Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

nix/hosts/app-host.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+
+{
+  networking.hostName = "app-host";
+
+  services.gebos.supabase = {
+    enable = true;
+    # Compose stack points at external db-host instead of the bundled `db` service.
+    postgresHost = "db-host.gebos.internal";  # TODO: real internal hostname
+    postgresPort = 5432;
+    # Studio bound to loopback only — reach via `ssh -L 3000:127.0.0.1:3000 app-host`.
+    studioBindAddress = "127.0.0.1";
+  };
+
+  services.gebos.caddy = {
+    enable = true;
+    # Caddy terminates TLS, proxies to Kong on 127.0.0.1:8000.
+    sites = {
+      "api.ge-bos.de" = { upstream = "127.0.0.1:8000"; };  # → Kong → PostgREST/GoTrue
+      "app.ge-bos.de" = { staticRoot = "${config.services.gebos.frontend.package}/share/frontend"; };
+    };
+  };
+
+  services.gebos.frontend.enable = true;
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}

nix/hosts/common.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, ... }:
+
+{
+  system.stateVersion = "25.05";
+
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    trusted-users = [ "@wheel" "deploy" ];
+  };
+
+  # deploy-rs SSHes in as `deploy` and uses sudo to activate.
+  users.users.deploy = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      # TODO: paste the Gitea runner's deploy ed25519 pubkey here
+    ];
+  };
+  security.sudo.wheelNeedsPassword = false;
+
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+  };
+
+  networking.firewall.enable = true;
+
+  time.timeZone = "UTC";
+
+  environment.systemPackages = with pkgs; [ vim curl jq ];
+}

nix/hosts/db-host.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+
+{
+  networking.hostName = "db-host";
+
+  # Skeleton: real hardware-configuration.nix + boot/fs lives next to this file
+  # once we have the actual box. Marked here so the structure is visible.
+  # imports = [ ./db-host.hardware.nix ];
+
+  services.gebos.postgres = {
+    enable = true;
+    listenAddresses = [ "0.0.0.0" ];
+    # Telemetry, auth, _supavisor, _analytics live in the same cluster.
+    # See nix/supabase/init.sql for schema/role bootstrap.
+  };
+
+  # Postgres exposed only to the app-host and mqtt-ingest private addresses.
+  networking.firewall.extraInputRules = ''
+    ip saddr { 10.0.0.0/8 } tcp dport 5432 accept
+  '';
+}

nix/hosts/default.nix

@@ -0,0 +1,24 @@
+{ inputs }:
+
+let
+  mkHost = name: extraModules:
+    inputs.nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      specialArgs = { inherit inputs; };
+      modules = [
+        ./common.nix
+        (import ../modules).gebos-postgres
+        (import ../modules).gebos-supabase
+        (import ../modules).gebos-caddy
+        (import ../modules).gebos-hivemq
+        (import ../modules).gebos-ingester
+        (import ../modules).gebos-frontend
+        ./${name}.nix
+      ] ++ extraModules;
+    };
+in
+{
+  db-host     = mkHost "db-host"     [ ];
+  app-host    = mkHost "app-host"    [ ];
+  mqtt-ingest = mkHost "mqtt-ingest" [ ];
+}

nix/hosts/mqtt-ingest.nix

@@ -0,0 +1,29 @@
+{ config, lib, pkgs, ... }:
+
+{
+  networking.hostName = "mqtt-ingest";
+
+  services.gebos.hivemq = {
+    enable = true;
+    # Persistent sessions on disk — single-node, devices reconnect on restart.
+    persistentSessions = true;
+    tlsPort = 8883;
+  };
+
+  services.gebos.ingester = {
+    enable = true;
+    mqttBroker = "tcp://127.0.0.1:1883";   # local broker
+    postgresUrl = "postgres://gebos_ingest@db-host.gebos.internal:5432/postgres?sslmode=require";
+    # Password sourced from /etc/gebos/secrets.env via EnvironmentFile.
+  };
+
+  # Caddy fronts TLS for `ingest.ge-bos.de` and forwards to HiveMQ.
+  services.gebos.caddy = {
+    enable = true;
+    sites = {
+      "ingest.ge-bos.de" = { tcpProxy = "127.0.0.1:8883"; };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 8883 ];
+}