Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

nix/modules/default.nix

@@ -0,0 +1,8 @@
+{
+  gebos-ingester      = import ./gebos-ingester.nix;
+  gebos-supabase      = import ./gebos-supabase.nix;
+  gebos-caddy         = import ./gebos-caddy.nix;
+  gebos-postgres      = import ./gebos-postgres.nix;
+  gebos-hivemq        = import ./gebos-hivemq.nix;
+  gebos-frontend      = import ./gebos-frontend.nix;
+}

nix/modules/gebos-caddy.nix

@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.caddy;
+
+  siteBlock = host: site:
+    if site ? staticRoot then ''
+      ${host} {
+        root * ${site.staticRoot}
+        file_server
+        try_files {path} /index.html
+        encode zstd gzip
+      }
+    ''
+    else if site ? upstream then ''
+      ${host} {
+        reverse_proxy ${site.upstream}
+        encode zstd gzip
+      }
+    ''
+    else if site ? tcpProxy then ''
+      ${host}:8883 {
+        # TLS termination for MQTT — Caddy's `layer4` app would be ideal here;
+        # for now, document that the upstream HiveMQ port is ${site.tcpProxy}.
+        # TODO: switch to the caddy-l4 module or terminate TLS in HiveMQ directly.
+      }
+    ''
+    else throw "site `${host}` needs one of: staticRoot, upstream, tcpProxy";
+in
+{
+  options.services.gebos.caddy = {
+    enable = lib.mkEnableOption "Gebos Caddy reverse proxy / TLS terminator";
+    sites = lib.mkOption {
+      type = lib.types.attrsOf lib.types.attrs;
+      default = { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.caddy = {
+      enable = true;
+      email = "ops@ge-bos.de";  # TODO: confirm ACME contact
+      extraConfig = lib.concatStringsSep "\n"
+        (lib.mapAttrsToList siteBlock cfg.sites);
+    };
+  };
+}

nix/modules/gebos-frontend.nix

@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.frontend;
+in
+{
+  options.services.gebos.frontend = {
+    enable = lib.mkEnableOption "Gebos static SPA";
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.callPackage ../../frontend { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Nothing to install at the system level — Caddy serves the package's
+    # `share/frontend` directory directly. See nix/hosts/app-host.nix.
+  };
+}

nix/modules/gebos-hivemq.nix

@@ -0,0 +1,33 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.hivemq;
+in
+{
+  options.services.gebos.hivemq = {
+    enable = lib.mkEnableOption "HiveMQ CE single-node broker";
+    persistentSessions = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
+    tlsPort = lib.mkOption {
+      type = lib.types.port;
+      default = 8883;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # TODO: package HiveMQ CE (download tarball + JRE wrapper) and wire as a
+    # systemd unit. Until then this module only declares options so dependent
+    # hosts can be evaluated.
+    systemd.services.gebos-hivemq = {
+      description = "HiveMQ CE";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.coreutils}/bin/true";  # TODO: real HiveMQ command
+        Restart = "on-failure";
+      };
+    };
+  };
+}

nix/modules/gebos-ingester.nix

@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.ingester;
+  ingester = pkgs.callPackage ../../ingester { };
+in
+{
+  options.services.gebos.ingester = {
+    enable = lib.mkEnableOption "Gebos MQTT → Postgres ingester";
+    mqttBroker = lib.mkOption {
+      type = lib.types.str;
+      example = "tcp://127.0.0.1:1883";
+    };
+    postgresUrl = lib.mkOption {
+      type = lib.types.str;
+      description = "DSN without password — password comes from EnvironmentFile.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.gebos-ingester = {
+      description = "Gebos MQTT → Postgres ingester";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        GEBOS_MQTT_BROKER = cfg.mqttBroker;
+        GEBOS_POSTGRES_URL = cfg.postgresUrl;
+      };
+
+      serviceConfig = {
+        ExecStart = "${ingester}/bin/gebos-ingester";
+        DynamicUser = true;
+        EnvironmentFile = "/etc/gebos/secrets.env";  # GEBOS_POSTGRES_PASSWORD
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+    };
+  };
+}

nix/modules/gebos-postgres.nix

@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.postgres;
+in
+{
+  options.services.gebos.postgres = {
+    enable = lib.mkEnableOption "Gebos Postgres 17 + TimescaleDB";
+    listenAddresses = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "127.0.0.1" ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.postgresql = {
+      enable = true;
+      package = pkgs.postgresql_17;
+      enableTCPIP = true;
+      settings = {
+        listen_addresses = lib.concatStringsSep "," cfg.listenAddresses;
+        shared_preload_libraries = "timescaledb,pg_stat_statements";
+      };
+      extensions = ps: with ps; [
+        timescaledb
+        pgjwt
+        pg_graphql
+        pgsodium
+        # supabase_vault — TODO: package or vendor
+      ];
+      # Init script creates Supabase's `auth`, `storage`, `_analytics`, `_supavisor`
+      # schemas, the gebos_ingest role (BYPASSRLS), and telemetry hypertables.
+      initialScript = ../supabase/init.sql;
+    };
+  };
+}

nix/modules/gebos-supabase.nix

@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.supabase;
+  composeDir = ../supabase;
+in
+{
+  options.services.gebos.supabase = {
+    enable = lib.mkEnableOption "Supabase stack via vanilla docker-compose";
+
+    postgresHost = lib.mkOption {
+      type = lib.types.str;
+      description = "External Postgres host (db-host).";
+    };
+    postgresPort = lib.mkOption {
+      type = lib.types.port;
+      default = 5432;
+    };
+    studioBindAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Studio is intentionally never exposed publicly.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.docker.enable = true;
+
+    systemd.tmpfiles.rules = [
+      "d /var/lib/gebos-supabase 0750 root root - -"
+    ];
+
+    # Copy the vendored compose file into place at activation time so changes
+    # to nix/supabase/docker-compose.yml are deployed atomically.
+    environment.etc."gebos/supabase/docker-compose.yml".source =
+      "${composeDir}/docker-compose.yml";
+
+    systemd.services.gebos-supabase = {
+      description = "Gebos — Supabase compose stack";
+      after = [ "docker.service" "network-online.target" ];
+      wants = [ "docker.service" "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        POSTGRES_HOST = cfg.postgresHost;
+        POSTGRES_PORT = toString cfg.postgresPort;
+        POSTGRES_DB = "postgres";
+        STUDIO_BIND = cfg.studioBindAddress;
+      };
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        WorkingDirectory = "/etc/gebos/supabase";
+        EnvironmentFile = "/etc/gebos/secrets.env";  # POSTGRES_PASSWORD, JWT_SECRET, ANON_KEY, SERVICE_ROLE_KEY, DASHBOARD_PASSWORD
+        ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
+        ExecStop  = "${pkgs.docker}/bin/docker compose down";
+      };
+    };
+  };
+}