6242421ef0309c29a8",
-        "revCount": 267,
+        "rev": "fa28774656daf391ae8a79e30dc3a69261dfa82f",
+        "revCount": 272,
        "type": "git",
-        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
      },
      "original": {
        "type": "git",
-        "url": "https://code.m3ta.dev/m3tam3re/nixpkgs"
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
+      }
+    },
+    "m3ta-nixpkgs_2": {
+      "inputs": {
+        "agents": "agents_3",
+        "basecamp": "basecamp_2",
+        "nixpkgs": "nixpkgs_8",
+        "nixpkgs-master": "nixpkgs-master_2",
+        "openspec": "openspec_2"
+      },
+      "locked": {
+        "lastModified": 1777687275,
+        "narHash": "sha256-75fbn1g+46RjjsqapKOGAU1hdKyju4qK/p8IVmyBZdM=",
+        "ref": "refs/heads/master",
+        "rev": "fa28774656daf391ae8a79e30dc3a69261dfa82f",
+        "revCount": 272,
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://gitea@code.m3ta.dev/m3tam3re/nixpkgs"
      }
    },
    "nix-colors": {
@@ -467,6 +681,25 @@
        "type": "github"
      }
    },
+    "nix-colors_2": {
+      "inputs": {
+        "base16-schemes": "base16-schemes_2",
+        "nixpkgs-lib": "nixpkgs-lib_2"
+      },
+      "locked": {
+        "lastModified": 1707825078,
+        "narHash": "sha256-hTfge2J2W+42SZ7VHXkf4kjU+qzFqPeC9k66jAUBMHk=",
+        "owner": "misterio77",
+        "repo": "nix-colors",
+        "rev": "b01f024090d2c4fc3152cd0cf12027a7b8453ba1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "misterio77",
+        "repo": "nix-colors",
+        "type": "github"
+      }
+    },
    "nixlib": {
      "locked": {
        "lastModified": 1736643958,
@@ -485,7 +718,7 @@
    "nixos-generators": {
      "inputs": {
        "nixlib": "nixlib",
-        "nixpkgs": "nixpkgs_7"
+        "nixpkgs": "nixpkgs_9"
      },
      "locked": {
        "lastModified": 1769813415,
@@ -564,6 +797,21 @@
        "type": "github"
      }
    },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1697935651,
+        "narHash": "sha256-qOfWjQ2JQSQL15KLh6D7xQhx0qgZlYZTYlcEiRuAMMw=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "e1e11fdbb01113d85c7f41cada9d2847660e3902",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
    "nixpkgs-locked": {
      "locked": {
        "lastModified": 1739661218,
@@ -582,11 +830,11 @@
    },
    "nixpkgs-master": {
      "locked": {
-        "lastModified": 1777470666,
-        "narHash": "sha256-uAi+pTjKLturTz3XqTwnsU0fJnqf8xx8orfPpRbdaKQ=",
+        "lastModified": 1777684196,
+        "narHash": "sha256-irZjT++CZFBGHsuHNqPTa6AE1wVVuxdoR7pcdp6hq0A=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "053b9fa5f0fbdac0bd9d248cea58a11223eb495d",
+        "rev": "1cad9ada6da0658a588196ddcb2836004caa2293",
        "type": "github"
      },
      "original": {
@@ -597,6 +845,22 @@
      }
    },
    "nixpkgs-master_2": {
+      "locked": {
+        "lastModified": 1777684196,
+        "narHash": "sha256-irZjT++CZFBGHsuHNqPTa6AE1wVVuxdoR7pcdp6hq0A=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "1cad9ada6da0658a588196ddcb2836004caa2293",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "master",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-master_3": {
      "locked": {
        "lastModified": 1777483759,
        "narHash": "sha256-luE+pNcTx3gz109lEC/xUxPHrx1aEZsp5X4OEBcnGaw=",
@@ -628,6 +892,38 @@
        "type": "github"
      }
    },
+    "nixpkgs_10": {
+      "locked": {
+        "lastModified": 1777268161,
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_11": {
+      "locked": {
+        "lastModified": 1710272261,
+        "narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0ad13a6833440b8e238947e47bea7f11071dc2b2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "nixpkgs_2": {
      "locked": {
        "lastModified": 1772479524,
@@ -693,6 +989,38 @@
      }
    },
    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1754028485,
+        "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "59e69648d345d6e8fef86158c555730fa12af9de",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_7": {
+      "locked": {
