feat: Nix build + CI untuk GMW (3 services)

.gitea/workflows/deploy.yml

@@ -1,71 +1,88 @@
-name: Build & Deploy
-run-name: "Build & Deploy ${{ github.sha }}"
+name: Build & Deploy (Nix)
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
 
 jobs:
-  build-and-push:
+  build-and-deploy:
     runs-on: ubuntu-latest
+
     strategy:
       fail-fast: false
       max-parallel: 1
       matrix:
         service: [backend, discord-gateway, proxy]
+
     steps:
-      - name: Setup
+      - name: Check out repository
+        run: |
+          git clone https://git.imrnes.team/MythEclipse/GMW.git .
+          git checkout ${{ github.sha }}
+
+      - name: Install Nix & Build ${{ matrix.service }}
         run: |
           set -eu
-          apt-get update -qq
-          apt-get install -y -qq --no-install-recommends ca-certificates git docker.io docker-buildx
-          git config --global http.sslVerify false
-          docker buildx install
-          # Clean up runner disk before build
-          docker system prune -af --volumes 2>/dev/null || true
-          apt-get clean 2>/dev/null || true
 
-      - name: Checkout
-        run: |
-          cd /tmp
-          git clone --depth 1 https://MythEclipse:${{ secrets.REGISTRY_TOKEN }}@git.imrnes.team/MythEclipse/GMW.git repo
-          cd /tmp/repo
+          # Install Nix (container-safe: --init none, root-only mode)
+          curl -fsSL https://install.determinate.systems/nix \
+            | sh -s -- install linux --no-confirm --init none 2>&1
 
-      - name: Docker Login
-        run: |
-          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${{ vars.REGISTRY }} -u MythEclipse --password-stdin
+          # Enable flakes
+          mkdir -p /etc/nix
+          echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf
 
-      - name: Build & Push ${{ matrix.service }}
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+
+          # Build
+          nix build .#${{ matrix.service }} --impure --option sandbox false 2>&1
+
+          echo "$(readlink result)" > /tmp/gmw-store-path-${{ matrix.service }}
+
+      - name: Copy binary to target VPS & deploy ${{ matrix.service }}
         env:
-          DOCKER_BUILDKIT: "1"
-        run: |
-          cd /tmp/repo
-          IMG=${{ vars.REGISTRY }}/mytheclipse/gmw/bete-${{ matrix.service }}
-          docker build \
-            --file infra/docker/Dockerfile.${{ matrix.service }} \
-            --tag $IMG:${{ github.sha }} \
-            --tag $IMG:latest \
-            --build-arg VITE_BE_API_URL=https://imphnen.asepharyana.my.id \
-            --build-arg VITE_BE_WS_URL=wss://imphnen.asepharyana.my.id \
-            .
-          docker push $IMG:${{ github.sha }}
-          docker push $IMG:latest
-
-      - name: Deploy (proxy only — after all pushes)
-        if: matrix.service == 'proxy' && github.ref == 'refs/heads/main'
-        env:
-          ENV_FILE: ${{ secrets.ENV_FILE }}
-          SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
-          VPS_USER: ${{ secrets.VPS_USER }}
           VPS_HOST: ${{ secrets.VPS_HOST }}
+          VPS_USER: ${{ secrets.VPS_USER }}
+          VPS_SSH_KEY_VALUE: ${{ secrets.VPS_SSH_KEY_VALUE }}
         run: |
           set -eu
-          apt-get update -qq
-          apt-get install -y -qq --no-install-recommends openssh-client ca-certificates
-          mkdir -p ~/.ssh
-          echo "$SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ENV_B64=$(echo "$ENV_FILE" | base64 -w0)
-          ssh -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=30 -o ServerAliveCountMax=3 \
-            "$VPS_USER@$VPS_HOST" \
-            "cd /opt/imphenbot/infra/docker && echo '$ENV_B64' | base64 -d > .env && docker compose pull || true && docker compose down --remove-orphans || true && docker rm -f imphenbot-discord-gateway imphenbot-backend imphenbot-proxy || true && docker compose up -d --remove-orphans && docker image prune -f"
+
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+
+          SERVICE="${{ matrix.service }}"
+          STORE_PATH=$(cat "/tmp/gmw-store-path-$SERVICE")
+          echo "=== $SERVICE — Store path: $STORE_PATH"
+
+          key_file=$(mktemp /tmp/deploy-key.XXXXXX)
+          printf '%s\n' "$VPS_SSH_KEY_VALUE" > "$key_file"
+          chmod 600 "$key_file"
+
+          # Copy binary closure to target VPS via Nix SSH store
+          export NIX_SSHOPTS="-i $key_file -o StrictHostKeyChecking=no"
+          nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "$STORE_PATH" 2>&1
+
+          # Deploy: update profile + restart service
+          NIX_BIN="/nix/var/nix/profiles/default/bin"
+          PROFILE="/nix/var/nix/profiles/gmw-$SERVICE"
+          UNIT="gmw-$SERVICE"
+
+          ssh -i "$key_file" -o StrictHostKeyChecking=no \
+            "${VPS_USER}@${VPS_HOST}" "
+            # Remove stale profile dir if it exists as regular directory
+            if [ -d $PROFILE ] && [ ! -L $PROFILE ]; then
+              rm -rf $PROFILE
+            fi
+
+            export PATH=\$PATH:$NIX_BIN
+            nix-env --profile $PROFILE --set $STORE_PATH
+
+            if systemctl is-enabled --quiet $UNIT 2>/dev/null; then
+              systemctl daemon-reload
+              systemctl restart $UNIT
+              sleep 3
+              systemctl status $UNIT --no-pager 2>&1 | head -12
+            else
+              echo \"Unit $UNIT not yet created — run setup first\"
+            fi
+          " 2>&1

