tuwunel v1.9.3 (DB migrated, verified); teable mem_limit 2g; nick-timer systemd service + caddy vhost; heather swap 4g, drop chromium, add diag tools; server.nix: drop pinchtab, add nodejs

hosts/heather/nick.nix

@@ -0,0 +1,31 @@
+# Nick timer prototype.
+# Source is deployed separately to /home/mikl/sideprojects/other/nick.
+# Caddy terminates TLS; the app only listens on localhost.
+
+{ config, pkgs, lib, ... }:
+{
+  systemd.services.nick-timer = {
+    description = "Nick timer prototype";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "mikl";
+      Group = "users";
+      WorkingDirectory = "/home/mikl/sideprojects/other/nick";
+      ExecStart = "/home/mikl/.nix-profile/bin/python3 /home/mikl/sideprojects/other/nick/app.py";
+      Restart = "on-failure";
+      RestartSec = 5;
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+    };
+
+    environment = {
+      TIMER_HOST = "127.0.0.1";
+      TIMER_PORT = "8787";
+      TIMER_DB = "/home/mikl/sideprojects/other/nick/data/timer.db";
+    };
+  };
+}