Klaus
2d57db8182
check / flake-check (pull_request) Has been cancelled
Lays out the agreed shape from the design discussion: one flake at the root with three nixosConfigurations (mqtt-ingest, db-host, app-host), vendored Supabase docker-compose pointed at the external db-host, Caddy → Kong → PostgREST/GoTrue, a Go MQTT→Postgres ingester stub, deploy-rs node map, and a Gitea Actions workflow that deploys in db → app → ingest order on push to main. No real implementation yet — every host module has TODOs marking the gaps (real hardware config, actual hostnames, HiveMQ packaging, vendor the full upstream Supabase compose, etc.).
41 lines
1.5 KiB
Markdown
41 lines
1.5 KiB
Markdown
# Supabase compose stack
|
|
|
|
Vendored from the official Supabase self-hosting bundle, with two deliberate
|
|
changes:
|
|
|
|
1. The bundled `db` service is removed. Every service that talks to Postgres
|
|
reads `POSTGRES_HOST` / `POSTGRES_PORT` from the environment and connects to
|
|
the external `db-host`. The systemd unit (`nix/modules/gebos-supabase.nix`)
|
|
injects these from `/etc/gebos/secrets.env`.
|
|
|
|
2. Studio is bound to `127.0.0.1` only. There is **no public route** to it.
|
|
To use it from your laptop:
|
|
|
|
```
|
|
ssh -L 3000:127.0.0.1:3000 app-host
|
|
open http://localhost:3000
|
|
```
|
|
|
|
This is intentional — Studio runs with the `service_role` JWT and bypasses
|
|
RLS. Putting it on the public internet behind only HTTP basic auth (the
|
|
default) is too thin.
|
|
|
|
## What's in here
|
|
|
|
- `docker-compose.yml` — the stack itself
|
|
- `init.sql` — schemas, roles, and extensions Postgres needs before the
|
|
compose services come up. Loaded by `nix/modules/gebos-postgres.nix`.
|
|
- `kong.yml` — Kong's declarative routing (to be vendored alongside the compose
|
|
file when we copy it in).
|
|
|
|
## Updating the vendored compose
|
|
|
|
When upstream Supabase ships a new compose layout, re-vendor by:
|
|
|
|
1. Copy upstream `docker/docker-compose.yml` over `docker-compose.yml`.
|
|
2. Remove the `db:` service block.
|
|
3. Replace every `db:5432` / `postgres:5432` reference with
|
|
`${POSTGRES_HOST}:${POSTGRES_PORT}`.
|
|
4. Bind Studio to `${STUDIO_BIND}:3000` instead of `0.0.0.0:3000`.
|
|
5. Commit, deploy, smoke-test through the SSH tunnel.
|