From e4e0a92fe0217989808c4ababddd338aeaabfb73 Mon Sep 17 00:00:00 2001 From: Developer Date: Thu, 30 Jul 2026 17:02:27 +0700 Subject: [PATCH] feat: Nix build + CI untuk GMW (3 services) --- .gitea/workflows/deploy.yml | 117 +++++++++++--------- .gitignore | 3 + flake.lock | 61 +++++++++++ flake.nix | 209 ++++++++++++++++++++++++++++++++++++ 4 files changed, 340 insertions(+), 50 deletions(-) create mode 100644 flake.lock create mode 100644 flake.nix diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 6785b42..c720307 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -1,71 +1,88 @@ -name: Build & Deploy -run-name: "Build & Deploy ${{ github.sha }}" +name: Build & Deploy (Nix) on: push: - branches: [main] + branches: + - main jobs: - build-and-push: + build-and-deploy: runs-on: ubuntu-latest + strategy: fail-fast: false max-parallel: 1 matrix: service: [backend, discord-gateway, proxy] + steps: - - name: Setup + - name: Check out repository + run: | + git clone https://git.imrnes.team/MythEclipse/GMW.git . + git checkout ${{ github.sha }} + + - name: Install Nix & Build ${{ matrix.service }} run: | set -eu - apt-get update -qq - apt-get install -y -qq --no-install-recommends ca-certificates git docker.io docker-buildx - git config --global http.sslVerify false - docker buildx install - # Clean up runner disk before build - docker system prune -af --volumes 2>/dev/null || true - apt-get clean 2>/dev/null || true - - name: Checkout - run: | - cd /tmp - git clone --depth 1 https://MythEclipse:${{ secrets.REGISTRY_TOKEN }}@git.imrnes.team/MythEclipse/GMW.git repo - cd /tmp/repo + # Install Nix (container-safe: --init none, root-only mode) + curl -fsSL https://install.determinate.systems/nix \ + | sh -s -- install linux --no-confirm --init none 2>&1 - - name: Docker Login - run: | - echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${{ vars.REGISTRY }} -u MythEclipse --password-stdin + # Enable flakes + mkdir -p /etc/nix + echo "experimental-features = nix-command flakes" >> /etc/nix/nix.conf - - name: Build & Push ${{ matrix.service }} + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + + # Build + nix build .#${{ matrix.service }} --impure --option sandbox false 2>&1 + + echo "$(readlink result)" > /tmp/gmw-store-path-${{ matrix.service }} + + - name: Copy binary to target VPS & deploy ${{ matrix.service }} env: - DOCKER_BUILDKIT: "1" - run: | - cd /tmp/repo - IMG=${{ vars.REGISTRY }}/mytheclipse/gmw/bete-${{ matrix.service }} - docker build \ - --file infra/docker/Dockerfile.${{ matrix.service }} \ - --tag $IMG:${{ github.sha }} \ - --tag $IMG:latest \ - --build-arg VITE_BE_API_URL=https://imphnen.asepharyana.my.id \ - --build-arg VITE_BE_WS_URL=wss://imphnen.asepharyana.my.id \ - . - docker push $IMG:${{ github.sha }} - docker push $IMG:latest - - - name: Deploy (proxy only — after all pushes) - if: matrix.service == 'proxy' && github.ref == 'refs/heads/main' - env: - ENV_FILE: ${{ secrets.ENV_FILE }} - SSH_KEY: ${{ secrets.VPS_SSH_KEY }} - VPS_USER: ${{ secrets.VPS_USER }} VPS_HOST: ${{ secrets.VPS_HOST }} + VPS_USER: ${{ secrets.VPS_USER }} + VPS_SSH_KEY_VALUE: ${{ secrets.VPS_SSH_KEY_VALUE }} run: | set -eu - apt-get update -qq - apt-get install -y -qq --no-install-recommends openssh-client ca-certificates - mkdir -p ~/.ssh - echo "$SSH_KEY" > ~/.ssh/id_ed25519 - chmod 600 ~/.ssh/id_ed25519 - ENV_B64=$(echo "$ENV_FILE" | base64 -w0) - ssh -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=30 -o ServerAliveCountMax=3 \ - "$VPS_USER@$VPS_HOST" \ - "cd /opt/imphenbot/infra/docker && echo '$ENV_B64' | base64 -d > .env && docker compose pull || true && docker compose down --remove-orphans || true && docker rm -f imphenbot-discord-gateway imphenbot-backend imphenbot-proxy || true && docker compose up -d --remove-orphans && docker image prune -f" + + . