manatee: Add schema

The household weekly plan at schema.ppp.pm: its module, certificate,
DNS record, backup and secrets. The link to puppy-tracker is prepared
but commented out until puppy-tracker with the integration feed is
deployed.

flake.lock

@@ -910,12 +910,30 @@
         "nixpkgs": "nixpkgs_3",
         "pppdotpm-site": "pppdotpm-site",
         "puppy-tracker": "puppy-tracker",
+        "schema": "schema",
         "solo-referee": "solo-referee",
         "todo": "todo",
         "whib-backend": "whib-backend",
         "whib-frontend": "whib-frontend"
       }
     },
+    "schema": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790705995,
+        "narHash": "sha256-Qe7ugdZbc/aXU900EKtuZOGgN4dyTgfriayoySQX2U8=",
+        "path": "/home/alex/code/schema",
+        "type": "path"
+      },
+      "original": {
+        "path": "/home/alex/code/schema",
+        "type": "path"
+      }
+    },
     "solo-referee": {
       "inputs": {
         "flake-utils": "flake-utils_4",

flake.nix

@@ -99,6 +99,13 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    schema = {
+      # Switch to the gitea URL once the repo is pushed there:
+      # url = "git+ssh://gitea@git.ppp.pm:1122/alex/schema.git?ref=main";
+      url = "path:/home/alex/code/schema";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     todo = {
       url = "git+ssh://gitea@git.ppp.pm:1122/alex/todo.git?ref=main";
       # url = "git+file:///home/alex/code/todo?ref=main";

hosts/manatee/modules/certs/default.nix

@@ -30,6 +30,7 @@ in
       "romm.ppp.pm"
       "puppy.ppp.pm"
       "todo.ppp.pm"
+      "schema.ppp.pm"
     ] (_: hetznerCert);
   };
 

hosts/manatee/modules/default.nix

@@ -29,6 +29,7 @@ in
       puppy-tracker.enable = true;
       solo-referee.enable = true;
       todo.enable = true;
+      schema.enable = true;
     };
   };
 }

hosts/manatee/modules/home-assistant/default.nix

@@ -251,7 +251,7 @@ in
             ];
 
             script = ''
-              SUBDOMAINS="ha komga romm puppy todo"
+              SUBDOMAINS="ha komga romm puppy todo schema"
               INTERFACE="enp3s0"
 
               CURRENT_IP=$(curl -s --fail --interface "$INTERFACE" ifconfig.me)

hosts/manatee/modules/restic/default.nix

@@ -104,6 +104,7 @@ let
     snapshot /var/lib/puppy-tracker        "$STATE/puppy-tracker"
     snapshot /var/lib/solo-referee         "$STATE/solo-referee"
     snapshot /var/lib/todo                 "$STATE/todo"
+    snapshot /var/lib/schema               "$STATE/schema"
     snapshot /var/lib/komga-book-manager   "$STATE/komga-book-manager"
     snapshot /var/lib/komga-reading-stats  "$STATE/komga-reading-stats"
 