.gitignore

@@ -15,3 +15,6 @@ target/
 
 # Gitea CI runner logs
 .gitea/workflows/*.log
+
+# Nix build result symlink
+result

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1785301185,
+        "narHash": "sha256-eoS3KQTO0aPWXZvIaRbRAzSSHW3l5wdMFXtT1ISfoKA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9bc02893134c733dd85de46ee4fb2fac696b5529",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,209 @@
+{
+  description = "GMW — Bete Discord Moderation Bot (Nix build)";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+
+        # ---- Shared build tools ----
+        nodejs = pkgs.nodejs_22;
+        pnpm = pkgs.pnpm.override { nodejs = nodejs; };
+
+        pnpmInstall = ''
+          export HOME=$TMPDIR/home
+          export npm_config_cache=$TMPDIR/npm-cache
+          mkdir -p $npm_config_cache
+
+          # SSL/TLS certs (Nix sandbox doesn't have system CA bundle)
+          export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+          export NODE_EXTRA_CA_CERTS=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+          export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+          export NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+
+          # pnpm uses node-gyp for native addons — provide build tools
+          export npm_config_build_from_source=true
+          export CPPFLAGS="-I${pkgs.lib.getDev pkgs.openssl}/include"
+          export LDFLAGS="-L${pkgs.lib.getLib pkgs.openssl}/lib"
+
+          pnpm install --no-frozen-lockfile --ignore-scripts 2>&1
+
+          # Build native addons that need compilation
+          pnpm rebuild 2>&1 || true
+        '';
+
+        # ---- Backend ----
+        backend = pkgs.stdenv.mkDerivation {
+          pname = "gmw-backend";
+          version = "1.0.0";
+
+          src = ./services/backend;
+
+          nativeBuildInputs = [ nodejs pnpm pkgs.python3 pkgs.gnumake pkgs.gcc pkgs.cacert ];
+
+          buildPhase = pnpmInstall + ''
+            echo "=== Compiling TypeScript ==="
+            npx tsc 2>&1
+          '';
+
+          installPhase = ''
+            mkdir -p $out/lib/gmw-backend
+            cp -r dist node_modules package.json tsconfig.json $out/lib/gmw-backend/
+
+            mkdir -p $out/bin
+            cat > $out/bin/gmw-backend <<WRAPPER
+            #!${pkgs.runtimeShell}
+            exec ${nodejs}/bin/node $out/lib/gmw-backend/dist/index.js "\$@"
+            WRAPPER
+            chmod +x $out/bin/gmw-backend
+          '';
+
+          meta = {
+            description = "GMW Backend — Express HTTP/WS server";
+            platforms = pkgs.lib.platforms.linux;
+          };
+        };
+
+        # ---- Discord Gateway ----
+        discord-gateway = pkgs.stdenv.mkDerivation {
+          pname = "gmw-discord-gateway";
+          version = "1.0.0";
+
+          src = ./services/discord-gateway;
+
+          nativeBuildInputs = [
+            nodejs pnpm
+            pkgs.python3 pkgs.gnumake pkgs.gcc
+            pkgs.rustc pkgs.cargo
+            pkgs.pkg-config
+            pkgs.openssl
+            pkgs.cacert
+          ];
+
+          buildPhase = pnpmInstall + ''
+            echo "=== Compiling TypeScript ==="
+            npx tsc 2>&1
+          '';
+
+          installPhase = ''
+            mkdir -p $out/lib/gmw-discord-gateway
+            cp -r dist node_modules package.json tsconfig.json $out/lib/gmw-discord-gateway/
+
+            # Also include drizzle migrations if they exist
+            cp -r drizzle $out/lib/gmw-discord-gateway/ 2>/dev/null || true
