Add infrastructure skeleton for review (refs #21)

Lays out the agreed shape from the design discussion: one flake at the root with three nixosConfigurations (mqtt-ingest, db-host, app-host), vendored Supabase docker-compose pointed at the external db-host, Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub, deploy-rs node map, and a Gitea Actions workflow that deploys in db → app → ingest order on push to main. No real implementation yet — every host module has TODOs marking the gaps (real hardware config, actual hostnames, HiveMQ packaging, vendor the full upstream Supabase compose, etc.).
2026-05-27 17:23:02 +00:00
parent 71d74d3b83
commit 2d57db8182
34 changed files with 1005 additions and 0 deletions
@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.gebos.supabase;
+  composeDir = ../supabase;
+in
+{
+  options.services.gebos.supabase = {
+    enable = lib.mkEnableOption "Supabase stack via vanilla docker-compose";
+
+    postgresHost = lib.mkOption {
+      type = lib.types.str;
+      description = "External Postgres host (db-host).";
+    };
+    postgresPort = lib.mkOption {
+      type = lib.types.port;
+      default = 5432;
+    };
+    studioBindAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Studio is intentionally never exposed publicly.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.docker.enable = true;
+
+    systemd.tmpfiles.rules = [
+      "d /var/lib/gebos-supabase 0750 root root - -"
+    ];
+
+    # Copy the vendored compose file into place at activation time so changes
+    # to nix/supabase/docker-compose.yml are deployed atomically.
+    environment.etc."gebos/supabase/docker-compose.yml".source =
+      "${composeDir}/docker-compose.yml";
+
+    systemd.services.gebos-supabase = {
+      description = "Gebos — Supabase compose stack";
+      after = [ "docker.service" "network-online.target" ];
+      wants = [ "docker.service" "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      environment = {
+        POSTGRES_HOST = cfg.postgresHost;
+        POSTGRES_PORT = toString cfg.postgresPort;
+        POSTGRES_DB = "postgres";
+        STUDIO_BIND = cfg.studioBindAddress;
+      };
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        WorkingDirectory = "/etc/gebos/supabase";
+        EnvironmentFile = "/etc/gebos/secrets.env";  # POSTGRES_PASSWORD, JWT_SECRET, ANON_KEY, SERVICE_ROLE_KEY, DASHBOARD_PASSWORD
+        ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
+        ExecStop  = "${pkgs.docker}/bin/docker compose down";
+      };
+    };
+  };
+}