lars/Gebos
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

switch to emqx
check / flake-check (push) Successful in 25s
Details
deploy / deploy (push) Successful in 48s
Details

Browse Source
This commit is contained in:
Lars Nolden
2026-07-02 15:19:59 +02:00
parent 08d9fc594e
commit 58155dc737
11 changed files with 366 additions and 512 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nix/secrets/secrets.yaml.example
+8 -7
View File
@@ -28,11 +28,12 @@ ingester_postgres_password: "replace-me-openssl-rand-hex-32"
# Postgres bootstrap (consumed on db-host by a one-shot ALTER ROLE unit)
postgres_admin_password: "replace-me-openssl-rand-hex-32"
# HiveMQ file-RBAC broker users (consumed on mqtt-ingest by gebos-hivemq).
# PLAIN passwords (password-type defaults to PLAIN; the whole file is sops-
# encrypted). The ingester will authenticate as `ingester`; `admin` is for ops.
hivemq_ingester_password: "replace-me-openssl-rand-hex-32"
hivemq_admin_password: "replace-me-openssl-rand-hex-32"
# EMQX broker users (consumed on mqtt-ingest by gebos-emqx). Plaintext
# passwords in a bootstrap users.csv (the whole file is sops-encrypted at
# rest); no commas allowed. The ingester will authenticate as `ingester`;
# `admin` is the operational break-glass superuser.
emqx_ingester_password: "replace-me-openssl-rand-hex-32"
emqx_admin_password: "replace-me-openssl-rand-hex-32"
# Shared device login (Option A) — must match mqtt_user/mqtt_password on the
# senders. Per-device users (Option B) are a TODO in gebos-secrets.nix.
hivemq_device_password: "replace-me-to-match-the-sender-mqtt_password"
# senders. Per-device users (Option B) are a TODO in gebos-emqx.nix.
emqx_device_password: "replace-me-to-match-the-sender-mqtt_password"