manatee: Add schema

The household weekly plan at schema.ppp.pm: its module, certificate,
DNS record, backup and secrets. The link to puppy-tracker is prepared
but commented out until puppy-tracker with the integration feed is
deployed.

hosts/manatee/modules/schema/default.nix

@@ -0,0 +1,69 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.schema.enable;
+  nginxEnabled = config.mod.nginx.enable;
+  port = 8092;
+in
+{
+  options = {
+    mod.schema = {
+      enable = lib.mkEnableOption "Enable schema module";
+    };
+  };
+
+  imports = [
+    inputs.schema.nixosModules.default
+  ];
+
+  config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Schema";
+        port = port;
+        description = "Our week: chores, meals, dog";
+        # Login needs HTTPS (Secure cookies), so link to the public vhost.
+        url = "https://schema.ppp.pm";
+      }
+    ];
+
+    services.schema = {
+      enable = true;
+      address = "127.0.0.1";
+      inherit port;
+      # Served publicly over HTTPS via the nginx vhost below.
+      secureCookies = true;
+      inviteCodeFile = config.age.secrets."schema-invite-code".path;
+      timeZone = "Europe/Stockholm";
+
+      # Walks and meals logged in puppy-tracker tick off dog duties here. Needs
+      # the integration endpoint from puppy-tracker (see below) to be deployed.
+      # puppyTracker = {
+      #   url = "http://127.0.0.1:8089";
+      #   tokenFile = config.age.secrets."schema-puppy-token".path;
+      # };
+    };
+
+    # The other half of the puppy-tracker link, enabled together with the
+    # block above once puppy-tracker with integration.tokenFile is pushed.
+    # services.puppy-tracker.integration.tokenFile = config.age.secrets."schema-puppy-token".path;
+    # age.secrets."schema-puppy-token".file = ../../../../secrets/manatee/schema-puppy-token.age;
+
+    services.nginx = lib.mkIf nginxEnabled {
+      virtualHosts."schema.ppp.pm" = {
+        forceSSL = true;
+        useACMEHost = "schema.ppp.pm";
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";
+        };
+      };
+    };
+
+    age.secrets."schema-invite-code".file = ../../../../secrets/manatee/schema-invite-code.age;
+  };
+}