ci: fix Nix GC cleanup job SSH key secret for Booster-role

.env.example

@@ -1,7 +1,7 @@
 DISCORD_TOKEN=
 DISCORD_CLIENT_ID=
 DISCORD_GUILD_ID=
-DATABASE_URL=postgresql://booster_role:booster_role@localhost:5432/booster_role
+DATABASE_URL=postgresql://asephs:***@100.121.180.82:6432/boost
 BOOSTER_ROLE_ANCHOR_ROLE_ID=
 BOOSTER_ELIGIBILITY_ROLE_ID=1206431347925852162
 BOOSTER_GREETING_CHANNEL_ID=

.github/workflows/deploy.yml

@@ -5,8 +5,35 @@ on:
     branches: [main]
   workflow_dispatch:
 
+concurrency:
+  group: booster-role-deploy
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install deps
+        run: bun install --frozen-lockfile
+
+      - name: Typecheck
+        run: bun run typecheck
+
+      - name: Test
+        run: bun test
+
   build-and-deploy:
+    needs: test
     runs-on: ubuntu-latest
     environment: orangevps
 
@@ -20,7 +47,7 @@ jobs:
             sandbox = false
             accept-flake-config = true
 
-      - uses: DeterminateSystems/magic-nix-cache-action@v8
+      - uses: DeterminateSystems/magic-nix-cache-action@v14
         with:
           use-flakehub: false
 
@@ -63,3 +90,23 @@ jobs:
             }
             systemctl status booster-role --no-pager 2>&1 | head -8
           " 2>&1
+
+  cleanup:
+    # Bersihkan sampah Nix di VPS SETELAH deploy: hapus generasi profile lama
+    # + nix store gc. Profil yang sedang dipakai tidak disentuh.
+    needs: build-and-deploy
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Nix GC on VPS
+        env:
+          VPS_HOST: ${{ secrets.VPS_HOST }}
+          VPS_USER: ${{ secrets.VPS_USER }}
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+        run: |
+          key_file=$(mktemp /tmp/gc-key.XXXXXX)
+          printf '%s\n' "$VPS_SSH_KEY" > "$key_file"
+          chmod 600 "$key_file"
+          sed -i 's/\r$//' "$key_file"
+          ssh -i "$key_file" -o StrictHostKeyChecking=no "${VPS_USER}@${VPS_HOST}" "sudo /usr/local/bin/nix-gc-vps.sh" || echo "⚠️ Nix GC gagal (non-fatal)"
+          rm -f "$key_file"

.github/workflows/flakehub-publish-rolling.yaml

@@ -0,0 +1,20 @@
+name: Publish to FlakeHub
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+jobs:
+  flakehub-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: DeterminateSystems/determinate-nix-action@main
+      - uses: DeterminateSystems/flakehub-push@main
+        with:
+          visibility: public
+          rolling: true

README.md

@@ -30,7 +30,7 @@ Isi `.env`:
 DISCORD_TOKEN=token_bot_discord
 DISCORD_CLIENT_ID=client_id_aplikasi_discord
 DISCORD_GUILD_ID=id_server_discord
-DATABASE_URL=postgresql://booster_role:booster_role@localhost:5432/booster_role
+DATABASE_URL=postgresql://asephs:***@100.121.180.82:6432/boost
 BOOSTER_ROLE_ANCHOR_ROLE_ID=id_role_pembatas_opsional
 BOOSTER_ELIGIBILITY_ROLE_ID=1206431347925852162
 LOG_LEVEL=info
@@ -47,7 +47,7 @@ bun run db:generate
 bun run db:migrate
 ```
 
-Pastikan `DATABASE_URL` mengarah ke database PostgreSQL external sebelum menjalankan migration.
+Pastikan `DATABASE_URL` mengarah ke database PostgreSQL external (pool PgBouncer imrnes `100.121.180.82:6432`) sebelum menjalankan migration.
 
 ## Menjalankan bot
 

drizzle.config.ts

@@ -5,6 +5,6 @@ export default defineConfig({
   out: "./src/db/migrations",
   dialect: "postgresql",
   dbCredentials: {
-    url: process.env.DATABASE_URL ?? "postgresql://booster_role:booster_role@localhost:5432/booster_role"
+    url: process.env.DATABASE_URL ?? "postgresql://asephs:***@100.121.180.82:6432/boost"
   }
 });

flake.nix

@@ -7,7 +7,7 @@
   };
 
   outputs = { self, nixpkgs, flake-utils }:
-    flake-utils.lib.eachDefaultSystem (system:
+    flake-utils.lib.eachSystem [ "x86_64-linux" ] (system:
       let
         pkgs = import nixpkgs { inherit system; };
       in

src/config/index.ts

@@ -14,7 +14,7 @@ export function loadConfig(env: Record<string, string | undefined> = process.env
     discordToken: requireEnv(env, "DISCORD_TOKEN"),
     discordClientId: requireEnv(env, "DISCORD_CLIENT_ID"),
     discordGuildId: requireEnv(env, "DISCORD_GUILD_ID"),
-    databaseUrl: env.DATABASE_URL ?? "postgresql://booster_role:booster_role@localhost:5432/booster_role",
+    databaseUrl: env.DATABASE_URL ?? "postgresql://asephs:***@100.121.180.82:6432/boost",
     boosterRoleAnchorRoleId: env.BOOSTER_ROLE_ANCHOR_ROLE_ID ?? null,
     boosterEligibilityRoleId: env.BOOSTER_ELIGIBILITY_ROLE_ID ?? "1206431347925852162",
     boostCleanupIntervalMs: Number(env.BOOST_CLEANUP_INTERVAL_MS) || 5 * 60 * 1000,