Klaus
2d57db8182
check / flake-check (pull_request) Has been cancelled
Lays out the agreed shape from the design discussion: one flake at the root with three nixosConfigurations (mqtt-ingest, db-host, app-host), vendored Supabase docker-compose pointed at the external db-host, Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub, deploy-rs node map, and a Gitea Actions workflow that deploys in db → app → ingest order on push to main. No real implementation yet — every host module has TODOs marking the gaps (real hardware config, actual hostnames, HiveMQ packaging, vendor the full upstream Supabase compose, etc.).
48 lines
1.2 KiB
Nix
48 lines
1.2 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
cfg = config.services.gebos.caddy;
|
|
|
|
siteBlock = host: site:
|
|
if site ? staticRoot then ''
|
|
${host} {
|
|
root * ${site.staticRoot}
|
|
file_server
|
|
try_files {path} /index.html
|
|
encode zstd gzip
|
|
}
|
|
''
|
|
else if site ? upstream then ''
|
|
${host} {
|
|
reverse_proxy ${site.upstream}
|
|
encode zstd gzip
|
|
}
|
|
''
|
|
else if site ? tcpProxy then ''
|
|
${host}:8883 {
|
|
# TLS termination for MQTT — Caddy's `layer4` app would be ideal here;
|
|
# for now, document that the upstream HiveMQ port is ${site.tcpProxy}.
|
|
# TODO: switch to the caddy-l4 module or terminate TLS in HiveMQ directly.
|
|
}
|
|
''
|
|
else throw "site `${host}` needs one of: staticRoot, upstream, tcpProxy";
|
|
in
|
|
{
|
|
options.services.gebos.caddy = {
|
|
enable = lib.mkEnableOption "Gebos Caddy reverse proxy / TLS terminator";
|
|
sites = lib.mkOption {
|
|
type = lib.types.attrsOf lib.types.attrs;
|
|
default = { };
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
services.caddy = {
|
|
enable = true;
|
|
email = "ops@ge-bos.de"; # TODO: confirm ACME contact
|
|
extraConfig = lib.concatStringsSep "\n"
|
|
(lib.mapAttrsToList siteBlock cfg.sites);
|
|
};
|
|
};
|
|
}
|