Klaus
2d57db8182
Lays out the agreed shape from the design discussion: one flake at the root with three nixosConfigurations (mqtt-ingest, db-host, app-host), vendored Supabase docker-compose pointed at the external db-host, Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub, deploy-rs node map, and a Gitea Actions workflow that deploys in db → app → ingest order on push to main. No real implementation yet — every host module has TODOs marking the gaps (real hardware config, actual hostnames, HiveMQ packaging, vendor the full upstream Supabase compose, etc.).
Gebos
IoT telemetry stack on bare-metal NixOS.
This repo is a monorepo containing all code, NixOS modules, host configurations,
and CI/CD pipelines for the project. Everything is one flake.nix.
Architecture
Three hosts (see issue #21 for the full design discussion):
| Host | Role | Public hostname |
|---|---|---|
mqtt-ingest |
HiveMQ CE + Go MQTT→Postgres ingester | ingest.ge-bos.de |
db-host |
Postgres 17 + TimescaleDB (telemetry+auth) | internal only |
app-host |
Caddy + Kong + Supabase (compose) + SPA | app.ge-bos.de, api.ge-bos.de |
Public REST surface is PostgREST + SQL /rpc/ functions, fronted by Kong, TLS-terminated by Caddy.
Supabase Studio is bound to 127.0.0.1 on app-host — reach it with ssh -L 3000:127.0.0.1:3000 app-host.
Repo layout
flake.nix
frontend/ # Vite + React SPA
ingester/ # Go MQTT → Postgres
nix/
modules/ # NixOS modules (one per service)
hosts/ # nixosConfigurations: mqtt-ingest, db-host, app-host
supabase/ # vendored Supabase docker-compose, db init SQL
dev/ # process-compose for local development
deploy.nix # deploy-rs node map
.gitea/workflows/ # CI + CD
Local development
nix run .#dev
Brings the full stack up on one machine via process-compose-flake (Postgres, Supabase compose, Kong, Caddy, ingester, Vite dev server). NixOS required.
Deployment
deploy-rs from a Gitea Actions runner on push to main. Closures are built
once, copied to each host, activated with auto-rollback. Order: db-host →
app-host → mqtt-ingest.
nix run github:serokell/deploy-rs -- .#db-host # one host
nix run github:serokell/deploy-rs -- . # all hosts
Secrets
Out-of-band file at /etc/gebos/secrets.env on each host, mode 0400, loaded
by systemd EnvironmentFile=. Not in the repo, not in the Nix store. Rotation
is manual (ssh + edit + restart unit).