MythEclipse/asepharyana-hub
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
298 Commits 6 Branches 0 Tags
4f8a975337ebea32aa3a0e5bbcefdb675c6bfab7
Commit Graph
145 Commits
Author SHA1 Message Date
asepharyanaandAsep Haryana 97b635e8c6 firewall: whitelist TCPShield proxy ranges untuk port 25565 (Minecraft) 2026-08-06 20:42:39 +07:00
asepharyana 6c2a4fc9d2 fix(infra): sync Caddyfile.prod with live — add dashboard.asepharyana.my.id block 
dashboard was proxied via wildcard but missing from live Caddy site
blocks -> Cloudflare 525. Live /etc/caddy/Caddyfile is now the
authoritative copy; repo reference updated to match byte-for-byte so
the drift cannot recur.
 2026-08-05 09:44:26 +07:00
Asep Haryana 3e92f68d78 fix(infra): revert imphnen block ke gmw-proxy 4009 (dimentorin gak dipublish via domain ini) 2026-08-04 23:12:02 +07:00
Asep Haryana 2050129062 fix(infra): imphnen site block — SPA :5173 + API /v1 → :4099 (was 525: no block on live caddy) 2026-08-04 22:51:09 +07:00
asepharyana a6148753ca fix(infra): 9router Caddy timeouts — false 504 on slow LLM TTFT 
9router combo models (deepseek-v4-flash-free fallback) have TTFT up to
30-40s. Default (proxy) response_header_timeout 30s / read 60s caused
false-positive 504 'timeout awaiting response headers' even while 9router
was processing. Give the 9router route dedicated long timeouts
(response_header 120s, read/write 300s). Syncs /etc/caddy/Caddyfile.
 2026-08-04 22:02:09 +07:00
Asep Haryana cc8c3f1bf3 chore(infra): add llm-api to prometheus targets.yml (now exposes /metrics) 2026-08-03 11:56:35 +07:00
Asep Haryana 7da1727603 fix(firewall): accept IPv6 MLD/ND multicast (ff02::1, ff02::2, ff02::fb) 
Neighbor multicast to ff02::1 (MLDv2 reports from other hosts) was
hitting the LOG+DROP tail — ~1800 FW6-DROP lines/6h in journald,
i.e. ~5/min of pure log spam from ICMPv6 layer-2 discovery. Accept
link-local multicast ranges before the logging rule.
 2026-08-03 04:06:32 +07:00
asepharyana 3781a8882d chore(infra): scraper OTEL env drop-in (OTLP endpoint 127.0.0.1:4317) 2026-08-02 21:05:20 +07:00
asepharyana da2f4a2f2c chore(infra): prometheus file_sd targets for nix services (gmw-backend/api-metrics) 2026-08-02 21:05:12 +07:00
asepharyana e6033c8b12 feat(infra): hardening firewall + sysctl + ssh 
- deny-by-default iptables/ip6tables: public cuma 22/80/443/4013,
  sisanya localhost + tailscale CGNAT; log FW-DROP rate-limited
- persist via netfilter-persistent (rules.v4/v6) + /usr/local/bin/firewall.sh
- sysctl hardening: syncookies, rp_filter, redirect off, kptr/dmesg
  restrict, protected links, somaxconn, tcp retries tuner
- sshd: PasswordAuthentication no (fix 50-cloud-init.conf override),
  PermitRootLogin prohibit-password, MaxAuthTries 4, LoginGraceTime 30,
  X11Forwarding no
 2026-08-02 20:22:49 +07:00
asepharyana 500af023de fix(infra): otel collector no self-loop trace export 
- hapus otlp/jaeger exporter (jaeger mati sejak Docker dihapus) yang
  nunjuk ke 127.0.0.1:4317 (port receiver sendiri) -> loop trace tanpa
  henti, ~1.8jt baris log/hari di journal
- traces pipeline -> nop exporter, metrics -> prometheus
- logs pipeline dihapus (tidak ada konsumen)
 2026-08-02 19:59:31 +07:00
Asep Haryana 35cbcdcc92 chore(infra): add tuned Caddyfile.prod reference 2026-08-02 16:37:05 +07:00
Asep Haryana 5d21848e87 perf(infra): traefik response speed - HTTP/3 + backend conn pooling 
- entryPoints.websecure.http3: enable QUIC (UDP 443, alt-svc h3)
- serversTransport maxIdleConnsPerHost 2->100: reuse backend keep-alive
- forwardingTimeouts.dialTimeout 30s->3s: fail fast on dead backends
- disable version-check/anonymous-usage network chatter
 2026-08-01 13:12:50 +07:00
Asep Haryana b96548bffa fix(infra): raise upload-buffer response cap to 2GB 
Chunked file streaming (TeleUploader) serves multi-part bodies up to
120MB+; 10MB maxResponseBodyBytes made every big download 500.
