From 3a115df8a7f3205b339180ec41981155106a2c75 Mon Sep 17 00:00:00 2001 From: Alexander Heldt Date: Tue, 29 Sep 2026 19:13:50 +0000 Subject: [PATCH] manatee: Add schema The household weekly plan at schema.ppp.pm: its module, certificate, DNS record, backup and secrets. The link to puppy-tracker is prepared but commented out until puppy-tracker with the integration feed is deployed. --- flake.lock | 18 +++++ flake.nix | 7 ++ hosts/manatee/modules/certs/default.nix | 1 + hosts/manatee/modules/default.nix | 1 + .../modules/home-assistant/default.nix | 2 +- hosts/manatee/modules/restic/default.nix | 1 + hosts/manatee/modules/schema/default.nix | 69 +++++++++++++++++++ secrets/manatee/schema-invite-code.age | 7 ++ secrets/manatee/schema-puppy-token.age | 7 ++ secrets/secrets.nix | 2 + 10 files changed, 114 insertions(+), 1 deletion(-) create mode 100644 hosts/manatee/modules/schema/default.nix create mode 100644 secrets/manatee/schema-invite-code.age create mode 100644 secrets/manatee/schema-puppy-token.age diff --git a/flake.lock b/flake.lock index 3825faf..4a990e8 100644 --- a/flake.lock +++ b/flake.lock @@ -910,12 +910,30 @@ "nixpkgs": "nixpkgs_3", "pppdotpm-site": "pppdotpm-site", "puppy-tracker": "puppy-tracker", + "schema": "schema", "solo-referee": "solo-referee", "todo": "todo", "whib-backend": "whib-backend", "whib-frontend": "whib-frontend" } }, + "schema": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1790705995, + "narHash": "sha256-Qe7ugdZbc/aXU900EKtuZOGgN4dyTgfriayoySQX2U8=", + "path": "/home/alex/code/schema", + "type": "path" + }, + "original": { + "path": "/home/alex/code/schema", + "type": "path" + } + }, "solo-referee": { "inputs": { "flake-utils": "flake-utils_4", diff --git a/flake.nix b/flake.nix index cbdd6fc..e6b4a8e 100644 --- a/flake.nix +++ b/flake.nix @@ -99,6 +99,13 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + schema = { + # Switch to the gitea URL once the repo is pushed there: + # url = "git+ssh://gitea@git.ppp.pm:1122/alex/schema.git?ref=main"; + url = "path:/home/alex/code/schema"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + todo = { url = "git+ssh://gitea@git.ppp.pm:1122/alex/todo.git?ref=main"; # url = "git+file:///home/alex/code/todo?ref=main"; diff --git a/hosts/manatee/modules/certs/default.nix b/hosts/manatee/modules/certs/default.nix index 4be7b56..778d7f4 100644 --- a/hosts/manatee/modules/certs/default.nix +++ b/hosts/manatee/modules/certs/default.nix @@ -30,6 +30,7 @@ in "romm.ppp.pm" "puppy.ppp.pm" "todo.ppp.pm" + "schema.ppp.pm" ] (_: hetznerCert); }; diff --git a/hosts/manatee/modules/default.nix b/hosts/manatee/modules/default.nix index 77030a0..1eb4fc6 100644 --- a/hosts/manatee/modules/default.nix +++ b/hosts/manatee/modules/default.nix @@ -29,6 +29,7 @@ in puppy-tracker.enable = true; solo-referee.enable = true; todo.enable = true; + schema.enable = true; }; }; } diff --git a/hosts/manatee/modules/home-assistant/default.nix b/hosts/manatee/modules/home-assistant/default.nix index c841f35..c9d68a2 100644 --- a/hosts/manatee/modules/home-assistant/default.nix +++ b/hosts/manatee/modules/home-assistant/default.nix @@ -251,7 +251,7 @@ in ]; script = '' - SUBDOMAINS="ha komga romm puppy todo" + SUBDOMAINS="ha komga romm puppy todo schema" INTERFACE="enp3s0" CURRENT_IP=$(curl -s --fail --interface "$INTERFACE" ifconfig.me) diff --git a/hosts/manatee/modules/restic/default.nix b/hosts/manatee/modules/restic/default.nix index 61974cb..ae5fd84 100644 --- a/hosts/manatee/modules/restic/default.nix +++ b/hosts/manatee/modules/restic/default.nix @@ -104,6 +104,7 @@ let snapshot /var/lib/puppy-tracker "$STATE/puppy-tracker" snapshot /var/lib/solo-referee "$STATE/solo-referee" snapshot /var/lib/todo "$STATE/todo" + snapshot /var/lib/schema "$STATE/schema" snapshot /var/lib/komga-book-manager "$STATE/komga-book-manager" snapshot /var/lib/komga-reading-stats "$STATE/komga-reading-stats" diff --git a/hosts/manatee/modules/schema/default.nix b/hosts/manatee/modules/schema/default.nix new file mode 100644 index 0000000..0bd002d --- /dev/null +++ b/hosts/manatee/modules/schema/default.nix @@ -0,0 +1,69 @@ +{ + inputs, + lib, + config, + ... +}: +let + enabled = config.mod.schema.enable; + nginxEnabled = config.mod.nginx.enable; + port = 8092; +in +{ + options = { + mod.schema = { + enable = lib.mkEnableOption "Enable schema module"; + }; + }; + + imports = [ + inputs.schema.nixosModules.default + ]; + + config = lib.mkIf enabled { + mod.homepage.services = [ + { + name = "Schema"; + port = port; + description = "Our week: chores, meals, dog"; + # Login needs HTTPS (Secure cookies), so link to the public vhost. + url = "https://schema.ppp.pm"; + } + ]; + + services.schema = { + enable = true; + address = "127.0.0.1"; + inherit port; + # Served publicly over HTTPS via the nginx vhost below. + secureCookies = true; + inviteCodeFile = config.age.secrets."schema-invite-code".path; + timeZone = "Europe/Stockholm"; + + # Walks and meals logged in puppy-tracker tick off dog duties here. Needs + # the integration endpoint from puppy-tracker (see below) to be deployed. + # puppyTracker = { + # url = "http://127.0.0.1:8089"; + # tokenFile = config.age.secrets."schema-puppy-token".path; + # }; + }; + + # The other half of the puppy-tracker link, enabled together with the + # block above once puppy-tracker with integration.tokenFile is pushed. + # services.puppy-tracker.integration.tokenFile = config.age.secrets."schema-puppy-token".path; + # age.secrets."schema-puppy-token".file = ../../../../secrets/manatee/schema-puppy-token.age; + + services.nginx = lib.mkIf nginxEnabled { + virtualHosts."schema.ppp.pm" = { + forceSSL = true; + useACMEHost = "schema.ppp.pm"; + + locations."/" = { + proxyPass = "http://127.0.0.1:${toString port}"; + }; + }; + }; + + age.secrets."schema-invite-code".file = ../../../../secrets/manatee/schema-invite-code.age; + }; +} diff --git a/secrets/manatee/schema-invite-code.age b/secrets/manatee/schema-invite-code.age new file mode 100644 index 0000000..1280816 --- /dev/null +++ b/secrets/manatee/schema-invite-code.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 wkRvNA 73OdSBU5vi/uHFRBJRYCAaaMuT2xjv/k7Dk/lela3HQ +SJFTTuaohubRB9tNtVGCJPlvQaeRfLUYnGl4oZWG/hI +-> ssh-ed25519 +oNaHQ TWvVn/YL6dsUckjN/zkOA5Cgl63agqZSQi9j77GOhm4 +ay+p2r70U5++sG2KlOkqvo4ATKbSb+mZ14/y4XxeYaQ +--- MhsKOuWdZL0xNU+ImVmQ+vRbvRK6Cgv8kjYr4Cby958 +#V{mc3 pNWfßS/HLnPԨ<# \ No newline at end of file diff --git a/secrets/manatee/schema-puppy-token.age b/secrets/manatee/schema-puppy-token.age new file mode 100644 index 0000000..d9d890e --- /dev/null +++ b/secrets/manatee/schema-puppy-token.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 wkRvNA Bd21tyO+Rh+Zhb56/xzRCHAfkdggoRUp36E1e8eK+kk +hDd0ZJ8XQyN+Py9QxSP+4jXKa2MzWSM7OkU2huLNDDI +-> ssh-ed25519 +oNaHQ HaMjqDzPBUDwMDH0190pVxColLLVO4FTq0hZk9atiWE +WZvpvJ+IU9GV0n+fE0DN1gmLBfkBE65s2e0g1/yjTa8 +--- ARKUYPu8vtFDOvtGVKzWlBskrxGoh+6muz3eA6tptMQ +$8!!l|wi daeE&\wT_zۚq)rZk/E9]Eq8fEA` t%>:1 \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index bce1ddd..1b42089 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -45,6 +45,8 @@ in { "manatee/puppy-tracker-invite-code.age".publicKeys = [ manatee alex ]; "manatee/solo-referee-api-key.age".publicKeys = [ manatee alex ]; "manatee/todo-token.age".publicKeys = [ manatee alex ]; + "manatee/schema-invite-code.age".publicKeys = [ manatee alex ]; + "manatee/schema-puppy-token.age".publicKeys = [ manatee alex ]; "manatee/restic-password.age".publicKeys = [ manatee alex ]; "manatee/restic-cloud-sync-key.age".publicKeys = [ manatee alex ]; "manatee/restic-cloud-sync-repository.age".publicKeys = [ manatee alex ];