From 46730ec07dcc3c2a779cddd0163a933e44f4b27c Mon Sep 17 00:00:00 2001
From: Asep Haryana <asepharyana@users.noreply.github.com>
Date: Thu, 30 Jul 2026 18:46:45 +0700
Subject: [PATCH] feat(infra): Nix build for scraper, GitHub Actions workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Build scraper (Rust) with Nix — cargo build --release
- Create scraper systemd unit (port 4091), env from Docker config
- Fix HOME/CARGO_HOME for Rust/cargo in Nix sandbox
- Update Traefik apps.yaml: scraper -> host.docker.internal:4091
- Add iptables rules for port 4091 (Docker->host)
- Add GitHub Actions workflow: nix-build.yml (determinate-nix + deploy)
- Save iptables rules persistently
---
 .github/workflows/nix-build.yml | 71 +++++++++++++++++++++++++++++++++
 flake.nix                       |  3 ++
 infra/traefik/dynamic/apps.yaml |  2 +-
 3 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/nix-build.yml

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
new file mode 100644
index 0000000..a2c676e
--- /dev/null
+++ b/.github/workflows/nix-build.yml
@@ -0,0 +1,71 @@
+name: Nix Build & Deploy
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'apps/**'
+      - 'infra/**'
+      - 'flake.nix'
+      - 'flake.lock'
+      - '.github/workflows/nix-build.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: nix-deploy
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        service: [hub, scraper]
+
+    steps:
+      - name: Checkout with submodules
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v16
+        with:
+          extra-conf: |
+            sandbox = false
+            accept-flake-config = true
+
+      - name: Use Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@v8
+
+      - name: Build ${{ matrix.service }} with Nix
+        run: nix build .#${{ matrix.service }} --impure --option sandbox false
+
+      - name: Nix copy via SSH
+        env:
+          SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          VPS_HOST: ${{ secrets.VPS_HOST }}
+          VPS_USER: ${{ secrets.VPS_USER }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts
+          nix copy --to "ssh://$VPS_USER@$VPS_HOST" ./result
+
+      - name: Deploy ${{ matrix.service }} on VPS
+        env:
+          VPS_HOST: ${{ secrets.VPS_HOST }}
+          VPS_USER: ${{ secrets.VPS_USER }}
+        run: |
+          STORE_PATH=$(readlink result)
+          PROFILE_NAME="${{ matrix.service }}"
+          ssh "$VPS_USER@$VPS_HOST" "
+            sudo /nix/var/nix/profiles/default/bin/nix-env --profile /nix/var/nix/profiles/$PROFILE_NAME --set '$STORE_PATH' &&
+            sudo systemctl restart $PROFILE_NAME
+          "
diff --git a/flake.nix b/flake.nix
index f0a607f..e8a1433 100644
--- a/flake.nix
+++ b/flake.nix
@@ -31,6 +31,9 @@
             NODE_EXTRA_CA_CERTS = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
             NODE_ENV = "production";
 
+            HOME = "/tmp";
+            CARGO_HOME = "/tmp/.cargo";
+
             phases = [ "unpackPhase" "buildPhase" "installPhase" ];
             buildPhase = buildScript;
             installPhase = installScript;
diff --git a/infra/traefik/dynamic/apps.yaml b/infra/traefik/dynamic/apps.yaml
index f47d221..a3d885f 100644
--- a/infra/traefik/dynamic/apps.yaml
+++ b/infra/traefik/dynamic/apps.yaml
@@ -59,7 +59,7 @@ http:
     scraper-service:
       loadBalancer:
         servers:
-          - url: 'http://scraper-api:4091'
+          - url: 'http://host.docker.internal:4091'
 
     tools-service:
       loadBalancer: