# services/flowtrack.nix — Kayla's private period tracker.
#
# The application and NixOS module live in the standalone flowtrack flake.
# nginx is the only public listener and Authelia admits just kayla and fred;
# the app maps them to owner and read-only viewer. Nightly snapshots go
# straight to the SSD branch of the pool (not via mergerfs), which had the
# cleanest SMART record of the data disks.
{ config, lib, ... }:
{
  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
    services.flowtrack = {
      enable = true;
      port = 8093;
      editors = [ "kayla" ];
      viewers = [ "fred" ];
      backup.directory = "/mnt/disk2/backups/flowtrack";
    };

    systemd.tmpfiles.rules = [ "d /mnt/disk2/backups 0755 root root -" ];
  };
}