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh + + SERVICE="${{ matrix.service }}" + STORE_PATH=$(cat "/tmp/gmw-store-path-$SERVICE") + echo "=== $SERVICE — Store path: $STORE_PATH" + + key_file=$(mktemp /tmp/deploy-key.XXXXXX) + printf '%s\n' "$VPS_SSH_KEY_VALUE" > "$key_file" + chmod 600 "$key_file" + + # Copy binary closure to target VPS via Nix SSH store + export NIX_SSHOPTS="-i $key_file -o StrictHostKeyChecking=no" + nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "$STORE_PATH" 2>&1 + + # Deploy: update profile + restart service + NIX_BIN="/nix/var/nix/profiles/default/bin" + PROFILE="/nix/var/nix/profiles/gmw-$SERVICE" + UNIT="gmw-$SERVICE" + + ssh -i "$key_file" -o StrictHostKeyChecking=no \ + "${VPS_USER}@${VPS_HOST}" " + # Remove stale profile dir if it exists as regular directory + if [ -d $PROFILE ] && [ ! -L $PROFILE ]; then + rm -rf $PROFILE + fi + + export PATH=\$PATH:$NIX_BIN + nix-env --profile $PROFILE --set $STORE_PATH + + if systemctl is-enabled --quiet $UNIT 2>/dev/null; then + systemctl daemon-reload + systemctl restart $UNIT + sleep 3 + systemctl status $UNIT --no-pager 2>&1 | head -12 + else + echo \"Unit $UNIT not yet created — run setup first\" + fi + " 2>&1 \ No newline at end of file diff --git a/.gitignore b/.gitignore index 5f437d5..c78d034 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,6 @@ target/ # Gitea CI runner logs .gitea/workflows/*.log + +# Nix build result symlink +result diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..617b2f3 --- /dev/null +++ b/flake.lock @@ -0,0 +1,61 @@ +{ + "nodes": { + "flake-utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1785301185, + "narHash": "sha256-eoS3KQTO0aPWXZvIaRbRAzSSHW3l5wdMFXtT1ISfoKA=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "9bc02893134c733dd85de46ee4fb2fac696b5529", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixpkgs-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "flake-utils": "flake-utils", + "nixpkgs": "nixpkgs" + } + }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..1ce7ba3 --- /dev/null +++ b/flake.nix @@ -0,0 +1,209 @@ +{ + description = "GMW — Bete Discord Moderation Bot (Nix build)"; + + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; + flake-utils.url = "github:numtide/flake-utils"; + }; + + outputs = { self, nixpkgs, flake-utils }: + flake-utils.lib.eachDefaultSystem (system: + let + pkgs = import nixpkgs { inherit system; }; + + # ---- Shared build tools ---- + nodejs = pkgs.nodejs_22; + pnpm = pkgs.pnpm.override { nodejs = nodejs; }; + + pnpmInstall = '' + export HOME=$TMPDIR/home + export npm_config_cache=$TMPDIR/npm-cache + mkdir -p $npm_config_cache + + # SSL/TLS certs (Nix sandbox doesn't have system CA bundle) + export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt + export NODE_EXTRA_CA_CERTS=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt + export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt + export NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt + + # pnpm uses node-gyp for native addons — provide build tools + export npm_config_build_from_source=true + export CPPFLAGS="-I${pkgs.lib.getDev pkgs.openssl}/include" + export LDFLAGS="-L${pkgs.lib.getLib pkgs.openssl}/lib" + + pnpm install --no-frozen-lockfile --ignore-scripts 2>&1 + + # Build native addons that need compilation + pnpm rebuild 2>&1 || true + ''; + + # ---- Backend ---- + backend = pkgs.stdenv.mkDerivation { + pname = "gmw-backend"; + version = "1.0.0"; + + src = ./services/backend; + + nativeBuildInputs = [ nodejs pnpm pkgs.python3 pkgs.gnumake pkgs.gcc pkgs.cacert ]; + + buildPhase = pnpmInstall + '' + echo "=== Compiling TypeScript ===" + npx tsc 2>&1 + ''; + + installPhase = '' + mkdir -p $out/lib/gmw-backend + cp -r dist node_modules package.json tsconfig.json $out/lib/gmw-backend/ + + mkdir -p $out/bin + cat > $out/bin/gmw-backend <&1 + ''; + + installPhase = '' + mkdir -p $out/lib/gmw-discord-gateway + cp -r dist node_modules package.json tsconfig.json $out/lib/gmw-discord-gateway/ + + # Also include drizzle migrations if they exist + cp -r drizzle $out/lib/gmw-discord-gateway/ 2>/dev/null || true + + mkdir -p $out/bin + cat > $out/bin/gmw-discord-gateway <&1 + ''; + + installPhase = '' + mkdir -p $out/share/gmw-frontend + cp -r out $out/share/gmw-frontend/out 2>/dev/null || \ + cp -r dist $out/share/gmw-frontend/dist 2>/dev/null || \ + cp -r .next $out/share/gmw-frontend/.next 2>/dev/null || true + + # Copy node_modules for standalone mode if it exists + cp -r node_modules $out/share/gmw-frontend/ 2>/dev/null || true + ''; + + meta = { + description = "GMW Frontend — Next.js static dashboard"; + platforms = pkgs.lib.platforms.linux; + }; + }; + + # ---- Proxy (nginx serving frontend) ---- + proxy = pkgs.stdenv.mkDerivation { + pname = "gmw-proxy"; + version = "1.0.0"; + + src = ./infra/docker; + + buildInputs = [ pkgs.nginx ]; + + phases = [ "installPhase" ]; + + installPhase = '' + mkdir -p $out/bin $out/etc $out/share + + # Copy nginx config + cp nginx/nginx.conf $out/etc/nginx.conf 2>/dev/null || cat > $out/etc/nginx.conf < $out/bin/gmw-proxy <