chore(deps-dev): bump @biomejs/biome in the development group

Bumps the development group with 1 update: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome).


Updates `@biomejs/biome` from 2.5.3 to 2.5.10
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.10/packages/@biomejs/biome)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot-auto-merge.yml

@@ -0,0 +1,24 @@
+name: dependabot-auto-merge
+
+on:
+  pull_request:
+    branches:
+      - main
+      - master
+
+# Auto-merge Dependabot PRs with passing CI
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    # Only for Dependabot PRs
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Auto-merge
+        run: gh pr merge --auto --merge "$PR_NUMBER"
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/dependabot.yml

@@ -1,21 +1,31 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for more information:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-# https://containers.dev/guide/dependabot
-
 version: 2
 updates:
-  - package-ecosystem: 'devcontainers'
+  - package-ecosystem: "npm"
-    directory: '/'
+    directory: "/"
     schedule:
-      interval: weekly
+      interval: "daily"
-
+      day: "monday"
-  - package-ecosystem: 'github-actions'
+      time: "05:00"
-    directory: '/'
+      timezone: "Asia/Makassar"
-    schedule:
+    open-pull-requests-limit: 10
-      interval: weekly
+    assignees:
+      - "asepharyana"
+    commit-message:
+      prefix: "chore"
+      prefix-development: "chore"
+      include: "scope"
+    reviewers:
+      - "asepharyana"
+    labels:
+      - "dependencies"
     groups:
-      github-actions:
+      production:
-        patterns:
+        dependency-type: "production"
-          - '*'
+        update-types:
+          - "minor"
+          - "patch"
+      development:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/flakehub-publish-rolling.yaml

@@ -12,7 +12,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: DeterminateSystems/determinate-nix-action@main
       - uses: DeterminateSystems/flakehub-push@main
         with:

infra/firewall/firewall.sh

@@ -2,10 +2,30 @@
 # ============================================================
 # firewall.sh — deny-by-default firewall untuk orangevps
 # Public: 22 (SSH), 80/443 (Caddy), 4013 (hermes dashboard)
+#         25565 (Minecraft) — WHITELIST TCPShield proxy only
 # Tailscale CGNAT 100.64/10: semua port (imrnes & node lain)
 # Localhost: semua
 # Sisanya: DROP + log
 # ============================================================
+# TCPShield proxy ranges (https://tcpshield.com/v4/ + /v4-cf/)
+# Update saat TCPShield publish range baru.
+TCPSHIELD_V4=(
+  198.178.119.0/24
+  104.234.6.0/24
+)
+TCPSHIELD_V4_CF=(
+  89.222.122.36/31
+  152.233.22.8/31
+  89.222.108.246/31
+  84.17.55.186/31
+  51.79.45.52/31
+  5.135.84.92/30
+  51.75.35.44/30
+  51.161.27.110/31
+  152.233.30.16/31
+  152.233.30.232/31
+  203.205.31.160/31
+)
 set -e
 
 ### IPv4 ###
@@ -33,6 +53,10 @@ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
 iptables -A INPUT -p tcp --dport 443 -j ACCEPT
 # Public: hermes dashboard (auth-protected)
 iptables -A INPUT -p tcp --dport 4013 -j ACCEPT
+# Public: Minecraft (FTB sky) — hanya dari proxy TCPShield
+for cidr in "${TCPSHIELD_V4[@]}" "${TCPSHIELD_V4_CF[@]}"; do
+  iptables -A INPUT -s "$cidr" -p tcp --dport 25565 -j ACCEPT
+done
 
 # ICMP (ping, PMTU)
 iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 10 -j ACCEPT
@@ -66,15 +90,10 @@ ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 4013 -j ACCEPT
-# ICMPv6/MLD: ping + neighbor discovery (NIC multicast ff02::1 = MLDv2 reports
+# Minecraft 25565: TCPShield IPv4 only — tidak ada range IPv6 publik
-# dari host lain; kena LOG+DROP tiap menit — 1800 baris/6h di journal).
-# IPv6 layer-2 discovery WAJIB di-ACCEPT, bukan cuma dropped.
 ip6tables -A INPUT -p icmpv6 -j ACCEPT
-ip6tables -A INPUT -d ff02::1 -j ACCEPT
-ip6tables -A INPUT -d ff02::2 -j ACCEPT
-ip6tables -A INPUT -d ff02::fb -j ACCEPT
 ip6tables -A INPUT -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "FW6-DROP " --log-level 4
 ip6tables -A INPUT -j DROP
 
 echo "Firewall applied:"
-iptables -L INPUT -n --line-numbers | head -20
+iptables -L INPUT -n --line-numbers | head -24

package.json

@@ -9,6 +9,6 @@
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.3"
+    "@biomejs/biome": "2.5.10"
   }
 }