MythEclipse/asepharyana-hub
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
262 Commits 6 Branches 0 Tags
3781a8882d451668becd21911da53eb14ce5adc7
Commit Graph
262 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
asepharyana 3781a8882d chore(infra): scraper OTEL env drop-in (OTLP endpoint 127.0.0.1:4317) 2026-08-02 21:05:20 +07:00
asepharyana da2f4a2f2c chore(infra): prometheus file_sd targets for nix services (gmw-backend/api-metrics) 2026-08-02 21:05:12 +07:00
asepharyana ad22a39a9e chore(infra): use full sha for hub flake rev 2026-08-02 20:56:16 +07:00
asepharyanaandAsep Haryana 2f969972a1 chore(infra): bump hub flake rev to f35edb0 (dashboard fix) 2026-08-02 20:55:55 +07:00
monrepo-bot 620f06fbe0 chore: update hub to f35edb00d726 2026-08-02 13:55:07 +00:00
asepharyana e6033c8b12 feat(infra): hardening firewall + sysctl + ssh 
- deny-by-default iptables/ip6tables: public cuma 22/80/443/4013,
  sisanya localhost + tailscale CGNAT; log FW-DROP rate-limited
- persist via netfilter-persistent (rules.v4/v6) + /usr/local/bin/firewall.sh
- sysctl hardening: syncookies, rp_filter, redirect off, kptr/dmesg
  restrict, protected links, somaxconn, tcp retries tuner
- sshd: PasswordAuthentication no (fix 50-cloud-init.conf override),
  PermitRootLogin prohibit-password, MaxAuthTries 4, LoginGraceTime 30,
  X11Forwarding no
 2026-08-02 20:22:49 +07:00
asepharyana 500af023de fix(infra): otel collector no self-loop trace export 
- hapus otlp/jaeger exporter (jaeger mati sejak Docker dihapus) yang
  nunjuk ke 127.0.0.1:4317 (port receiver sendiri) -> loop trace tanpa
  henti, ~1.8jt baris log/hari di journal
- traces pipeline -> nop exporter, metrics -> prometheus
- logs pipeline dihapus (tidak ada konsumen)
 2026-08-02 19:59:31 +07:00
Asep Haryana e280d196f9 chore: update llm-api to 344bc195fa95 2026-08-02 17:02:59 +07:00
Asep Haryana 4927338c98 docs: sync infra docs to Caddy+Nix 4000s (Traefik/Docker legacy) 2026-08-02 16:54:17 +07:00
monrepo-bot 54ee903647 chore: update llm-api to 344bc195fa95 2026-08-02 09:45:06 +00:00
Asep Haryana 35cbcdcc92 chore(infra): add tuned Caddyfile.prod reference 2026-08-02 16:37:05 +07:00
monrepo-bot 324fe08913 chore: update llm-api to 81c51772495c 2026-08-02 09:18:56 +00:00
Asep Haryana e171201b1c chore: sync port references and docs to 4000s infra 2026-08-02 16:16:40 +07:00
Asep Haryana ec1394bdc5 chore: bump tools submodule (ports 4007/4008) 2026-08-02 14:31:47 +07:00
asepharyana f0787b5f23 fix(nix): restrict flake to x86_64-linux (nixpkgs 26.11 dropped darwin) 2026-08-01 18:03:44 +07:00
asepharyana 0df6c35d5a ci: publish flake to FlakeHub (rolling) 2026-08-01 17:58:22 +07:00
Asep Haryana 5d21848e87 perf(infra): traefik response speed - HTTP/3 + backend conn pooling 
- entryPoints.websecure.http3: enable QUIC (UDP 443, alt-svc h3)
- serversTransport maxIdleConnsPerHost 2->100: reuse backend keep-alive
- forwardingTimeouts.dialTimeout 30s->3s: fail fast on dead backends
- disable version-check/anonymous-usage network chatter
 2026-08-01 13:12:50 +07:00
Asep Haryana b96548bffa fix(infra): raise upload-buffer response cap to 2GB 
Chunked file streaming (TeleUploader) serves multi-part bodies up to
120MB+; 10MB maxResponseBodyBytes made every big download 500.
 2026-08-01 12:52:34 +07:00
Asep Haryana e19fa76dc3 fix(infra): add teleuploader traefik router for upload hostnames 
Restore upload.asepharyana.my.id/.web.id routing lost during Nix migration
(docker label router removed with container). Upload chain uses 2GB body
buffer + dedicated 300/100 rate limit, service targets bun on host:3000.
