traccar: replace owntracks with traccar

configuration.nix

@@ -73,6 +73,8 @@
     ./services/harmonia.nix
 
     ./services/ddns-updater.nix
+
+    ./services/traccar.nix
   ];
 
   # Hosts entries for CI/CD deploy targets

service-configs.nix

@@ -68,6 +68,10 @@ rec {
         port = 64738;
         proto = "both";
       };
+      traccar_tracking = {
+        port = 5056;
+        proto = "tcp";
+      };
     };
 
     # Ports bound to localhost / VPN only. The flake asserts none of
@@ -197,6 +201,10 @@ rec {
         port = 5500;
         proto = "tcp";
       };
+      traccar_web = {
+        port = 8082;
+        proto = "tcp";
+      };
     };
   };
 
@@ -330,6 +338,10 @@ rec {
     dataDir = services_dir + "/trilium";
   };
 
+  traccar = {
+    domain = "traccar.${https.domain}";
+  };
+
   media = {
     moviesDir = torrents_path + "/media/movies";
     tvDir = torrents_path + "/media/tv";

services/traccar.nix

@@ -0,0 +1,36 @@
+{
+  service_configs,
+  lib,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "traccar" service_configs.zpool_ssds [
+      "/var/lib/private/traccar"
+    ])
+    (lib.serviceFilePerms "traccar" [
+      "Z /var/lib/private/traccar 0700 root root"
+    ])
+    (lib.mkCaddyReverseProxy {
+      subdomain = "traccar";
+      port = service_configs.ports.private.traccar_web.port;
+    })
+  ];
+
+  services.traccar = {
+    enable = true;
+    settings = {
+      web.port = toString service_configs.ports.private.traccar_web.port;
+
+      # Only enable OsmAnd protocol (phone app). Prevents Traccar from
+      # opening 200+ default protocol ports that conflict with other services.
+      protocols.enable = "osmand";
+      osmand.port = toString service_configs.ports.public.traccar_tracking.port;
+    };
+  };
+
+  # OsmAnd tracking port must be reachable from the internet for the phone app
+  networking.firewall.allowedTCPPorts = [
+    service_configs.ports.public.traccar_tracking.port
+  ];
+}

tests/fail2ban-jellyfin.nix

@@ -107,7 +107,7 @@ pkgs.testers.runNixOSTest {
     server.wait_for_unit("jellyfin.service")
     server.wait_for_unit("fail2ban.service")
     server.wait_for_open_port(8096)
-    server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60)
+    server.wait_until_succeeds("curl -sf http://localhost:8096/health | grep -q Healthy", timeout=120)
     time.sleep(2)
 
     # Wait for Jellyfin to create real log files and reload fail2ban

tests/jellyfin-test-lib.py

@@ -18,7 +18,7 @@ def setup_jellyfin(machine, retry, auth_header, auth_payload, empty_payload):
     machine.wait_for_unit("jellyfin.service")
     machine.wait_for_open_port(8096)
     machine.wait_until_succeeds(
-        "curl -sf http://localhost:8096/health | grep -q Healthy", timeout=60
+        "curl -sf http://localhost:8096/health | grep -q Healthy", timeout=120
     )
 
     machine.wait_until_succeeds(