ci(deploy): push builds to attic binary cache (attic.asepharyana.my.id)

.github/workflows/deploy.yml

@@ -107,13 +107,35 @@ jobs:
           ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
           ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
 
+      # Push build result to Attic binary cache (attic.asepharyana.my.id) so
+      # the VPS can substitute it instead of a single-stream `nix copy ssh://`.
+      - name: Push to Attic cache
+        if: ${{ secrets.ATTIC_TOKEN != '' }}
+        env:
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+        run: |
+          STORE_PATH="${{ steps.build.outputs.store-path }}"
+          # Install attic client (deterministic Nix build from flake)
+          nix build github:DeterminateSystems/attic#attic --option sandbox false --no-link --print-out-paths > /tmp/attic-path
+          ATTIC_BIN=$(cat /tmp/attic-path)/bin/attic
+          "$ATTIC_BIN" login asepharyana https://attic.asepharyana.my.id "$ATTIC_TOKEN" >/dev/null 2>&1 || true
+          "$ATTIC_BIN" push asepharyana:gmw "$STORE_PATH" --jobs 4
+
       # NOTE: env files /etc/gmw/backend.env & /etc/gmw/discord-gateway.env are
       # managed MANUALLY on the VPS (source of truth). CI only builds & deploys.
       - name: Deploy ${{ matrix.service }} to VPS
         run: |
           STORE_PATH="${{ steps.build.outputs.store-path }}"
           echo "=== Copying ${{ matrix.service }}: $STORE_PATH ==="
-          nix copy --to "ssh://$VPS_USER@$VPS_HOST" "$STORE_PATH"
+          if [ -n "${{ secrets.ATTIC_TOKEN }}" ]; then
+            # Fast path: VPS substitutes from Attic cache (multi-stream) instead
+            # of single-stream `nix copy ssh://`. Falls back to ssh copy if attic
+            # substitute fails (e.g. cache miss on first deploy).
+            ssh "$VPS_USER@$VPS_HOST" "sudo /nix/var/nix/profiles/default/bin/nix-store --realise '$STORE_PATH'" \
+              || nix copy --to "ssh://$VPS_USER@$VPS_HOST" "$STORE_PATH"
+          else
+            nix copy --to "ssh://$VPS_USER@$VPS_HOST" "$STORE_PATH"
+          fi
 
           echo "=== Updating profile ==="
           ssh "$VPS_USER@$VPS_HOST" "sudo /nix/var/nix/profiles/default/bin/nix-env --profile /nix/var/nix/profiles/gmw-${{ matrix.service }} --set '$STORE_PATH'"