diff --git a/configs/default.nix b/configs/default.nix
index 35ef0f3..ba92e09 100644
--- a/configs/default.nix
+++ b/configs/default.nix
@@ -1,5 +1,6 @@
 { ... }: {
   imports = [
+    ./tracker.nix
     ./git.nix
     ./pkgs.nix
   ];
diff --git a/configs/tracker-bin b/configs/tracker-bin
new file mode 100755
index 0000000..719dd14
Binary files /dev/null and b/configs/tracker-bin differ
diff --git a/configs/tracker.nix b/configs/tracker.nix
new file mode 100644
index 0000000..30ff0f3
--- /dev/null
+++ b/configs/tracker.nix
@@ -0,0 +1,72 @@
+# tracker: single-host project tracker web app (hackerman edition).
+# Wraps the prebuilt Go binary in ./tracker-bin; rebuild it with
+#   CGO_ENABLED=0 go build -o tracker-bin .
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.tracker;
+
+  trackerPackage = pkgs.stdenvNoCC.mkDerivation {
+    pname = "tracker";
+    version = "0.1.0";
+    src = ./tracker-bin;
+    dontUnpack = true;
+    dontBuild = true;
+    installPhase = ''
+      install -Dm755 $src $out/bin/tracker
+    '';
+  };
+in
+{
+  options.services.tracker = {
+    enable = mkEnableOption "tracker project tracker web app";
+
+    address = mkOption {
+      type = types.str;
+      default = ":8420";
+      description = "Address for the tracker web server to listen on.";
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Open the firewall for the tracker port on the tailscale interface.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users.tracker = {
+      isSystemUser = true;
+      group = "tracker";
+      description = "tracker service user";
+    };
+    users.groups.tracker = { };
+
+    systemd.services.tracker = {
+      description = "tracker project tracker (hackerman edition)";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        User = "tracker";
+        Group = "tracker";
+        StateDirectory = "tracker";
+        ExecStart = "${trackerPackage}/bin/tracker -addr ${cfg.address} -db /var/lib/tracker/tracker.db";
+        Restart = "on-failure";
+        RestartSec = 5;
+
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      };
+    };
+
+    networking.firewall.interfaces."tailscale0".allowedTCPPorts =
+      mkIf cfg.openFirewall [ (toInt (removePrefix ":" cfg.address)) ];
+  };
+}
diff --git a/hw/straylight/default.nix b/hw/straylight/default.nix
index 00f47a0..e4f50b8 100644
--- a/hw/straylight/default.nix
+++ b/hw/straylight/default.nix
@@ -350,6 +350,9 @@ in
       };
     };
 
+    # Project tracker (hackerman edition), tailnet-only.
+    services.tracker.enable = true;
+
     # Open ports: DNS (53), mc-proxy (443/8443/9443), agent (9444), master (9555), open-webui (8080).
     networking.firewall.allowedTCPPorts = [ 53 443 8080 8443 9443 9444 9555 ];
     networking.firewall.allowedUDPPorts = [ 53 ];