 2026-08-01 12:34:22 +07:00
Asep Haryana c535ee7858 ci(otel): add logs pipeline to otel-collector (OTLP /v1/logs 404 fix) 2026-07-31 14:13:56 +07:00
Asep Haryana 80b5161630 ci(infra): traefik dynamic config path -> /home/code (drop /root dependency) 2026-07-31 14:02:07 +07:00
Asep Haryana 1ccc0355ac ci(traefik): add hermes dashboard route via file provider 2026-07-31 13:50:46 +07:00
asepharyana 12aed642a9 ci(traefik): add zeavis routes via file provider (Nix migration) 2026-07-31 12:42:14 +07:00
asepharyana f8e3dccb44 ci(traefik): lidm routes -> host ports 3100/3101 (3000/3001 occupied by teleuploader+gmw) 2026-07-31 11:37:13 +07:00
asepharyana 1811c6adc2 ci(traefik): add lidm frontend+backend routes via file provider (Nix migration) 2026-07-31 11:29:47 +07:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		ceeac5c02f chore(deps): bump the github-actions group across 1 directory with 3 updates (#9) 
Bumps the github-actions group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [DeterminateSystems/nix-installer-action](https://github.com/determinatesystems/nix-installer-action) and [DeterminateSystems/magic-nix-cache-action](https://github.com/determinatesystems/magic-nix-cache-action).


Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v7)

Updates `DeterminateSystems/nix-installer-action` from 16 to 22
- [Release notes](https://github.com/determinatesystems/nix-installer-action/releases)
- [Commits](https://github.com/determinatesystems/nix-installer-action/compare/v16...v22)

Updates `DeterminateSystems/magic-nix-cache-action` from 8 to 14
- [Release notes](https://github.com/determinatesystems/magic-nix-cache-action/releases)
- [Commits](https://github.com/determinatesystems/magic-nix-cache-action/compare/v8...v14)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: DeterminateSystems/magic-nix-cache-action
  dependency-version: '14'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: DeterminateSystems/nix-installer-action
  dependency-version: '22'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-30 22:34:36 +07:00
Asep Haryana d0c9f16d5d chore(infra): disable Docker compose for Nix-migrated services (hub, scraper, tools, llm-api) 2026-07-30 22:29:20 +07:00
Asep Haryana 6cbafbfe2e fix(flake): update scraper pinned rev for config fix 2026-07-30 22:28:24 +07:00
GitHub Action d6b9a0806b chore: update manifests and submodules [skip ci] 2026-07-30 15:23:34 +00:00
Asep Haryana 60a1af436f fix(infra): llm-api port 8080→8082 (conflict with gmw-proxy nginx) 2026-07-30 22:18:56 +07:00
Asep Haryana 2459541677 fix(scraper): update submodule - config list_separator fix 2026-07-30 22:18:03 +07:00
Asep Haryana 33b999d2b7 fix(ci): disable Determinate Nix / FlakeHub (no flakehub flakes used) 
DeterminateSystems/nix-installer-action defaults to determinate:true
which tries to auth with FlakeHub via GitHub JWT. We don't use any
FlakeHub flakes, so disable it — skipping the auth entirely.
 2026-07-30 22:05:41 +07:00
Asep Haryana 59f131f951 fix(ci): combine build+deploy per-service, pass exact store path 
Separate deploy job failed because it used ls to find store paths
by name, finding OLD local paths instead of the freshly copied CI
paths. Now each service builds, copies, and updates its profile
in a single job using the exact store path from the build output.
No more guessing which path is the right one.
