Update puppy-tracker flake input

With cert and ip update

flake.lock

@@ -882,11 +882,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783157233,
-        "narHash": "sha256-1FU/4S5y4wxSKYGVglWWmRaE2CZb9DsQjAS8+IUmh0U=",
+        "lastModified": 1783621236,
+        "narHash": "sha256-8JU9/6kaWS15D+1nLze7dv+3PiC3UE5q/pZVyma3wfQ=",
         "ref": "main",
-        "rev": "da692d84da6f54089bbe7fb58035ed02f9f0299f",
-        "revCount": 5,
+        "rev": "706d8d8d9f39c857912a1871807e3a2100e565bd",
+        "revCount": 7,
         "type": "git",
         "url": "ssh://gitea@git.ppp.pm:1122/alex/puppy-tracker.git"
       },

hosts/manatee/modules/certs/default.nix

@@ -46,6 +46,19 @@
           "--http-timeout=60"
         ];
       };
+
+      "puppy.ppp.pm" = {
+        dnsProvider = "hetzner";
+        environmentFile = config.age.secrets.hetzner-dns.path;
+        group = "nginx";
+
+        extraLegoFlags = [
+          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
+          "--dns.propagation-wait=60s"
+          "--dns-timeout=60"
+          "--http-timeout=60"
+        ];
+      };
     };
   };
 

hosts/manatee/modules/home-assistant/default.nix

@@ -241,7 +241,7 @@ in
             ];
 
             script = ''
-              SUBDOMAINS="ha komga romm"
+              SUBDOMAINS="ha komga romm puppy"
               INTERFACE="enp3s0"
 
               CURRENT_IP=$(curl -s --fail --interface "$INTERFACE" ifconfig.me)

hosts/manatee/modules/homepage/default.nix

@@ -9,8 +9,13 @@ let
   nginxEnabled = config.mod.nginx.enable;
   services = config.mod.homepage.services;
 
-  serviceToCard = svc: ''
-    <a class="card" href="http://manatee:${toString svc.port}">
+  serviceToCard =
+    svc:
+    let
+      href = if svc.url != null then svc.url else "http://manatee:${toString svc.port}";
+    in
+    ''
+      <a class="card" href="${href}">
         <div class="name">${svc.name}</div>
         <div class="desc">${svc.description}</div>
         <div class="port">:${toString svc.port}</div>
@@ -83,6 +88,11 @@ in
               name = lib.mkOption { type = lib.types.str; };
               port = lib.mkOption { type = lib.types.port; };
               description = lib.mkOption { type = lib.types.str; };
+              url = lib.mkOption {
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+                description = "Link target for the card; defaults to http://manatee:<port>.";
+              };
             };
           }
         );

hosts/manatee/modules/puppy-tracker/default.nix

@@ -6,6 +6,7 @@
 }:
 let
   enabled = config.mod.puppy-tracker.enable;
+  nginxEnabled = config.mod.nginx.enable;
   port = 8089;
 in
 {
@@ -25,6 +26,8 @@ in
         name = "Puppy Tracker";
         port = port;
         description = "Sleep, meals, pees, poos";
+        # Login needs HTTPS (Secure cookies), so link to the public vhost.
+        url = "https://puppy.ppp.pm";
       }
     ];
 
@@ -32,6 +35,29 @@ in
       enable = true;
       inherit port;
       openFirewall = true;
+      # Served publicly over HTTPS via the nginx vhost below.
+      secureCookies = true;
+      # Shared registration secret; the file holds `PUPPY_INVITE_CODE=...`.
+      inviteCodeFile = config.age.secrets."puppy-tracker-invite-code".path;
     };
+
+    services.nginx = lib.mkIf nginxEnabled {
+      virtualHosts."puppy.ppp.pm" = {
+        forceSSL = true;
+        useACMEHost = "puppy.ppp.pm";
+
+        # Photo uploads are up to 15 MB; give nginx headroom over its 1 MB default.
+        extraConfig = ''
+          client_max_body_size 20m;
+        '';
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";
+        };
+      };
+    };
+
+    age.secrets."puppy-tracker-invite-code".file =
+      ../../../../secrets/manatee/puppy-tracker-invite-code.age;
   };
 }

secrets/manatee/puppy-tracker-invite-code.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 wkRvNA 1U7rIOHezvIpeb7QBkwz+NOgagrPDltkFtWY2N/hdE4
+9rLqhxhc4c7cGB9hDPy9r0y5QbDp0CcYFwIWczB0mlU
+-> ssh-ed25519 +oNaHQ w9QggF6DOTSMUC5n+7OKpFOM8iDSQakgx/10pIhM9ws
+GOk7OQpLh5OjyZTiJQxd7hhN93EcSMnMxueNh6AwCOk
+--- mzQrbeaXCVPu0MqNC0iAMLCiZbopyfYanwhsgDjFbZE
+�¡
&ÈEÆݼ�žÊÆ öfh(tJn´Ð†ç$^åkì[Cå

secrets/secrets.nix

@@ -44,6 +44,7 @@ in {
   "manatee/romm-auth-secret-key.age".publicKeys = [ manatee alex ];
   "manatee/romm-db-password.age".publicKeys = [ manatee alex ];
   "manatee/romm-metadata-api-keys.age".publicKeys = [ manatee alex ];
+  "manatee/puppy-tracker-invite-code.age".publicKeys = [ manatee alex ];
 
   "backwards/root.backwards.age".publicKeys = [ backwards alex ];
   "backwards/root.backwards.pub.age".publicKeys = [ backwards alex ];