{ config, lib, pkgs, ... }:

{
  networking.hostName = "db-host";

  services.gebos.secrets.postgresAdmin = true;

  # Skeleton: real hardware-configuration.nix + boot/fs lives next to this file
  # once we have the actual box. Marked here so the structure is visible.
  # imports = [ ./db-host.hardware.nix ];

  services.gebos.postgres = {
    enable = true;
    listenAddresses = [ "0.0.0.0" ];
    # Telemetry, auth, _supavisor, _analytics live in the same cluster.
    # See nix/supabase/init.sql for schema/role bootstrap.
  };

  # Postgres exposed only to the app-host and mqtt-ingest private addresses.
  networking.firewall.extraInputRules = ''
    ip saddr { 10.0.0.0/8 } tcp dport 5432 accept
  '';
}