Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the root with three nixosConfigurations (mqtt-ingest, db-host, app-host), vendored Supabase docker-compose pointed at the external db-host, Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub, deploy-rs node map, and a Gitea Actions workflow that deploys in db → app → ingest order on push to main. No real implementation yet — every host module has TODOs marking the gaps (real hardware config, actual hostnames, HiveMQ packaging, vendor the full upstream Supabase compose, etc.).
2026-05-27 17:23:02 +00:00
parent 71d74d3b83
commit 2d57db8182
34 changed files with 1005 additions and 0 deletions
@@ -0,0 +1,60 @@
+# Gebos
+
+IoT telemetry stack on bare-metal NixOS.
+
+This repo is a monorepo containing all code, NixOS modules, host configurations,
+and CI/CD pipelines for the project. Everything is one `flake.nix`.
+
+## Architecture
+
+Three hosts (see issue #21 for the full design discussion):
+
+| Host          | Role                                      | Public hostname        |
+| ------------- | ----------------------------------------- | ---------------------- |
+| `mqtt-ingest` | HiveMQ CE + Go MQTT→Postgres ingester     | `ingest.ge-bos.de`     |
+| `db-host`     | Postgres 17 + TimescaleDB (telemetry+auth)| internal only          |
+| `app-host`    | Caddy + Kong + Supabase (compose) + SPA   | `app.ge-bos.de`, `api.ge-bos.de` |
+
+Public REST surface is PostgREST + SQL `/rpc/` functions, fronted by Kong, TLS-terminated by Caddy.
+Supabase Studio is bound to `127.0.0.1` on `app-host` — reach it with `ssh -L 3000:127.0.0.1:3000 app-host`.
+
+## Repo layout
+
+```
+flake.nix
+frontend/                # Vite + React SPA
+ingester/                # Go MQTT → Postgres
+nix/
+  modules/               # NixOS modules (one per service)
+  hosts/                 # nixosConfigurations: mqtt-ingest, db-host, app-host
+  supabase/              # vendored Supabase docker-compose, db init SQL
+  dev/                   # process-compose for local development
+  deploy.nix             # deploy-rs node map
+.gitea/workflows/        # CI + CD
+```
+
+## Local development
+
+```
+nix run .#dev
+```
+
+Brings the full stack up on one machine via process-compose-flake (Postgres,
+Supabase compose, Kong, Caddy, ingester, Vite dev server). NixOS required.
+
+## Deployment
+
+`deploy-rs` from a Gitea Actions runner on push to `main`. Closures are built
+once, copied to each host, activated with auto-rollback. Order: `db-host` →
+`app-host` → `mqtt-ingest`.
+
+```
+nix run github:serokell/deploy-rs -- .#db-host       # one host
+nix run github:serokell/deploy-rs -- .                # all hosts
+```
+
+## Secrets
+
+Out-of-band file at `/etc/gebos/secrets.env` on each host, mode `0400`, loaded
+by systemd `EnvironmentFile=`. Not in the repo, not in the Nix store. Rotation
+is manual (ssh + edit + restart unit).