{
  inputs,
  lib,
  config,
  ...
}:
let
  enabled = config.mod.puppy-tracker.enable;
  nginxEnabled = config.mod.nginx.enable;
  port = 8089;
in
{
  options = {
    mod.puppy-tracker = {
      enable = lib.mkEnableOption "Enable puppy-tracker module";
    };
  };

  imports = [
    inputs.puppy-tracker.nixosModules.default
  ];

  config = lib.mkIf enabled {
    mod.homepage.services = [
      {
        name = "Puppy Tracker";
        port = port;
        description = "Sleep, meals, pees, poos";
        # Login needs HTTPS (Secure cookies), so link to the public vhost.
        url = "https://puppy.ppp.pm";
      }
    ];

    services.puppy-tracker = {
      enable = true;
      inherit port;
      openFirewall = true;
      # Served publicly over HTTPS via the nginx vhost below.
      secureCookies = true;
      # Shared registration secret; the file holds `PUPPY_INVITE_CODE=...`.
      inviteCodeFile = config.age.secrets."puppy-tracker-invite-code".path;
    };

    services.nginx = lib.mkIf nginxEnabled {
      virtualHosts."puppy.ppp.pm" = {
        forceSSL = true;
        useACMEHost = "puppy.ppp.pm";

        # Photo uploads are up to 15 MB; give nginx headroom over its 1 MB default.
        extraConfig = ''
          client_max_body_size 20m;
        '';

        locations."/" = {
          proxyPass = "http://127.0.0.1:${toString port}";
        };
      };
    };

    age.secrets."puppy-tracker-invite-code".file =
      ../../../../secrets/manatee/puppy-tracker-invite-code.age;
  };
}