lars/Gebos

Files

T

check / flake-check (pull_request) Has been cancelled

Details

Add infrastructure skeleton for review (refs #21 )

Lays out the agreed shape from the design discussion: one flake at the
root with three nixosConfigurations (mqtt-ingest, db-host, app-host),
vendored Supabase docker-compose pointed at the external db-host,
Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub,
deploy-rs node map, and a Gitea Actions workflow that deploys in
db → app → ingest order on push to main.

No real implementation yet — every host module has TODOs marking the
gaps (real hardware config, actual hostnames, HiveMQ packaging,
vendor the full upstream Supabase compose, etc.).

2026-05-27 17:23:02 +00:00

2.1 KiB

Raw Blame History

Gebos

IoT telemetry stack on bare-metal NixOS.

This repo is a monorepo containing all code, NixOS modules, host configurations, and CI/CD pipelines for the project. Everything is one flake.nix.

Architecture

Three hosts (see issue #21 for the full design discussion):

Host	Role	Public hostname
`mqtt-ingest`	HiveMQ CE + Go MQTT→Postgres ingester	`ingest.ge-bos.de`
`db-host`	Postgres 17 + TimescaleDB (telemetry+auth)	internal only
`app-host`	Caddy + Kong + Supabase (compose) + SPA	`app.ge-bos.de`, `api.ge-bos.de`

Public REST surface is PostgREST + SQL /rpc/ functions, fronted by Kong, TLS-terminated by Caddy. Supabase Studio is bound to 127.0.0.1 on app-host — reach it with ssh -L 3000:127.0.0.1:3000 app-host.

Repo layout

flake.nix
frontend/                # Vite + React SPA
ingester/                # Go MQTT → Postgres
nix/
  modules/               # NixOS modules (one per service)
  hosts/                 # nixosConfigurations: mqtt-ingest, db-host, app-host
  supabase/              # vendored Supabase docker-compose, db init SQL
  dev/                   # process-compose for local development
  deploy.nix             # deploy-rs node map
.gitea/workflows/        # CI + CD

Local development

nix run .#dev

Brings the full stack up on one machine via process-compose-flake (Postgres, Supabase compose, Kong, Caddy, ingester, Vite dev server). NixOS required.

Deployment

deploy-rs from a Gitea Actions runner on push to main. Closures are built once, copied to each host, activated with auto-rollback. Order: db-host → app-host → mqtt-ingest.

nix run github:serokell/deploy-rs -- .#db-host       # one host
nix run github:serokell/deploy-rs -- .                # all hosts

Secrets

Out-of-band file at /etc/gebos/secrets.env on each host, mode 0400, loaded by systemd EnvironmentFile=. Not in the repo, not in the Nix store. Rotation is manual (ssh + edit + restart unit).

2.1 KiB Raw Blame History