Flowtrack: private period tracker with cycle predictions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-18 08:37:13 +01:00 · 2026-10-18 08:37:13 +01:00 · 94372c6abc
commit 94372c6abc
19 changed files with 2166 additions and 0 deletions
--- a/module.nix
+++ b/module.nix
@ -0,0 +1,104 @@
+self: { config, lib, pkgs, ... }:
+let
+  cfg = config.services.flowtrack;
+  database = "/var/lib/flowtrack/flowtrack.sqlite3";
+  hardening = {
+    User = "flowtrack";
+    Group = "flowtrack";
+    StateDirectory = "flowtrack";
+    StateDirectoryMode = "0700";
+    UMask = "0077";
+    NoNewPrivileges = true;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    ProtectSystem = "strict";
+    ProtectHome = true;
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectControlGroups = true;
+    RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+  };
+  userFlags = lib.concatMapStringsSep " " (user: "--editor ${lib.escapeShellArg user}") cfg.editors
+    + " " + lib.concatMapStringsSep " " (user: "--viewer ${lib.escapeShellArg user}") cfg.viewers;
+in
+{
+  options.services.flowtrack = {
+    enable = lib.mkEnableOption "the Flowtrack period tracker";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
+      defaultText = lib.literalExpression "flowtrack.packages.${pkgs.stdenv.hostPlatform.system}.default";
+      description = "The flowtrack package to run.";
+    };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8093;
+      description = "Loopback TCP port used by the tracker.";
+    };
+    editors = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Remote-User names that own and edit the data.";
+    };
+    viewers = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Remote-User names with read-only access.";
+    };
+    backup = {
+      directory = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "Directory for nightly database snapshots; null disables backups.";
+      };
+      keep = lib.mkOption {
+        type = lib.types.ints.positive;
+        default = 30;
+        description = "Number of nightly snapshots to keep.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (lib.mkMerge [
+    {
+      users.users.flowtrack = {
+        isSystemUser = true;
+        group = "flowtrack";
+        description = "Flowtrack service user";
+      };
+      users.groups.flowtrack = { };
+
+      systemd.services.flowtrack = {
+        description = "Flowtrack period tracker";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = hardening // {
+          ExecStart = "${cfg.package}/bin/flowtrack --host 127.0.0.1 --port ${toString cfg.port} --database ${database} ${userFlags}";
+          Restart = "on-failure";
+          RestartSec = 3;
+        };
+      };
+    }
+    (lib.mkIf (cfg.backup.directory != null) {
+      systemd.tmpfiles.rules = [ "d ${cfg.backup.directory} 0700 flowtrack flowtrack -" ];
+
+      systemd.services.flowtrack-backup = {
+        description = "Snapshot the Flowtrack database";
+        unitConfig.RequiresMountsFor = [ cfg.backup.directory ];
+        serviceConfig = hardening // {
+          Type = "oneshot";
+          ExecStart = "${cfg.package}/bin/flowtrack --database ${database} --backup-to ${cfg.backup.directory} --keep ${toString cfg.backup.keep}";
+          ReadWritePaths = [ cfg.backup.directory ];
+        };
+      };
+
+      systemd.timers.flowtrack-backup = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-* 03:15:00";
+          Persistent = true;
+        };
+      };
+    })
+  ]);
+}