 2026-08-01 12:52:34 +07:00
Asep Haryana e19fa76dc3 fix(infra): add teleuploader traefik router for upload hostnames 
Restore upload.asepharyana.my.id/.web.id routing lost during Nix migration
(docker label router removed with container). Upload chain uses 2GB body
buffer + dedicated 300/100 rate limit, service targets bun on host:3000.
 2026-08-01 12:34:22 +07:00
Asep Haryana c535ee7858 ci(otel): add logs pipeline to otel-collector (OTLP /v1/logs 404 fix) 2026-07-31 14:13:56 +07:00
Asep Haryana 80b5161630 ci(infra): traefik dynamic config path -> /home/code (drop /root dependency) 2026-07-31 14:02:07 +07:00
Asep Haryana 1ccc0355ac ci(traefik): add hermes dashboard route via file provider 2026-07-31 13:50:46 +07:00
asepharyana 12aed642a9 ci(traefik): add zeavis routes via file provider (Nix migration) 2026-07-31 12:42:14 +07:00
asepharyana f8e3dccb44 ci(traefik): lidm routes -> host ports 3100/3101 (3000/3001 occupied by teleuploader+gmw) 2026-07-31 11:37:13 +07:00
asepharyana 1811c6adc2 ci(traefik): add lidm frontend+backend routes via file provider (Nix migration) 2026-07-31 11:29:47 +07:00
Asep Haryana d0c9f16d5d chore(infra): disable Docker compose for Nix-migrated services (hub, scraper, tools, llm-api) 2026-07-30 22:29:20 +07:00
GitHub Action d6b9a0806b chore: update manifests and submodules [skip ci] 2026-07-30 15:23:34 +00:00
Asep Haryana 60a1af436f fix(infra): llm-api port 8080→8082 (conflict with gmw-proxy nginx) 2026-07-30 22:18:56 +07:00
Asep Haryana b5596e1398 feat(infra): full Nix migration — all 6 services + CI/CD 
- flake.nix: 6 derivations (hub, scraper, tools-gateway, tools-workers, tools-frontend, llm-api)
- Fetch submodule source via builtins.fetchGit with pinned revs
- Fix cargo HOME/TMPDIR for Nix sandbox permission issues
- Fix llm-api: CMake/Clang deps for llama.cpp-sys2 bindgen
- Add LIBCLANG_PATH, LD_LIBRARY_PATH for Rust bindgen builds
- Systemd units: tools-gateway (3501), tools-frontend (3500), tools-workers, llm-api (8080)
- tools.target for grouped management
- Env configs: /etc/tools/env, /etc/llm-api/env
- GitHub Actions: nix-build.yml — matrix build + nix copy + deploy
- Update Traefik apps.yaml: tools/host.docker.internal:3500, llm-api/host.docker.internal:8080
- iptables: allow Docker→host on 3099, 4091, 3500, 3501, 8080
- Add scripts/nix-deploy.sh for CI/CD deploy step
 2026-07-30 19:45:43 +07:00
Asep Haryana 46730ec07d feat(infra): Nix build for scraper, GitHub Actions workflow 
- Build scraper (Rust) with Nix — cargo build --release
- Create scraper systemd unit (port 4091), env from Docker config
- Fix HOME/CARGO_HOME for Rust/cargo in Nix sandbox
- Update Traefik apps.yaml: scraper -> host.docker.internal:4091
- Add iptables rules for port 4091 (Docker->host)
- Add GitHub Actions workflow: nix-build.yml (determinate-nix + deploy)
- Save iptables rules persistently
 2026-07-30 18:46:45 +07:00
Asep Haryana ff52f8841c feat(infra): Nix build for hub app, systemd deployment 
- Add flake.nix with derivations for hub (Next.js), scraper, tools, llm-api
- Create hub systemd unit (port 3099)
- Update Traefik dynamic config to point to host hub service
- Add iptables rule for Docker-to-host communication
- Use fetchGit for submodule source resolution
 2026-07-30 18:33:43 +07:00
GitHub Action 32049c70ac chore: update manifests and submodules [skip ci] 2026-07-26 12:18:15 +00:00