 2026-07-30 21:42:39 +07:00
Asep Haryana cc8c5088a4 fix(ci): use SSH_PRIVATE_KEY secret, sanitize key format 
- Ganti secret name: VPS_SSH_KEY → SSH_PRIVATE_KEY (nama yg ada)
- Fix nix copy URL: ***@ → $VPS_USER@
- Sanitize SSH key: strip \r\n, validasi dengan ssh-keygen
- Cegah libcrypto error dari key format broken
 2026-07-30 21:32:40 +07:00
Asep Haryana d15e8621a9 fix(ci): proper SSH user in nix copy, deploy job structure 
- Fix nix copy URL: ***@ → $VPS_USER@
- Store path from build output, passed across jobs
- Deploy job waits for all builds via needs: build
- SSH key setup in its own step, guarded by main branch
- Only deploy on main branch pushes
- Remote deploy script fetches from VPS nix store
 2026-07-30 21:14:20 +07:00
Asep Haryana 33d5b12ec6 fix: tools-workers install path (no cd backend in installPhase) 2026-07-30 20:11:31 +07:00
Asep Haryana b5596e1398 feat(infra): full Nix migration — all 6 services + CI/CD 
- flake.nix: 6 derivations (hub, scraper, tools-gateway, tools-workers, tools-frontend, llm-api)
- Fetch submodule source via builtins.fetchGit with pinned revs
- Fix cargo HOME/TMPDIR for Nix sandbox permission issues
- Fix llm-api: CMake/Clang deps for llama.cpp-sys2 bindgen
- Add LIBCLANG_PATH, LD_LIBRARY_PATH for Rust bindgen builds
- Systemd units: tools-gateway (3501), tools-frontend (3500), tools-workers, llm-api (8080)
- tools.target for grouped management
- Env configs: /etc/tools/env, /etc/llm-api/env
- GitHub Actions: nix-build.yml — matrix build + nix copy + deploy
- Update Traefik apps.yaml: tools/host.docker.internal:3500, llm-api/host.docker.internal:8080
- iptables: allow Docker→host on 3099, 4091, 3500, 3501, 8080
- Add scripts/nix-deploy.sh for CI/CD deploy step
 2026-07-30 19:45:43 +07:00
Asep Haryana 46730ec07d feat(infra): Nix build for scraper, GitHub Actions workflow 
- Build scraper (Rust) with Nix — cargo build --release
- Create scraper systemd unit (port 4091), env from Docker config
- Fix HOME/CARGO_HOME for Rust/cargo in Nix sandbox
- Update Traefik apps.yaml: scraper -> host.docker.internal:4091
- Add iptables rules for port 4091 (Docker->host)
- Add GitHub Actions workflow: nix-build.yml (determinate-nix + deploy)
- Save iptables rules persistently
 2026-07-30 18:46:45 +07:00
Asep Haryana 1ae8a53cd4 chore: ignore Nix build result symlink 2026-07-30 18:33:52 +07:00
Asep Haryana ff52f8841c feat(infra): Nix build for hub app, systemd deployment 
- Add flake.nix with derivations for hub (Next.js), scraper, tools, llm-api
- Create hub systemd unit (port 3099)
- Update Traefik dynamic config to point to host hub service
- Add iptables rule for Docker-to-host communication
- Use fetchGit for submodule source resolution
 2026-07-30 18:33:43 +07:00
monrepo-bot b747ae5c3b chore: update hub to b007ced615dc 2026-07-29 00:12:03 +00:00
monrepo-bot 64ce812b4e chore: update hub to 5370fd47954d 2026-07-29 00:10:06 +00:00
monrepo-bot 9837d9dc50 chore: update hub to 407aa7b8993b 2026-07-28 00:11:32 +00:00
monrepo-bot 86dda74174 chore: update hub to a803849cba6c 2026-07-27 00:21:20 +00:00
monrepo-bot d045602f3e chore: update hub to 6042a6056a99 2026-07-27 00:17:20 +00:00
GitHub Action 32049c70ac chore: update manifests and submodules [skip ci] 2026-07-26 12:18:15 +00:00
asepharyana be7348a27d fix(infra): remove buffer/compress from llm-api for real SSE streaming 
- llm-api uses llm-chain instead of common-chain
- llm-chain excludes buffer & compress middlewares
- Prevents Traefik from buffering streaming SSE responses
- Each token is now flushed immediately
 2026-07-26 19:14:52 +07:00
asepharyana 43f0df4493 fix(infra): remove buffer/compress from llm-api middleware chain 
- Buffer middleware causes SSE stream buffering
- Compress middleware breaks real-time streaming
- Added llm-chain with only secure-headers + retry + rate-limit
- llm-api router now uses llm-chain@file instead of common-chain@file
 2026-07-26 19:13:08 +07:00
GitHub Action f0c7534152 chore: update manifests and submodules [skip ci] 2026-07-26 12:09:58 +00:00
asepharyana a4687c9d5b fix(llm-api): update submodule - reasoning/content stream separation 2026-07-26 19:04:36 +07:00