manatee: Add puppy-tracker behind virtual host puppy.ppp.pm

hosts/manatee/modules/puppy-tracker/default.nix

@@ -6,6 +6,7 @@
 }:
 let
   enabled = config.mod.puppy-tracker.enable;
+  nginxEnabled = config.mod.nginx.enable;
   port = 8089;
 in
 {
@@ -25,6 +26,8 @@ in
         name = "Puppy Tracker";
         port = port;
         description = "Sleep, meals, pees, poos";
+        # Login needs HTTPS (Secure cookies), so link to the public vhost.
+        url = "https://puppy.ppp.pm";
       }
     ];
 
@@ -32,6 +35,29 @@ in
       enable = true;
       inherit port;
       openFirewall = true;
+      # Served publicly over HTTPS via the nginx vhost below.
+      secureCookies = true;
+      # Shared registration secret; the file holds `PUPPY_INVITE_CODE=...`.
+      inviteCodeFile = config.age.secrets."puppy-tracker-invite-code".path;
     };
+
+    services.nginx = lib.mkIf nginxEnabled {
+      virtualHosts."puppy.ppp.pm" = {
+        forceSSL = true;
+        useACMEHost = "puppy.ppp.pm";
+
+        # Photo uploads are up to 15 MB; give nginx headroom over its 1 MB default.
+        extraConfig = ''
+          client_max_body_size 20m;
+        '';
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";
+        };
+      };
+    };
+
+    age.secrets."puppy-tracker-invite-code".file =
+      ../../../../secrets/manatee/puppy-tracker-invite-code.age;
   };
 }