Add shared Stardew Valley tracker

services/authelia.nix

@@ -43,6 +43,7 @@
             { domain = "code.nordhammer.it";       policy = "one_factor"; }
             { domain = "reddit.nordhammer.it";    policy = "one_factor"; }
             { domain = "panel.nordhammer.it";     policy = "one_factor"; }
+            { domain = "stardew.nordhammer.it";  policy = "one_factor"; }
           ];
         };
 

services/nginx.nix

@@ -195,6 +195,14 @@ in
           '';
         };
         "reddit.nordhammer.it"   = protectedProxy 8087;
+        # Shared household checklist. Pass the Authelia identity through only
+        # as update metadata; every authorized user sees the same farm state.
+        "stardew.nordhammer.it"  = lib.recursiveUpdate (protectedProxy 8089) {
+          locations."/".extraConfig = autheliaAuthConfig + ''
+            proxy_set_header Remote-User $user;
+            proxy_set_header Remote-Email $email;
+          '';
+        };
 
         # Pelican game panel. Can't turn off its own login (no such option
         # upstream), so Authelia is the outer gate and the Pelican account

services/service-health.nix

@@ -18,7 +18,7 @@ let
   watched = [
     "jellyfin" "sonarr" "radarr" "prowlarr" "bazarr"
     "qbittorrent-nox" "sabnzbd" "authelia-main" "nginx"
-    "adguardhome" "crowdsec" "go2rtc"
+    "adguardhome" "crowdsec" "go2rtc" "stardew-tracker"
     "cloudflare-dyndns" "gitea-runner-default"
   ];
 

services/stardew-tracker.nix

@@ -0,0 +1,14 @@
+# services/stardew-tracker.nix — Shared two-year Stardew Valley planner.
+#
+# The application and NixOS module live in the standalone stardew-tracker
+# flake. nginx provides the only public listener and Authelia protects the
+# entire origin; the app itself stays bound to loopback.
+{ config, lib, ... }:
+{
+  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
+    services.stardew-tracker = {
+      enable = true;
+      port = 8089;
+    };
+  };
+}