ci: migrate deploy to Nix (flake + systemd via GitHub Actions)

.github/workflows/deploy.yml

@@ -1,113 +1,65 @@
-name: Deploy
+name: Build & Deploy (Nix)
 
 on:
   push:
-    branches:
+    branches: [main]
-      - main
   workflow_dispatch:
 
-permissions:
-  contents: read
-  packages: write
-
-concurrency:
-  group: deploy-production
-  cancel-in-progress: true
-
-env:
-  IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/booster-role
-
 jobs:
-  deploy:
+  build-and-deploy:
     runs-on: ubuntu-latest
     environment: orangevps
 
     steps:
-      - name: Checkout
+      - uses: actions/checkout@v4
-        uses: actions/checkout@v4
 
-      - name: Set up Bun
+      - uses: DeterminateSystems/nix-installer-action@v16
-        uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          determinate: false
+          extra-conf: |
+            sandbox = false
+            accept-flake-config = true
 
-      - name: Install dependencies
+      - uses: DeterminateSystems/magic-nix-cache-action@v8
-        run: bun install
-
-      - name: Type check
-        run: bun run typecheck
-
-      - name: Run tests
-        run: bun test
-
-      - name: Lint
-        run: bun run lint
-
-      - name: Set lowercase image name
-        run: echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV"
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
         with:
-          registry: ghcr.io
+          use-flakehub: false
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push image
+      - name: Build & Deploy
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          tags: |
-            ${{ env.IMAGE_NAME }}:latest
-            ${{ env.IMAGE_NAME }}:${{ github.sha }}
-
-      - name: Deploy on VPS
-        uses: appleboy/ssh-action@v1.2.0
         env:
-          IMAGE_NAME: ${{ env.IMAGE_NAME }}
+          VPS_HOST: ${{ secrets.VPS_HOST }}
-          GHCR_USERNAME: ${{ github.actor }}
+          VPS_USER: ${{ secrets.VPS_USER }}
-          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
-          DISCORD_TOKEN: ${{ secrets.DISCORD_TOKEN }}
+        run: |
-          DISCORD_CLIENT_ID: ${{ secrets.DISCORD_CLIENT_ID }}
-          DISCORD_GUILD_ID: ${{ secrets.DISCORD_GUILD_ID }}
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          BOOSTER_ROLE_ANCHOR_ROLE_ID: ${{ secrets.BOOSTER_ROLE_ANCHOR_ROLE_ID }}
-          BOOSTER_ELIGIBILITY_ROLE_ID: ${{ secrets.BOOSTER_ELIGIBILITY_ROLE_ID }}
-          BOOSTER_GREETING_CHANNEL_ID: ${{ secrets.BOOSTER_GREETING_CHANNEL_ID }}
-          LOG_LEVEL: ${{ secrets.LOG_LEVEL }}
-        with:
-          host: ${{ secrets.VPS_HOST }}
-          username: ${{ secrets.VPS_USER }}
-          key: ${{ secrets.VPS_SSH_KEY }}
-          envs: IMAGE_NAME,GHCR_USERNAME,GHCR_TOKEN,DISCORD_TOKEN,DISCORD_CLIENT_ID,DISCORD_GUILD_ID,DATABASE_URL,BOOSTER_ROLE_ANCHOR_ROLE_ID,BOOSTER_ELIGIBILITY_ROLE_ID,BOOSTER_GREETING_CHANNEL_ID,LOG_LEVEL
-          script: |
           set -eu
-            mkdir -p /opt/booster-role
+          STORE_PATH=$(nix build . --impure --option sandbox false --no-link --print-out-paths | tail -1)
-            cd /opt/booster-role
+          echo "Store path: $STORE_PATH"
 
