Klaus
2dd5ed5877
check / flake-check (pull_request) Has been cancelled
- sops-nix flake input, age + ssh-to-age in devShell, .sops.yaml with per-host recipients (real pubkeys still TODO until lars bootstraps). - nix/modules/gebos-secrets.nix centralises per-host secret subsets and renders /run/secrets/gebos-env via sops.templates. Service modules now read EnvironmentFile= from services.gebos.secrets.envFile instead of the placeholder /etc/gebos/secrets.env. - Falls back to a writeText env file when nix/secrets/secrets.yaml is absent, so `nix flake check` and first-boot eval work pre-bootstrap. - nix/secrets/README.md walks through age key + sops bootstrap. - Dev defaults: ingester binary falls back to local tcp/postgres URLs, process-compose adds mosquitto and wires GEBOS_MQTT_BROKER / GEBOS_POSTGRES_URL / GEBOS_POSTGRES_PASSWORD + VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY, frontend defaults to 127.0.0.1:8000 in DEV. Refs #23 (comment #110).
64 lines
1.9 KiB
Nix
64 lines
1.9 KiB
Nix
{
|
|
description = "Gebos — IoT telemetry stack on bare-metal NixOS";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
flake-parts.url = "github:hercules-ci/flake-parts";
|
|
deploy-rs.url = "github:serokell/deploy-rs";
|
|
process-compose-flake.url = "github:Platonic-Systems/process-compose-flake";
|
|
services-flake.url = "github:juspay/services-flake";
|
|
sops-nix = {
|
|
url = "github:Mic92/sops-nix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
};
|
|
|
|
outputs = inputs@{ self, flake-parts, nixpkgs, deploy-rs, ... }:
|
|
flake-parts.lib.mkFlake { inherit inputs; } {
|
|
systems = [ "x86_64-linux" "aarch64-linux" ];
|
|
|
|
imports = [
|
|
inputs.process-compose-flake.flakeModule
|
|
];
|
|
|
|
flake = {
|
|
nixosModules = import ./nix/modules;
|
|
nixosConfigurations = import ./nix/hosts { inherit inputs; };
|
|
deploy = import ./nix/deploy.nix { inherit inputs; };
|
|
|
|
# `nix flake check` runs deploy-rs's schema check on every node
|
|
checks = builtins.mapAttrs
|
|
(system: deployLib: deployLib.deployChecks self.deploy)
|
|
deploy-rs.lib;
|
|
};
|
|
|
|
perSystem = { config, pkgs, system, ... }: {
|
|
packages = {
|
|
ingester = pkgs.callPackage ./ingester { };
|
|
frontend = pkgs.callPackage ./frontend { };
|
|
};
|
|
|
|
devShells.default = pkgs.mkShell {
|
|
packages = with pkgs; [
|
|
go
|
|
gopls
|
|
nodejs_20
|
|
postgresql_17
|
|
supabase-cli
|
|
deploy-rs.packages.${system}.default
|
|
sops
|
|
age
|
|
ssh-to-age
|
|
];
|
|
};
|
|
|
|
# `nix run .#dev` — full stack locally via process-compose-flake.
|
|
# Real service wiring lives in nix/dev/process-compose.nix.
|
|
process-compose.dev = import ./nix/dev/process-compose.nix {
|
|
inherit pkgs;
|
|
inherit (inputs) services-flake;
|
|
};
|
|
};
|
|
};
|
|
}
|