feat(infra): add hub service — Docker, Traefik, CI/CD

- Add infra/docker/hub.Dockerfile (Next.js multi-stage build)
- Add infra/compose/hub.yml with app-shared-net
- Add Traefik route for hub.asepharyana.{my,web}.id → hub:3000
- Update docker-build-push.yml: path detection, matrix build, dispatch, manifest
- Update deploy-docker.yml: include hub.yml in ALL_COMPOSE_FILES
- Update update-submodule.yml: allow hub service
- Update docs/ARCHITECTURE.md

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/deploy-docker.yml

@@ -89,7 +89,7 @@ jobs:
             git fetch origin main --depth=1 || true
             
             # Detect changed files before resetting
-            ALL_COMPOSE_FILES="infra/compose/traefik.yml infra/compose/shared.yml infra/compose/scraper.yml infra/compose/nats.yml infra/compose/dapr.yml infra/compose/observability.yml"
+            ALL_COMPOSE_FILES="infra/compose/traefik.yml infra/compose/shared.yml infra/compose/scraper.yml infra/compose/hub.yml infra/compose/nats.yml infra/compose/dapr.yml infra/compose/observability.yml"
             TRAEFIK_DYNAMIC_DIR="infra/traefik/dynamic"
             
             if git rev-parse HEAD >/dev/null 2>&1; then

.github/workflows/docker-build-push.yml

@@ -6,6 +6,7 @@ on:
       - main
     paths:
       - 'apps/scraper/**'
+      - 'apps/hub/**'
       - '.github/workflows/docker-build-push.yml'
       - 'infra/**'
       - '!infra/compose/**'
@@ -34,6 +35,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
       scraper-api: ${{ steps.filter.outputs['scraper-api'] == 'true' || steps.dispatch.outputs['scraper-api'] == 'true' || github.event_name == 'workflow_dispatch' }}
+      hub: ${{ steps.filter.outputs['hub'] == 'true' || steps.dispatch.outputs['hub'] == 'true' || github.event_name == 'workflow_dispatch' }}
       dashboard: ${{ steps.filter.outputs['dashboard'] == 'true' || steps.dispatch.outputs['dashboard'] == 'true' || github.event_name == 'workflow_dispatch' }}
     steps:
       - uses: actions/checkout@v6
@@ -61,6 +63,7 @@ jobs:
           }
 
           echo "scraper-api=$(changed '^(apps/scraper(/|$)|\.github/workflows/docker-build-push\.yml$|infra/docker/scraper\.Dockerfile$)')" >> "$GITHUB_OUTPUT"
+          echo "hub=$(changed '^(apps/hub(/|$)|\.github/workflows/docker-build-push\.yml$|infra/docker/hub\.Dockerfile$)')" >> "$GITHUB_OUTPUT"
           echo "dashboard=$(changed '^(infra/dashboard(/|$)|\.github/workflows/docker-build-push\.yml$|infra/docker/dashboard\.Dockerfile$)')" >> "$GITHUB_OUTPUT"
 
       - name: Parse repository_dispatch payload
@@ -83,7 +86,7 @@ jobs:
           fi
 
           case "$SERVICE" in
-            scraper-api|dashboard) ;;
+            scraper-api|hub|dashboard) ;;
             *)
               exit 1
               ;;
@@ -91,7 +94,7 @@ jobs:
 
           if ! [[ "$SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then echo "::error::Invalid sha '$SHA'. Expected 40 hex characters"; fi
 
-          SERVICES=(scraper-api dashboard)
+          SERVICES=(scraper-api hub dashboard)
           for svc in "${SERVICES[@]}"; do
             if [ "$SERVICE" = "$svc" ]; then
               echo "${svc}=true" >> "$GITHUB_OUTPUT"
@@ -109,6 +112,7 @@ jobs:
           }
 
           if [ "${{ steps.filter.outputs['scraper-api'] == 'true' || steps.dispatch.outputs['scraper-api'] == 'true' || github.event_name == 'workflow_dispatch' }}" == "true" ]; then add_service "scraper-api" "docker-scraper" "apps/scraper"; fi
+          if [ "${{ steps.filter.outputs['hub'] == 'true' || steps.dispatch.outputs['hub'] == 'true' || github.event_name == 'workflow_dispatch' }}" == "true" ]; then add_service "hub" "docker-hub" "apps/hub"; fi
           if [ "${{ steps.filter.outputs['dashboard'] == 'true' || steps.dispatch.outputs['dashboard'] == 'true' || github.event_name == 'workflow_dispatch' }}" == "true" ]; then add_service "dashboard" "docker-dashboard" "infra/dashboard"; fi
 
           JSON_ARRAY="[$(IFS=,; echo "${SERVICES[*]}")]"
@@ -129,6 +133,7 @@ jobs:
 
           case "$SERVICE" in
             "scraper-api") REPO="https://github.com/asepharyana/asepharyana-hub-scraper.git" ;;
+            "hub") REPO="https://github.com/asepharyana/asepharyana-hub-hub.git" ;;
             *)
               echo "::error::Unsupported service '$SERVICE'"
               exit 1
@@ -210,6 +215,7 @@ jobs:
           echo "cache-registry=${REGISTRY}/${IMAGE_NAME_PREFIX}/${SVC_NAME}:buildcache" >> $GITHUB_OUTPUT
           case "$SVC_NAME" in
             "scraper-api")    echo "dockerfile=infra/docker/scraper.Dockerfile" >> $GITHUB_OUTPUT ;;
+            "hub")            echo "dockerfile=infra/docker/hub.Dockerfile" >> $GITHUB_OUTPUT ;;
             "dashboard")      echo "dockerfile=infra/docker/dashboard.Dockerfile" >> $GITHUB_OUTPUT ;;
           esac
 