+        "lastModified": 1777578337,
+        "narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "15f4ee454b1dce334612fa6843b3e05cf546efab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_8": {
      "locked": {
        "lastModified": 1777268161,
        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
@@ -708,7 +1036,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_7": {
+    "nixpkgs_9": {
      "locked": {
        "lastModified": 1736657626,
        "narHash": "sha256-FWlPMUzp0lkQBdhKlPqtQdqmp+/C+1MBiEytaYfrCTY=",
@@ -724,38 +1052,6 @@
        "type": "github"
      }
    },
-    "nixpkgs_8": {
-      "locked": {
-        "lastModified": 1777268161,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_9": {
-      "locked": {
-        "lastModified": 1710272261,
-        "narHash": "sha256-g0bDwXFmTE7uGDOs9HcJsfLFhH7fOsASbAuOzDC+fhQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "0ad13a6833440b8e238947e47bea7f11071dc2b2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
    "npm-lockfile-fix": {
      "inputs": {
        "nixpkgs": [
@@ -780,6 +1076,25 @@
    "nur": {
      "inputs": {
        "flake-parts": "flake-parts_3",
+        "nixpkgs": "nixpkgs_7"
+      },
+      "locked": {
+        "lastModified": 1777712567,
+        "narHash": "sha256-HnS+JN7FhBq0dPdigYGE9py3TAMInzRPkVW8mE4qSQE=",
+        "owner": "nix-community",
+        "repo": "NUR",
+        "rev": "5035bb030208b191f464446970df5786f25b7ae9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "NUR",
+        "type": "github"
+      }
+    },
+    "nur_2": {
+      "inputs": {
+        "flake-parts": "flake-parts_4",
        "nixpkgs": [
          "nixpkgs"
        ]
@@ -801,16 +1116,38 @@
    "openspec": {
      "inputs": {
        "nixpkgs": [
+          "m3ta-home",
          "m3ta-nixpkgs",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1776788052,
-        "narHash": "sha256-L4LBHVVtgMhSJm+IzZSYOR0UXPbvIRg4xiEV5urYxdI=",
+        "lastModified": 1777679960,
+        "narHash": "sha256-yLc5BzIecR3L9lPILImNqRgOqqXCZH902CSBLn/5UJI=",
        "owner": "Fission-AI",
        "repo": "OpenSpec",
-        "rev": "3c7a05c5dc88b2397c478805890b55ed392b19e8",
+        "rev": "0ca74762dc03ee25f8651eaa7c33866170112031",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Fission-AI",
+        "repo": "OpenSpec",
+        "type": "github"
+      }
+    },
+    "openspec_2": {
+      "inputs": {
+        "nixpkgs": [
+          "m3ta-nixpkgs",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1777679960,
+        "narHash": "sha256-yLc5BzIecR3L9lPILImNqRgOqqXCZH902CSBLn/5UJI=",
+        "owner": "Fission-AI",
+        "repo": "OpenSpec",
+        "rev": "0ca74762dc03ee25f8651eaa7c33866170112031",
        "type": "github"
      },
      "original": {
@@ -916,17 +1253,19 @@
        "home-manager": "home-manager_2",
        "hyprpanel": "hyprpanel",
        "llm-agents": "llm-agents",
-        "m3ta-nixpkgs": "m3ta-nixpkgs",
-        "nix-colors": "nix-colors",
+        "m3ta-home": "m3ta-home",
+        "m3ta-nixpkgs": "m3ta-nixpkgs_2",
+        "nix-colors": "nix-colors_2",
        "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_8",
+        "nixpkgs": "nixpkgs_10",
        "nixpkgs-45570c2": "nixpkgs-45570c2",
        "nixpkgs-9e58ed7": "nixpkgs-9e58ed7",
        "nixpkgs-locked": "nixpkgs-locked",
-        "nixpkgs-master": "nixpkgs-master_2",
+        "nixpkgs-master": "nixpkgs-master_3",
        "nixpkgs-stable": "nixpkgs-stable",
-        "nur": "nur",
+        "nur": "nur_2",
        "rose-pine-hyprcursor": "rose-pine-hyprcursor",
+        "rustfs": "rustfs",
        "skills-anthropic": "skills-anthropic",
        "skills-basecamp": "skills-basecamp",
        "skills-kestra": "skills-kestra",
@@ -937,7 +1276,7 @@
    "rose-pine-hyprcursor": {
      "inputs": {
        "hyprlang": "hyprlang",
-        "nixpkgs": "nixpkgs_9",
+        "nixpkgs": "nixpkgs_11",
        "utils": "utils"
      },
      "locked": {
@@ -954,6 +1293,26 @@
        "type": "github"
      }
    },
+    "rustfs": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1777635550,
+        "narHash": "sha256-QHknn6JYNb4+8ztMl7Ngk3Px3r2FRUPwbbrswYuHSpA=",
