From 4742e0f59393be811936c7403b00d0801a9f8fd3 Mon Sep 17 00:00:00 2001
From: Alexander Heldt <me@alexanderheldt.se>
Date: Thu, 9 Jul 2026 20:34:43 +0200
Subject: [PATCH] manatee: Add `puppy-tracker` behind virtual host
 `puppy.ppp.pm`

---
 .../manatee/modules/puppy-tracker/default.nix | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/hosts/manatee/modules/puppy-tracker/default.nix b/hosts/manatee/modules/puppy-tracker/default.nix
index 781fe1e..435d4c4 100644
--- a/hosts/manatee/modules/puppy-tracker/default.nix
+++ b/hosts/manatee/modules/puppy-tracker/default.nix
@@ -6,6 +6,7 @@
 }:
 let
   enabled = config.mod.puppy-tracker.enable;
+  nginxEnabled = config.mod.nginx.enable;
   port = 8089;
 in
 {
@@ -25,6 +26,8 @@ in
         name = "Puppy Tracker";
         port = port;
         description = "Sleep, meals, pees, poos";
+        # Login needs HTTPS (Secure cookies), so link to the public vhost.
+        url = "https://puppy.ppp.pm";
       }
     ];
 
@@ -32,6 +35,29 @@ in
       enable = true;
       inherit port;
       openFirewall = true;
+      # Served publicly over HTTPS via the nginx vhost below.
+      secureCookies = true;
+      # Shared registration secret; the file holds `PUPPY_INVITE_CODE=...`.
+      inviteCodeFile = config.age.secrets."puppy-tracker-invite-code".path;
     };
+
+    services.nginx = lib.mkIf nginxEnabled {
+      virtualHosts."puppy.ppp.pm" = {
+        forceSSL = true;
+        useACMEHost = "puppy.ppp.pm";
+
+        # Photo uploads are up to 15 MB; give nginx headroom over its 1 MB default.
+        extraConfig = ''
+          client_max_body_size 20m;
+        '';
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";
+        };
+      };
+    };
+
+    age.secrets."puppy-tracker-invite-code".file =
+      ../../../../secrets/manatee/puppy-tracker-invite-code.age;
   };
 }