@@ -255,10 +261,12 @@ jobs:
 
           declare -A SERVICES
           SERVICES["scraper-api"]="scraper.yml"
+          SERVICES["hub"]="hub.yml"
           SERVICES["dashboard"]="observability.yml"
 
           declare -A PATHS
           PATHS["scraper-api"]="apps/scraper"
+          PATHS["hub"]="apps/hub"
           PATHS["dashboard"]="infra/dashboard"
 
           # Use git config for possible commits
@@ -268,6 +276,7 @@ jobs:
           for id in "${!SERVICES[@]}"; do
             SHOULD_HAVE_RUN=false
             if [ "${{ needs.changes.outputs['scraper-api'] }}" == "true" ] && [ "$id" == "scraper-api" ]; then SHOULD_HAVE_RUN=true; fi
+            if [ "${{ needs.changes.outputs['hub'] }}" == "true" ] && [ "$id" == "hub" ]; then SHOULD_HAVE_RUN=true; fi
             if [ "${{ needs.changes.outputs['dashboard'] }}" == "true" ] && [ "$id" == "dashboard" ]; then SHOULD_HAVE_RUN=true; fi
 
             if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then SHOULD_HAVE_RUN=true; fi

.github/workflows/update-submodule.yml

@@ -36,7 +36,7 @@ jobs:
           fi
 
           case "$SERVICE" in
-            scraper-api) ;;
+            scraper-api|hub) ;;
             *)
               echo "::error::Unsupported service '$SERVICE'"
               exit 1

docs/ARCHITECTURE.md

@@ -16,7 +16,7 @@ Dua node terhubung via **Tailscale** overlay network:
 │  ├─ Dapr Placement           │       └──────────────────────────────┘
 │  ├─ Redis (cache, Dapr)      │
 │  ├─ Scraper API + Dapr       │
-│  └─ (future services)        │
+│  └─ Hub (Next.js SPA)       │
 └──────────────────────────────┘
 ```
 
@@ -36,7 +36,8 @@ Traefik (v3.6)
    ├─ Plugin: real-ip (Cloudflare), block-sensitive-paths
    │
    ▼ Router matching
-Host(`scraper.asepharyana.my.id`) || Host(`api.asepharyana.my.id`)
+Host(`scraper.asepharyana.my.id`) || Host(`api.asepharyana.my.id') → scraper-api
+Host(`hub.asepharyana.my.id`) → hub
    │
    ▼ Service load balancer
 http://scraper-api:4091
@@ -63,6 +64,7 @@ Semua service berjalan dalam satu Docker Compose project bernama `compose` dan b
 | `nats.yml` | `nats` | Message broker + JetStream persistent streaming |
 | `dapr.yml` | `dapr-placement` | Koordinasi actor placement untuk sidecar Dapr |
 | `scraper.yml` | `scraper-api` + `scraper-api-dapr` | Aplikasi Rust + sidecar Dapr |
+| `hub.yml` | `hub` | Next.js SPA portfolio |
 
 ### Dapr Sidecar Pattern
 

infra/compose/hub.yml

@@ -0,0 +1,16 @@
+services:
+  hub:
+    container_name: hub
+    image: ghcr.io/asepharyana/asepharyana-hub/hub:sha-TODO
+    restart: always
+    networks:
+      app-shared-net:
+        aliases:
+          - hub
+    env_file:
+      - ../../.env
+
+networks:
+  app-shared-net:
+    name: app-shared-net
+    external: true

infra/docker/hub.Dockerfile

@@ -0,0 +1,20 @@
+# ── Build stage ──
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY apps/hub/package.json apps/hub/bun.lock ./
+RUN npm install --frozen-lockfile
+COPY apps/hub .
+RUN npm run build
+
+# ── Runtime ──
+FROM node:22-alpine AS runtime
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+WORKDIR /app
+COPY --from=builder /app/.next ./.next
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/public ./public
+COPY --from=builder /app/package.json ./
+USER appuser
+EXPOSE 3000
+ENV PORT=3000 NODE_ENV=production
+CMD ["npm", "run", "start"]

infra/traefik/dynamic/apps.yaml

@@ -1,5 +1,15 @@
 http:
   routers:
+    # ── Hub (Portfolio SPA) ──
+    hub:
+      rule: 'Host(`hub.asepharyana.my.id`) || Host(`hub.asepharyana.web.id`)'
+      entryPoints:
+        - websecure
+      tls: {}
+      middlewares:
+        - common-chain@file
+      service: hub-service
+
     # ── Scraper API ──
     scraper:
       rule: 'Host(`scraper.asepharyana.my.id`) || Host(`api.asepharyana.my.id`) || Host(`scraper.asepharyana.web.id`) || Host(`api.asepharyana.web.id`)'
@@ -31,6 +41,11 @@ http:
       service: jaeger-service
 
   services:
+    hub-service:
+      loadBalancer:
+        servers:
+          - url: 'http://hub:3000'
+
     scraper-service:
       loadBalancer:
         servers: