Klaus
2dd5ed5877
check / flake-check (pull_request) Has been cancelled
- sops-nix flake input, age + ssh-to-age in devShell, .sops.yaml with per-host recipients (real pubkeys still TODO until lars bootstraps). - nix/modules/gebos-secrets.nix centralises per-host secret subsets and renders /run/secrets/gebos-env via sops.templates. Service modules now read EnvironmentFile= from services.gebos.secrets.envFile instead of the placeholder /etc/gebos/secrets.env. - Falls back to a writeText env file when nix/secrets/secrets.yaml is absent, so `nix flake check` and first-boot eval work pre-bootstrap. - nix/secrets/README.md walks through age key + sops bootstrap. - Dev defaults: ingester binary falls back to local tcp/postgres URLs, process-compose adds mosquitto and wires GEBOS_MQTT_BROKER / GEBOS_POSTGRES_URL / GEBOS_POSTGRES_PASSWORD + VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY, frontend defaults to 127.0.0.1:8000 in DEV. Refs #23 (comment #110).
76 lines
2.3 KiB
Nix
76 lines
2.3 KiB
Nix
{ pkgs, services-flake }:
|
|
|
|
{ ... }:
|
|
let
|
|
# Dev-only credentials. Match the defaults baked into ingester/main.go and
|
|
# frontend/src/supabase.ts, so `nix run .#dev` and `go run ./ingester` /
|
|
# `npm --prefix frontend run dev` all interoperate without any setup.
|
|
#
|
|
# These values are public on purpose — they ONLY work against the local
|
|
# process-compose stack. Real prod values come from sops-nix (see
|
|
# nix/secrets/README.md).
|
|
dev = {
|
|
pgUser = "gebos_ingest";
|
|
pgDB = "gebos";
|
|
pgPassword = "dev";
|
|
pgHost = "127.0.0.1";
|
|
pgPort = 5432;
|
|
|
|
mqttHost = "127.0.0.1";
|
|
mqttPort = 1883;
|
|
|
|
# Pre-generated dev JWT pair, signed with `jwt_secret = "dev-jwt-secret-32chars-minimum-xxxxx"`.
|
|
# Anyone with this token can read/write the local dev stack only — not prod.
|
|
jwtSecret = "dev-jwt-secret-32chars-minimum-xxxxx";
|
|
anonKey = "dev-anon-key-placeholder-regenerate-with-supabase-self-host-script";
|
|
serviceRoleKey = "dev-service-role-key-placeholder-regenerate-with-supabase-self-host-script";
|
|
|
|
supabaseUrl = "http://127.0.0.1:8000";
|
|
};
|
|
|
|
ingesterEnv = {
|
|
GEBOS_MQTT_BROKER = "tcp://${dev.mqttHost}:${toString dev.mqttPort}";
|
|
GEBOS_POSTGRES_URL = "postgres://${dev.pgUser}@${dev.pgHost}:${toString dev.pgPort}/${dev.pgDB}?sslmode=disable";
|
|
GEBOS_POSTGRES_PASSWORD = dev.pgPassword;
|
|
};
|
|
|
|
frontendEnv = {
|
|
VITE_SUPABASE_URL = dev.supabaseUrl;
|
|
VITE_SUPABASE_ANON_KEY = dev.anonKey;
|
|
};
|
|
in
|
|
{
|
|
imports = [ services-flake.processComposeModules.default ];
|
|
|
|
services = {
|
|
postgres."db" = {
|
|
enable = true;
|
|
port = dev.pgPort;
|
|
initialDatabases = [{ name = dev.pgDB; }];
|
|
};
|
|
|
|
mosquitto."broker" = {
|
|
enable = true;
|
|
port = dev.mqttPort;
|
|
};
|
|
};
|
|
|
|
settings.processes = {
|
|
ingester = {
|
|
command = "${pkgs.go}/bin/go run ./ingester";
|
|
environment = ingesterEnv;
|
|
depends_on = {
|
|
"db".condition = "process_healthy";
|
|
"broker".condition = "process_started";
|
|
};
|
|
};
|
|
frontend = {
|
|
command = "${pkgs.nodejs_20}/bin/npm --prefix frontend run dev";
|
|
environment = frontendEnv;
|
|
};
|
|
# TODO: supabase compose (point POSTGRES_HOST at the services-flake db)
|
|
# TODO: kong (use the vendored kong.yml from nix/supabase/)
|
|
# TODO: caddy (mirror prod routes locally, no TLS)
|
|
};
|
|
}
|