Pushed 2dd5ed5 to this branch.
sops-nix
sops-nixflake input;sops,age,ssh-to-agein the devShell..sops.yamlwith…
Standard answer in the Nix world: sops-nix with age recipients. Maps onto what you described almost exactly.
Shape
- One file in repo, e.g.…
Three buckets, all referenced from this branch:
1. Gitea Actions secret (CI)
DEPLOY_SSH_KEY— ed25519 private key fordeploy@{db,app,mqtt-ingest}hosts. Used by `.gitea/workflows/deploy…
Skeleton PR up as #23 (draft).
Studio is bound to 127.0.0.1 on app-host — no public route. Access from your laptop with ssh -L 3000:127.0.0.1:3000 app-host, as agreed.
PR description…
Locked:
- PostgREST +
/rpc/is the public REST surface, Huma dropped - Caddy (TLS / ACME) → Kong (API gateway, key check, path fan-out) → upstreams
- Single subdomain:
api.ge-bos.defor…
Good questions — 2 and 3 are worth digging into.
1. Supabase on external db-host — locked
Concretely: in the compose file, remove (or profiles: out) the bundled db service, then…
Locked in:
- Single-node HiveMQ CE with persistent sessions on disk
- Topic-encoded tenancy →
tenant_idcolumn on the hypertable, standard RLS (`USING (tenant_id = current_setting('app.tenant_i…
Good — splitting failure domains across three hosts makes sense. A few things to refine before we commit.
Things I'd push back on or want to confirm
1. HiveMQ CE HA isn't really HA.…
Happy to ideate before I touch any code. Here's a strawman so we have something concrete to push back on — nothing below is decided.
Proposed shape
One flake.nix at the repo root…