{ config, lib, pkgs, ... }:

{
  # Postgres data lives on the dedicated second disk (/dev/sdb), not the OS disk.
  # The shared hardware-configuration.nix + sda disk layout come from ./default.nix.
  imports = [ ./hardware-configurations/db-data-disk.nix ];

  networking.hostName = "db-host";

  services.gebos.secrets.postgresAdmin = true;
  # The gebos-postgres-passwords oneshot (gebos-postgres.nix) also syncs the
  # shared Supabase service-role password and the ingester's password, so
  # db-host needs those keys rendered into its env file too.
  services.gebos.secrets.supabase = true;
  services.gebos.secrets.ingester = true;

  services.gebos.postgres = {
    enable = true;
    listenAddresses = [ "0.0.0.0" ];
    # Telemetry, auth, _supavisor, _analytics live in the same cluster.
    # See nix/supabase/init.sql for schema/role bootstrap.
  };

  # Postgres exposed only to the app-host and mqtt-ingest private addresses.
  networking.firewall.extraInputRules = ''
    ip saddr { 10.0.0.0/8 } tcp dport 5432 accept
  '';
}