From 2e662062cfb3f5f8aa977d3d3320140fbaa9f194 Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Sun, 4 Oct 2026 19:53:06 +0100
Subject: [PATCH] Add shared Stardew Valley tracker

---
 common.nix                   |  1 +
 flake.lock                   | 21 +++++++++++++++++++++
 flake.nix                    |  7 +++++++
 services/authelia.nix        |  1 +
 services/nginx.nix           |  8 ++++++++
 services/service-health.nix  |  2 +-
 services/stardew-tracker.nix | 14 ++++++++++++++
 7 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 services/stardew-tracker.nix

diff --git a/common.nix b/common.nix
index 4ad577c..e9d68e6 100644
--- a/common.nix
+++ b/common.nix
@@ -124,6 +124,7 @@ in
     ./services/forgejo-runner.nix
     ./services/code-server.nix
     ./services/redlib.nix
+    ./services/stardew-tracker.nix
     ./services/hardware-health.nix
     ./services/wan-watchdog.nix
     ./services/deployment.nix
diff --git a/flake.lock b/flake.lock
index c06d36f..b12fd55 100644
--- a/flake.lock
+++ b/flake.lock
@@ -380,10 +380,31 @@
         "nixpkgs": "nixpkgs_2",
         "proton-cachyos-nix": "proton-cachyos-nix",
         "redlib": "redlib",
+        "stardew-tracker": "stardew-tracker",
         "stylix": "stylix",
         "zen-browser": "zen-browser"
       }
     },
+    "stardew-tracker": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1791138456,
+        "narHash": "sha256-3S/M++CkWAhBNEEiCD3XpueK/j4Nj792F4eb3i/osE0=",
+        "ref": "refs/heads/main",
+        "rev": "a33f7a297d289df9507ffe0aa87f054decac459e",
+        "revCount": 1,
+        "type": "git",
+        "url": "https://forg.gregersen.it/rope/stardew-tracker"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://forg.gregersen.it/rope/stardew-tracker"
+      }
+    },
     "stylix": {
       "inputs": {
         "base16": "base16",
diff --git a/flake.nix b/flake.nix
index 8722dea..0205d86 100644
--- a/flake.nix
+++ b/flake.nix
@@ -30,6 +30,11 @@
       flake = false;
     };
 
+    stardew-tracker = {
+      url = "git+https://forg.gregersen.it/rope/stardew-tracker";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     stylix = {
       url = "github:nix-community/stylix/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -43,6 +48,7 @@
     , nix-cachyos-kernel
     , stylix
     , proton-cachyos-nix
+    , stardew-tracker
     , ...
     } @ inputs:
     let
@@ -52,6 +58,7 @@
         ./common.nix
         home-manager.nixosModules.home-manager
         stylix.nixosModules.stylix
+        stardew-tracker.nixosModules.default
         ./settings/stylix.nix
       ];
       mkHost = hostname: extraModules: nixpkgs.lib.nixosSystem {
diff --git a/services/authelia.nix b/services/authelia.nix
index 0b411be..8237d98 100644
--- a/services/authelia.nix
+++ b/services/authelia.nix
@@ -43,6 +43,7 @@
             { domain = "code.nordhammer.it";       policy = "one_factor"; }
             { domain = "reddit.nordhammer.it";    policy = "one_factor"; }
             { domain = "panel.nordhammer.it";     policy = "one_factor"; }
+            { domain = "stardew.nordhammer.it";  policy = "one_factor"; }
           ];
         };
 
diff --git a/services/nginx.nix b/services/nginx.nix
index ea200aa..115df06 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -195,6 +195,14 @@ in
           '';
         };
         "reddit.nordhammer.it"   = protectedProxy 8087;
+        # Shared household checklist. Pass the Authelia identity through only
+        # as update metadata; every authorized user sees the same farm state.
+        "stardew.nordhammer.it"  = lib.recursiveUpdate (protectedProxy 8089) {
+          locations."/".extraConfig = autheliaAuthConfig + ''
+            proxy_set_header Remote-User $user;
+            proxy_set_header Remote-Email $email;
+          '';
+        };
 
         # Pelican game panel. Can't turn off its own login (no such option
         # upstream), so Authelia is the outer gate and the Pelican account
diff --git a/services/service-health.nix b/services/service-health.nix
index 72250b4..1e149a5 100644
--- a/services/service-health.nix
+++ b/services/service-health.nix
@@ -18,7 +18,7 @@ let
   watched = [
     "jellyfin" "sonarr" "radarr" "prowlarr" "bazarr"
     "qbittorrent-nox" "sabnzbd" "authelia-main" "nginx"
-    "adguardhome" "crowdsec" "go2rtc"
+    "adguardhome" "crowdsec" "go2rtc" "stardew-tracker"
     "cloudflare-dyndns" "gitea-runner-default"
   ];
 
diff --git a/services/stardew-tracker.nix b/services/stardew-tracker.nix
new file mode 100644
index 0000000..8976318
--- /dev/null
+++ b/services/stardew-tracker.nix
@@ -0,0 +1,14 @@
+# services/stardew-tracker.nix — Shared two-year Stardew Valley planner.
+#
+# The application and NixOS module live in the standalone stardew-tracker
+# flake. nginx provides the only public listener and Authelia protects the
+# entire origin; the app itself stays bound to loopback.
+{ config, lib, ... }:
+{
+  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
+    services.stardew-tracker = {
+      enable = true;
+      port = 8089;
+    };
+  };
+}