hosts/manatee/modules/schema/default.nix

@@ -0,0 +1,69 @@
+{
+  inputs,
+  lib,
+  config,
+  ...
+}:
+let
+  enabled = config.mod.schema.enable;
+  nginxEnabled = config.mod.nginx.enable;
+  port = 8092;
+in
+{
+  options = {
+    mod.schema = {
+      enable = lib.mkEnableOption "Enable schema module";
+    };
+  };
+
+  imports = [
+    inputs.schema.nixosModules.default
+  ];
+
+  config = lib.mkIf enabled {
+    mod.homepage.services = [
+      {
+        name = "Schema";
+        port = port;
+        description = "Our week: chores, meals, dog";
+        # Login needs HTTPS (Secure cookies), so link to the public vhost.
+        url = "https://schema.ppp.pm";
+      }
+    ];
+
+    services.schema = {
+      enable = true;
+      address = "127.0.0.1";
+      inherit port;
+      # Served publicly over HTTPS via the nginx vhost below.
+      secureCookies = true;
+      inviteCodeFile = config.age.secrets."schema-invite-code".path;
+      timeZone = "Europe/Stockholm";
+
+      # Walks and meals logged in puppy-tracker tick off dog duties here. Needs
+      # the integration endpoint from puppy-tracker (see below) to be deployed.
+      # puppyTracker = {
+      #   url = "http://127.0.0.1:8089";
+      #   tokenFile = config.age.secrets."schema-puppy-token".path;
+      # };
+    };
+
+    # The other half of the puppy-tracker link, enabled together with the
+    # block above once puppy-tracker with integration.tokenFile is pushed.
+    # services.puppy-tracker.integration.tokenFile = config.age.secrets."schema-puppy-token".path;
+    # age.secrets."schema-puppy-token".file = ../../../../secrets/manatee/schema-puppy-token.age;
+
+    services.nginx = lib.mkIf nginxEnabled {
+      virtualHosts."schema.ppp.pm" = {
+        forceSSL = true;
+        useACMEHost = "schema.ppp.pm";
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";
+        };
+      };
+    };
+
+    age.secrets."schema-invite-code".file = ../../../../secrets/manatee/schema-invite-code.age;
+  };
+}

secrets/manatee/schema-invite-code.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 wkRvNA 73OdSBU5vi/uHFRBJRYCAaaMuT2xjv/k7Dk/lela3HQ
+SJFTTuaohubRB9tNtVGCJPlvQaeRfLUYnGl4oZWG/hI
+-> ssh-ed25519 +oNaHQ TWvVn/YL6dsUckjN/zkOA5Cgl63agqZSQi9j77GOhm4
+ay+p2r70U5++sG2KlOkqvo4ATKbSb+mZ14/y4XxeYaQ
+--- MhsKOuWdZL0xNU+ImVmQ+vRbvRK6Cgv8kjYr4Cby958
+#俸V
{ｧＮc3ﾈ錯pNWfﾃ汕�ﾉ/�ｧL頷ﾊﾔnｻ薰�ﾔｨ<#游ﾄ

secrets/manatee/schema-puppy-token.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 wkRvNA Bd21tyO+Rh+Zhb56/xzRCHAfkdggoRUp36E1e8eK+kk
+hDd0ZJ8XQyN+Py9QxSP+4jXKa2MzWSM7OkU2huLNDDI
+-> ssh-ed25519 +oNaHQ HaMjqDzPBUDwMDH0190pVxColLLVO4FTq0hZk9atiWE
+WZvpvJ+IU9GV0n+fE0DN1gmLBfkBE65s2e0g1/yjTa8
+--- ARKUYPu8vtFDOvtGVKzWlBskrxGoh+6muz3eA6tptMQ
+$ÙÔ8ÃÃ!!Ül|wÌöiø½Ç ºdaõeE&ˆÈ\w¢¢ÿ–TåÞµ_‚zÛš€q“«)rZŸk/E—9¹]Eq8ºfEî�ã�úA`	tÉ%Æ>Á:Â1␍

secrets/secrets.nix

@@ -45,6 +45,8 @@ in {
   "manatee/puppy-tracker-invite-code.age".publicKeys = [ manatee alex ];
   "manatee/solo-referee-api-key.age".publicKeys = [ manatee alex ];
   "manatee/todo-token.age".publicKeys = [ manatee alex ];
+  "manatee/schema-invite-code.age".publicKeys = [ manatee alex ];
+  "manatee/schema-puppy-token.age".publicKeys = [ manatee alex ];
   "manatee/restic-password.age".publicKeys = [ manatee alex ];
   "manatee/restic-cloud-sync-key.age".publicKeys = [ manatee alex ];
   "manatee/restic-cloud-sync-repository.age".publicKeys = [ manatee alex ];