+        "owner": "rustfs",
+        "repo": "rustfs-flake",
+        "rev": "efaad834053c41ac618804fb4e7612cea455848e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rustfs",
+        "repo": "rustfs-flake",
+        "type": "github"
+      }
+    },
    "skills-anthropic": {
      "flake": false,
      "locked": {
@@ -1080,6 +1439,21 @@
      }
    },
    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_5": {
      "locked": {
        "lastModified": 1689347949,
        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -1094,7 +1468,7 @@
        "type": "github"
      }
    },
-    "systems_5": {
+    "systems_6": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
@@ -1132,7 +1506,7 @@
    },
    "utils": {
      "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_6"
      },
      "locked": {
        "lastModified": 1710146030,
--- a/flake.nix
+++ b/flake.nix
@@ -74,6 +74,11 @@
      flake = false;
    };
    hermes-agent.url = "github:NousResearch/hermes-agent/v2026.4.30";
+
+    rustfs = {
+      url = "github:rustfs/rustfs-flake";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
  };

  outputs = {
@@ -127,6 +132,7 @@
          inputs.disko.nixosModules.disko
          agenix.nixosModules.default
          m3ta-nixpkgs.nixosModules.default
+          inputs.rustfs.nixosModules.rustfs
        ];
      };
      m3-kratos = nixpkgs.lib.nixosSystem {
--- a/hosts/m3-atlas/secrets.nix
+++ b/hosts/m3-atlas/secrets.nix
@@ -10,6 +10,8 @@
      kestra-env = {file = ../../secrets/kestra-env.age;};
      littlelink-m3tam3re = {file = ../../secrets/littlelink-m3tam3re.age;};
      minio-root-cred = {file = ../../secrets/minio-root-cred.age;};
+      rustfs-access-key = {file = ../../secrets/rustfs-access-key.age;};
+      rustfs-secret-key = {file = ../../secrets/rustfs-secret-key.age;};
      n8n-env = {file = ../../secrets/n8n-env.age;};
      netbird-auth-secret = {
        file = ../../secrets/netbird-auth-secret.age;
--- a/hosts/m3-atlas/services/default.nix
+++ b/hosts/m3-atlas/services/default.nix
@@ -4,7 +4,7 @@
    ./containers
    ./gitea.nix
    ./gitea-actions-runner.nix
-    ./minio.nix
+    ./rustfs.nix
    ./mysql.nix
    ./netbird.nix
    ./n8n.nix
--- a/hosts/m3-atlas/services/rustfs.nix
+++ b/hosts/m3-atlas/services/rustfs.nix
@@ -1,14 +1,29 @@
-{config, ...}: {
-  services.minio = {
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}: {
+  services.rustfs = {
    enable = true;
-    region = "eu-central-1";
+    package = inputs.rustfs.packages.${pkgs.stdenv.hostPlatform.system}.default;
+
+    # Reuse existing MinIO data directory
+    volumes = "/var/storage/s3";
+
+    # Keep same ports as MinIO to avoid changing Traefik and client configs
+    address = ":3008";
+    consoleEnable = true;
    consoleAddress = ":3007";
-    listenAddress = ":3008";
-    browser = true;
-    rootCredentialsFile = config.age.secrets.minio-root-cred.path;
-    dataDir = ["/var/storage/s3"];
+
+    # Credentials via agenix
+    accessKeyFile = config.age.secrets.rustfs-access-key.path;
+    secretKeyFile = config.age.secrets.rustfs-secret-key.path;
+
+    logLevel = "info";
  };
-  # Traefik configuration specific to minio
+
+  # Traefik configuration — same routes as before
  services.traefik.dynamicConfigOptions.http = {
    services.minio-console.loadBalancer.servers = [
      {
--- a/secrets.nix
+++ b/secrets.nix
@@ -23,6 +23,8 @@ in {
  "secrets/kestra-config.age".publicKeys = systems ++ users;
  "secrets/kestra-env.age".publicKeys = systems ++ users;
  "secrets/minio-root-cred.age".publicKeys = systems ++ users;
+  "secrets/rustfs-access-key.age".publicKeys = systems ++ users;
+  "secrets/rustfs-secret-key.age".publicKeys = systems ++ users;
  "secrets/n8n-env.age".publicKeys = systems ++ users;
  "secrets/netbird-auth-secret.age".publicKeys = systems ++ users;
  "secrets/netbird-db-password.age".publicKeys = systems ++ users;
--- a/secrets/rustfs-access-key.age
+++ b/secrets/rustfs-access-key.age
@@ -0,0 +1 @@
+PLACEHOLDER
--- a/secrets/rustfs-secret-key.age
+++ b/secrets/rustfs-secret-key.age
@@ -0,0 +1 @@
+PLACEHOLDER