asepharyana be7348a27d fix(infra): remove buffer/compress from llm-api for real SSE streaming 
- llm-api uses llm-chain instead of common-chain
- llm-chain excludes buffer & compress middlewares
- Prevents Traefik from buffering streaming SSE responses
- Each token is now flushed immediately
 2026-07-26 19:14:52 +07:00
GitHub Action f0c7534152 chore: update manifests and submodules [skip ci] 2026-07-26 12:09:58 +00:00
GitHub Action e42e967b7f chore: update manifests and submodules [skip ci] 2026-07-26 11:27:08 +00:00
GitHub Action 87df0d7ae2 chore: update manifests and submodules [skip ci] 2026-07-26 10:15:32 +00:00
GitHub Action 2913f515f0 chore: update manifests and submodules [skip ci] 2026-07-26 09:14:25 +00:00
GitHub Action 59e2f9d173 chore: update manifests and submodules [skip ci] 2026-07-26 09:08:26 +00:00
GitHub Action d75424634d chore: update manifests and submodules [skip ci] 2026-07-26 08:58:06 +00:00
GitHub Action cc8cefb33a chore: update manifests and submodules [skip ci] 2026-07-26 08:53:27 +00:00
GitHub Action ca81a8b7ee chore: update manifests and submodules [skip ci] 2026-07-26 08:44:28 +00:00
GitHub Action ac25a51113 chore: update manifests and submodules [skip ci] 2026-07-26 08:42:08 +00:00
asepharyanaandGitHub 10aeda4d4b fix: update llm-api MODEL_PATH for new MiniCPM5 GGUF 
Updates MODEL_PATH to MiniCPM5-1B-Claude-Opus-Fable5-V2-Thinking-Q8_0.gguf
 2026-07-26 15:40:14 +07:00
GitHub Action 1e4b17afb0 chore: update manifests and submodules [skip ci] 2026-07-25 12:06:23 +00:00
asepharyana 22e8a872cd fix(infra): replace short -S flags with long --system/--ingroup in hub Dockerfile 
The oven/bun:1.2 base image was updated and -S flag on adduser is
now ambiguous between --shell and --system, causing build failure.
 2026-07-25 19:02:00 +07:00
asepharyanaandClaude Code 3be2744070 fix(hub): switch Dockerfile from npm to bun 
hub project uses bun.lock, but Dockerfile was using npm install which
resolves dependencies differently. Switched to oven/bun image and
bun install --frozen-lockfile for deterministic builds.

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-07-25 17:43:11 +07:00
GitHub Action fde53f22b6 chore: update manifests and submodules [skip ci] 2026-07-25 06:45:09 +00:00
asepharyana e953c3cb67 ci(llm-api): integrate into hub CI/CD pipeline 
- Add llm-api to docker-build-push workflow (build, push, deploy)
- Add llm-api compose file to deploy-docker ALL_COMPOSE_FILES
- Add llm-api to update-submodule workflow
- Add llm-api CodeQL build step in security workflow
- Fix typo in Traefik host rule (asepharya -> asepharyana)
- Update CLAUDE.md submodule list
- Fix .gitmodules URL for llm-api submodule
- Clean up standalone infra files from llm-api submodule repo
 2026-07-25 13:39:35 +07:00
GitHub Action 2033d9b2bc chore: update manifests and submodules [skip ci] 2026-07-25 04:22:20 +00:00
asepharyana 8fc4a15e0c feat(llm-api): add MiniCPM-V LLM API service with Traefik routing 2026-07-25 11:20:15 +07:00
GitHub Action 4fbca91c8c chore: update manifests and submodules [skip ci] 2026-07-24 12:59:04 +00:00
GitHub Action c4791b3160 chore: update manifests and submodules [skip ci] 2026-07-24 12:08:26 +00:00
GitHub Action 6f1dfea710 chore: update manifests and submodules [skip ci] 2026-07-24 11:54:28 +00:00
asepharyanaandKilo 3c52036f7e fix(infra): replace curl healthcheck with wget, install wget in runtime 
Co-Authored-By: Kilo <kilo@kilo.ai>
 2026-07-24 18:52:40 +07:00