From 8d97d09b070aedf6818cada1621717f93a5177ca Mon Sep 17 00:00:00 2001
From: Petru Paler <petru@paler.net>
Date: Thu, 15 Jan 2026 07:13:36 +0000
Subject: [PATCH] Add phaseflow-cron job and PocketBase admin credentials

- New periodic job for daily Garmin sync at 6 AM
- Added pocketbase_admin_email and pocketbase_admin_password to
  secrets template for cron job authentication

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 services/phaseflow-cron.hcl | 42 +++++++++++++++++++++++++++++++++++++
 services/phaseflow.hcl      |  7 +++++--
 2 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 services/phaseflow-cron.hcl

diff --git a/services/phaseflow-cron.hcl b/services/phaseflow-cron.hcl
new file mode 100644
index 0000000..858b9b5
--- /dev/null
+++ b/services/phaseflow-cron.hcl
@@ -0,0 +1,42 @@
+# ABOUTME: Periodic batch job for PhaseFlow Garmin sync.
+# ABOUTME: Triggers daily sync at 6 AM to fetch fitness data and generate training recommendations.
+
+job "phaseflow-cron" {
+  datacenters = ["alo"]
+  type        = "batch"
+
+  periodic {
+    crons            = ["0 6 * * *"]
+    prohibit_overlap = true
+    time_zone        = "Europe/Lisbon"
+  }
+
+  group "garmin-sync" {
+    task "trigger" {
+      driver = "raw_exec"
+
+      config {
+        command = "/bin/sh"
+        args    = ["local/script.sh"]
+      }
+
+      template {
+        destination = "local/script.sh"
+        data        = <<EOH
+set -e
+/run/current-system/sw/bin/curl -s -f -X POST \
+  -H "Authorization: Bearer $CRON_SECRET" \
+  https://phaseflow.v.paler.net/api/cron/garmin-sync
+EOH
+      }
+
+      template {
+        destination = "secrets/env.env"
+        env         = true
+        data        = <<EOH
+{{- with nomadVar "secrets/phaseflow" -}}CRON_SECRET="{{ .cron_secret }}"{{- end -}}
+EOH
+      }
+    }
+  }
+}
diff --git a/services/phaseflow.hcl b/services/phaseflow.hcl
index fa15d5a..edda2a9 100644
--- a/services/phaseflow.hcl
+++ b/services/phaseflow.hcl
@@ -6,7 +6,9 @@
 #   nomad var put secrets/phaseflow \
 #     resend_api_key="re_xxxx" \
 #     encryption_key="$(openssl rand -hex 16)" \
-#     cron_secret="$(openssl rand -hex 32)"
+#     cron_secret="$(openssl rand -hex 32)" \
+#     pocketbase_admin_email="admin@example.com" \
+#     pocketbase_admin_password="your-admin-password"
 
 job "phaseflow" {
   datacenters = ["alo"]
@@ -66,7 +68,6 @@ job "phaseflow" {
         tags = [
           "traefik.enable=true",
           "traefik.http.routers.pocketbase-phaseflow.entryPoints=websecure",
-          "traefik.http.routers.pocketbase-phaseflow.middlewares=oidc-auth@file",
         ]
       }
     }
@@ -98,6 +99,8 @@ job "phaseflow" {
 RESEND_API_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .resend_api_key }}{{ end }}
 ENCRYPTION_KEY={{ with nomadVar "secrets/phaseflow" }}{{ .encryption_key }}{{ end }}
 CRON_SECRET={{ with nomadVar "secrets/phaseflow" }}{{ .cron_secret }}{{ end }}
+POCKETBASE_ADMIN_EMAIL={{ with nomadVar "secrets/phaseflow" }}{{ .pocketbase_admin_email }}{{ end }}
+POCKETBASE_ADMIN_PASSWORD={{ with nomadVar "secrets/phaseflow" }}{{ .pocketbase_admin_password }}{{ end }}
 EOH
       }