# services/flowtrack.nix — Kayla's private period tracker.
#
# The application and NixOS module live in the standalone flowtrack flake.
# nginx is the only public listener and Authelia admits just kayla and fred;
# the app maps them to owner and read-only viewer. Nightly snapshots go
# straight to the SSD branch of the pool (not via mergerfs), which had the
# cleanest SMART record of the data disks.
{ config, lib, ... }:
{
  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
    services.flowtrack = {
      enable = true;
      port = 8093;
      editors = [ "kayla" ];
      viewers = [ "fred" ];
      backup.directory = "/mnt/disk2/backups/flowtrack";
      # Push reminders. The contact goes to Apple in the VAPID token; the
      # site URL avoids handing out a personal address.
      push.contact = "https://flowtrack.nordhammer.it";
      push.time = "*-*-* 09:00:00 Europe/London";
    };

    systemd.tmpfiles.rules = [ "d /mnt/disk2/backups 0755 root root -" ];
  };
}