iObj: initial service — FastAPI + TinyDB memory object store

- Month-sharded TinyDB storage with search/filter (type, project, tag, date range, free-text)
- FastAPI app with bearer-token auth, CRUD + search endpoints
- 27 passing pytest tests (storage + API)
- Dockerfile + Nomad job spec + Gitea Actions deploy workflow (mirrors devops-mcp pattern)

iobj.nomad

@@ -0,0 +1,148 @@
+variable "service_name" {
+  description = "Service name for consistent naming"
+  type        = string
+  default     = "iobj"
+}
+
+variable "image_tag" {
+  description = "Docker image tag — override in CI with commit SHA: -var=\"image_tag=$SHA\""
+  type        = string
+  default     = "latest"
+}
+
+job "iobj" {
+  region      = "global"
+  datacenters = ["dc1"]
+  type        = "service"
+
+  meta {
+    uuid         = uuidv4()
+    deployed_at  = "[[ timeNowUTC ]]"
+    service_name = var.service_name
+  }
+
+  update {
+    stagger           = "30s"
+    max_parallel      = 1
+    auto_revert       = true
+    progress_deadline = "25m"
+  }
+
+  group "iobj-group" {
+    count = 1
+
+    # Deploy specifically on the 'autobox.i80.dk' node (same host as DevOpsMCP)
+    constraint {
+      attribute = "${node.unique.name}"
+      value     = "autobox.i80.dk"
+    }
+
+    # Zero-downtime update: canary ensures new alloc is healthy before old one stops
+    update {
+      canary            = 1
+      auto_promote       = true
+      min_healthy_time  = "15s"
+      healthy_deadline  = "20m"
+      progress_deadline = "25m"
+      auto_revert       = true
+    }
+
+    network {
+      port "http" {}
+    }
+
+    reschedule {
+      attempts       = 5
+      interval       = "10m"
+      delay          = "30s"
+      delay_function = "exponential"
+      max_delay      = "120s"
+      unlimited      = false
+    }
+
+    volume "iobj-data" {
+      type      = "host"
+      source    = "iobj-data"
+      read_only = false
+    }
+
+    service {
+      provider = "consul"
+      name     = var.service_name
+      port     = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.${var.service_name}.rule=Host(`${var.service_name}.i80.dk`)",
+        "traefik.http.routers.${var.service_name}.tls=true",
+      ]
+
+      check {
+        name     = "http_health_check"
+        type     = "http"
+        port     = "http"
+        path     = "/health"
+        interval = "10s"
+        timeout  = "5s"
+      }
+    }
+
+    task "iobj-task" {
+      driver = "docker"
+
+      config {
+        image      = "registry.i80.dk/gitea/iobj:${var.image_tag}"
+        ports      = ["http"]
+        force_pull = true
+        auth {
+          username = "robot$gitserver"
+          password = "${HARBOR_ROBOT_TOKEN}"
+        }
+      }
+
+      restart {
+        attempts = 10
+        interval = "10m"
+        delay    = "15s"
+        mode     = "fail"
+      }
+
+      volume_mount {
+        volume      = "iobj-data"
+        destination = "/app/data"
+        read_only   = false
+      }
+
+      env {
+        PYTHONUNBUFFERED = "1"
+        PORT             = "${NOMAD_PORT_http}"
+        IOBJ_DATA_DIR    = "/app/data"
+      }
+
+      # Registry auth + API token, both loaded from Consul KV
+      template {
+        data = <<EOH
+HARBOR_ROBOT_TOKEN="{{ key "harbor/robot/token" }}"
+EOH
+        destination = "secrets/registry.env"
+        env         = true
+      }
+
+      # NOTE: auth is disabled (open API) until "iobj/api/token" is set in Consul KV.
+      # Set it before going live: consul kv put iobj/api/token "<random-token>"
+      template {
+        data = <<EOH
+IOBJ_API_TOKEN="{{ keyOrDefault "iobj/api/token" "" }}"
+EOH
+        destination = "secrets/iobj.env"
+        env         = true
+      }
+
+      resources {
+        cpu        = 200  # MHz
+        memory     = 128  # MB
+        memory_max = 256  # MB
+      }
+    }
+  }
+}