{ pkgs, services-flake }:

{ ... }:
let
  # Dev-only credentials. Match the defaults baked into ingester/main.go and
  # frontend/src/supabase.ts, so `nix run .#dev` and `go run ./ingester` /
  # `npm --prefix frontend run dev` all interoperate without any setup.
  #
  # These values are public on purpose — they ONLY work against the local
  # process-compose stack. Real prod values come from sops-nix (see
  # nix/secrets/README.md).
  dev = {
    pgUser     = "gebos_ingest";
    pgDB       = "gebos";
    pgPassword = "dev";
    pgHost     = "127.0.0.1";
    pgPort     = 5432;

    mqttHost = "127.0.0.1";
    mqttPort = 1883;

    # Pre-generated dev JWT pair, signed with `jwt_secret = "dev-jwt-secret-32chars-minimum-xxxxx"`.
    # Anyone with this token can read/write the local dev stack only — not prod.
    jwtSecret       = "dev-jwt-secret-32chars-minimum-xxxxx";
    anonKey         = "dev-anon-key-placeholder-regenerate-with-supabase-self-host-script";
    serviceRoleKey  = "dev-service-role-key-placeholder-regenerate-with-supabase-self-host-script";

    supabaseUrl = "http://127.0.0.1:8000";
  };

  ingesterEnv = {
    GEBOS_MQTT_BROKER       = "tcp://${dev.mqttHost}:${toString dev.mqttPort}";
    GEBOS_POSTGRES_URL      = "postgres://${dev.pgUser}@${dev.pgHost}:${toString dev.pgPort}/${dev.pgDB}?sslmode=disable";
    GEBOS_POSTGRES_PASSWORD = dev.pgPassword;
  };

  frontendEnv = {
    VITE_SUPABASE_URL      = dev.supabaseUrl;
    VITE_SUPABASE_ANON_KEY = dev.anonKey;
  };
in
{
  imports = [ services-flake.processComposeModules.default ];

  services = {
    postgres."db" = {
      enable = true;
      port = dev.pgPort;
      initialDatabases = [{ name = dev.pgDB; }];
    };

    mosquitto."broker" = {
      enable = true;
      port = dev.mqttPort;
    };
  };

  settings.processes = {
    ingester = {
      command = "${pkgs.go}/bin/go run ./ingester";
      environment = ingesterEnv;
      depends_on = {
        "db".condition = "process_healthy";
        "broker".condition = "process_started";
      };
    };
    frontend = {
      command = "${pkgs.nodejs_24}/bin/npm --prefix frontend install && ${pkgs.nodejs_24}/bin/npm --prefix frontend run dev";
      environment = frontendEnv;
    };
    # TODO: supabase compose (point POSTGRES_HOST at the services-flake db)
    # TODO: kong (use the vendored kong.yml from nix/supabase/)
    # TODO: caddy (mirror prod routes locally, no TLS)
  };
}