-            cat > .env <<EOF
+          key_file=$(mktemp /tmp/deploy-key.XXXXXX)
-            DISCORD_TOKEN=${DISCORD_TOKEN}
+          printf '%s\n' "$VPS_SSH_KEY" > "$key_file"
-            DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID}
+          chmod 600 "$key_file"
-            DISCORD_GUILD_ID=${DISCORD_GUILD_ID}
+          sed -i 's/\r$//' "$key_file"
-            DATABASE_URL=${DATABASE_URL:?DATABASE_URL is required}
+          ssh-keygen -y -f "$key_file" >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
-            BOOSTER_ROLE_ANCHOR_ROLE_ID=${BOOSTER_ROLE_ANCHOR_ROLE_ID}
-            BOOSTER_ELIGIBILITY_ROLE_ID=${BOOSTER_ELIGIBILITY_ROLE_ID:-1206431347925852162}
-            BOOSTER_GREETING_CHANNEL_ID=${BOOSTER_GREETING_CHANNEL_ID}
-            LOG_LEVEL=${LOG_LEVEL:-info}
-            EOF
 
-            cat > docker-compose.yml <<EOF
+          export NIX_SSHOPTS="-i $key_file -o StrictHostKeyChecking=no"
-            services:
+          nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "$STORE_PATH" 2>&1
-              booster-role:
-                image: ${IMAGE_NAME}:latest
-                container_name: booster-role
-                restart: unless-stopped
-                env_file:
-                  - .env
-            EOF
 
-            echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin
+          ssh -i "$key_file" -o StrictHostKeyChecking=no "${VPS_USER}@${VPS_HOST}" "
-            docker compose pull
+            set -eu
-            docker compose up -d
+            if [ -d /nix/var/nix/profiles/booster-role ] && [ ! -L /nix/var/nix/profiles/booster-role ]; then
-            docker image prune -f
+              rm -rf /nix/var/nix/profiles/booster-role
+            fi
+            nix-env --profile /nix/var/nix/profiles/booster-role --set $STORE_PATH
+            systemctl daemon-reload
+            systemctl enable booster-role 2>/dev/null || true
+            systemctl restart booster-role
+            for i in \$(seq 1 30); do
+              systemctl is-active --quiet booster-role && break
+              sleep 1
+            done
+            systemctl is-active booster-role || {
+              echo \"=== SERVICE FAILED — journal ===\"
+              journalctl -u booster-role -n 40 --no-pager
+              exit 1
+            }
+            systemctl status booster-role --no-pager 2>&1 | head -8
+          " 2>&1

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1785301185,
+        "narHash": "sha256-eoS3KQTO0aPWXZvIaRbRAzSSHW3l5wdMFXtT1ISfoKA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9bc02893134c733dd85de46ee4fb2fac696b5529",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,49 @@
+{
+  description = "Booster Role Discord Bot (Nix build)";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+      in
+      {
+        packages.default = pkgs.stdenvNoCC.mkDerivation {
+          pname = "booster-role";
+          version = "0.1.0";
+          src = ./.;
+
+          nativeBuildInputs = [ pkgs.bun ];
+
+          buildPhase = ''
+            export HOME="$TMPDIR"
+            bun install --frozen-lockfile
+            bun run typecheck
+            bun test
+          '';
+
+          installPhase = ''
+            mkdir -p $out/bin $out/lib/booster-role
+            cp -r package.json bun.lock tsconfig.json drizzle.config.ts $out/lib/booster-role/
+            cp -r src $out/lib/booster-role/src
+            cp -r node_modules $out/lib/booster-role/node_modules
+            cat > $out/bin/booster-role << WRAPPER
+#!${pkgs.runtimeShell}
+cd $out/lib/booster-role
+export NODE_ENV=production
+${pkgs.bun}/bin/bun run db:migrate
+exec ${pkgs.bun}/bin/bun run src/index.ts
+WRAPPER
+            chmod +x $out/bin/booster-role
+          '';
+        };
+
+        devShells.default = pkgs.mkShell {
+          buildInputs = [ pkgs.bun ];
+        };
+      });
+}