+
+            mkdir -p $out/bin
+            cat > $out/bin/gmw-discord-gateway <<WRAPPER
+            #!${pkgs.runtimeShell}
+            exec ${nodejs}/bin/node $out/lib/gmw-discord-gateway/dist/index.js "\$@"
+            WRAPPER
+            chmod +x $out/bin/gmw-discord-gateway
+          '';
+
+          meta = {
+            description = "GMW Discord Gateway — message capture, voice, AI moderation";
+            platforms = pkgs.lib.platforms.linux;
+          };
+        };
+
+        # ---- Frontend (Next.js static export) ----
+        frontend = pkgs.stdenv.mkDerivation {
+          pname = "gmw-frontend";
+          version = "1.0.0";
+
+          src = ./services/frontend;
+
+          nativeBuildInputs = [ nodejs pnpm pkgs.gnumake pkgs.gcc pkgs.cacert ];
+
+          buildPhase = pnpmInstall + ''
+            echo "=== Building Next.js static export ==="
+            # Build args are provided as env vars
+            export NEXT_TELEMETRY_DISABLED=1
+            npx next build 2>&1
+          '';
+
+          installPhase = ''
+            mkdir -p $out/share/gmw-frontend
+            cp -r out $out/share/gmw-frontend/out 2>/dev/null || \
+            cp -r dist $out/share/gmw-frontend/dist 2>/dev/null || \
+            cp -r .next $out/share/gmw-frontend/.next 2>/dev/null || true
+
+            # Copy node_modules for standalone mode if it exists
+            cp -r node_modules $out/share/gmw-frontend/ 2>/dev/null || true
+          '';
+
+          meta = {
+            description = "GMW Frontend — Next.js static dashboard";
+            platforms = pkgs.lib.platforms.linux;
+          };
+        };
+
+        # ---- Proxy (nginx serving frontend) ----
+        proxy = pkgs.stdenv.mkDerivation {
+          pname = "gmw-proxy";
+          version = "1.0.0";
+
+          src = ./infra/docker;
+
+          buildInputs = [ pkgs.nginx ];
+
+          phases = [ "installPhase" ];
+
+          installPhase = ''
+            mkdir -p $out/bin $out/etc $out/share
+
+            # Copy nginx config
+            cp nginx/nginx.conf $out/etc/nginx.conf 2>/dev/null || cat > $out/etc/nginx.conf <<NGINX_CONF
+            events {}
+            http {
+              include ${pkgs.nginx}/conf/mime.types;
+              server {
+                listen 80;
+                server_name _;
+                root ${frontend}/share/gmw-frontend/out;
+                index index.html;
+                location / {
+                  try_files \$uri \$uri/ /index.html;
+                }
+              }
+            }
+NGINX_CONF
+
+            mkdir -p $out/bin
+            cat > $out/bin/gmw-proxy <<WRAPPER
+            #!${pkgs.runtimeShell}
+            exec ${pkgs.nginx}/bin/nginx -c $out/etc/nginx.conf -p /var/lib/gmw-proxy -g "daemon off;" "\$@"
+WRAPPER
+            chmod +x $out/bin/gmw-proxy
+          '';
+
+          meta = {
+            description = "GMW Proxy — nginx serving frontend";
+            platforms = pkgs.lib.platforms.linux;
+          };
+        };
+
+      in {
+        packages = {
+          inherit backend discord-gateway frontend proxy;
+          default = proxy;
+        };
+
+        devShells.default = pkgs.mkShell {
+          buildInputs = [
+            nodejs pnpm
+            pkgs.python3 pkgs.gnumake pkgs.gcc
+            pkgs.rustc pkgs.cargo
+            pkgs.ffmpeg-headless
+          ];
+          shellHook = ''
+            echo "GMW dev shell ready — node $(node --version), pnpm $(pnpm --version)"
+          '';
+        };
+      });
+}