Add shared Stardew Valley tracker

common.nix

@@ -124,6 +124,7 @@ in
     ./services/forgejo-runner.nix
     ./services/code-server.nix
     ./services/redlib.nix
+    ./services/stardew-tracker.nix
     ./services/hardware-health.nix
     ./services/wan-watchdog.nix
     ./services/deployment.nix

flake.lock

@@ -380,10 +380,31 @@
         "nixpkgs": "nixpkgs_2",
         "proton-cachyos-nix": "proton-cachyos-nix",
         "redlib": "redlib",
+        "stardew-tracker": "stardew-tracker",
         "stylix": "stylix",
         "zen-browser": "zen-browser"
       }
     },
+    "stardew-tracker": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1791138456,
+        "narHash": "sha256-3S/M++CkWAhBNEEiCD3XpueK/j4Nj792F4eb3i/osE0=",
+        "ref": "refs/heads/main",
+        "rev": "a33f7a297d289df9507ffe0aa87f054decac459e",
+        "revCount": 1,
+        "type": "git",
+        "url": "https://forg.gregersen.it/rope/stardew-tracker"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://forg.gregersen.it/rope/stardew-tracker"
+      }
+    },
     "stylix": {
       "inputs": {
         "base16": "base16",

flake.nix

@@ -30,6 +30,11 @@
       flake = false;
     };
 
+    stardew-tracker = {
+      url = "git+https://forg.gregersen.it/rope/stardew-tracker";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     stylix = {
       url = "github:nix-community/stylix/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -43,6 +48,7 @@
     , nix-cachyos-kernel
     , stylix
     , proton-cachyos-nix
+    , stardew-tracker
     , ...
     } @ inputs:
     let
@@ -52,6 +58,7 @@
         ./common.nix
         home-manager.nixosModules.home-manager
         stylix.nixosModules.stylix
+        stardew-tracker.nixosModules.default
         ./settings/stylix.nix
       ];
       mkHost = hostname: extraModules: nixpkgs.lib.nixosSystem {

services/authelia.nix

@@ -43,6 +43,7 @@
             { domain = "code.nordhammer.it";       policy = "one_factor"; }
             { domain = "reddit.nordhammer.it";    policy = "one_factor"; }
             { domain = "panel.nordhammer.it";     policy = "one_factor"; }
+            { domain = "stardew.nordhammer.it";  policy = "one_factor"; }
           ];
         };
 

services/nginx.nix

@@ -195,6 +195,14 @@ in
           '';
         };
         "reddit.nordhammer.it"   = protectedProxy 8087;
+        # Shared household checklist. Pass the Authelia identity through only
+        # as update metadata; every authorized user sees the same farm state.
+        "stardew.nordhammer.it"  = lib.recursiveUpdate (protectedProxy 8089) {
+          locations."/".extraConfig = autheliaAuthConfig + ''
+            proxy_set_header Remote-User $user;
+            proxy_set_header Remote-Email $email;
+          '';
+        };
 
         # Pelican game panel. Can't turn off its own login (no such option
         # upstream), so Authelia is the outer gate and the Pelican account

services/service-health.nix

@@ -18,7 +18,7 @@ let
   watched = [
     "jellyfin" "sonarr" "radarr" "prowlarr" "bazarr"
     "qbittorrent-nox" "sabnzbd" "authelia-main" "nginx"
-    "adguardhome" "crowdsec" "go2rtc"
+    "adguardhome" "crowdsec" "go2rtc" "stardew-tracker"
     "cloudflare-dyndns" "gitea-runner-default"
   ];
 

services/stardew-tracker.nix

@@ -0,0 +1,14 @@
+# services/stardew-tracker.nix — Shared two-year Stardew Valley planner.
+#
+# The application and NixOS module live in the standalone stardew-tracker
+# flake. nginx provides the only public listener and Authelia protects the
+# entire origin; the app itself stays bound to loopback.
+{ config, lib, ... }:
+{
+  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
+    services.stardew-tracker = {
+      enable = true;
+      port = 8089;
+    };
+  };
+}