ci: add Nix GC cleanup job on VPS after deploy

update code & comment

.env.example

@@ -1,6 +1,6 @@
 WEB_PORT=5173
-API_PORT=3000
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/zeavis_edu
+API_PORT=4006
+DATABASE_URL=postgres://asephs:***@100.121.180.82:6432/zeavis_edu
 
 # ── Telemetry / ClickHouse ──────────────────────────────────────────
 # These credentials are used by the telemetry Docker Compose stack.

.github/workflows/android.yml

@@ -1,203 +0,0 @@
-name: Build Android APK
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'apps/web/**'
-      - 'apps/tauri/**'
-      - 'packages/shared/**'
-      - '.github/workflows/android.yml'
-  pull_request:
-    paths:
-      - 'apps/web/**'
-      - 'apps/tauri/**'
-      - 'packages/shared/**'
-      - '.github/workflows/android.yml'
-  workflow_dispatch:
-
-env:
-  VITE_API_BASE_URL: ${{ vars.VITE_API_BASE_URL || 'https://zeavisedu.asepharyana.my.id' }}
-
-jobs:
-  build-apk:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    permissions:
-      contents: write
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          fetch-tags: true
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            apps/*/node_modules
-            packages/*/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock', '**/package.json') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install
-
-      - name: Setup Java 21
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: '21'
-
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
-        with:
-          packages: 'platforms;android-36 build-tools;36.0.0'
-      - name: Pin NDK version
-        run: echo "ANDROID_NDK_HOME=${ANDROID_SDK_ROOT}/ndk/$(ls ${ANDROID_SDK_ROOT}/ndk | sort -V | head -1)" >> $GITHUB_ENV
-
-      - name: Setup Rust with Android targets
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: >-
-            aarch64-linux-android,
-            armv7-linux-androideabi,
-            i686-linux-android,
-            x86_64-linux-android
-
-      - name: Cache Cargo
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            apps/tauri/target
-          key: ${{ runner.os }}-cargo-android-${{ hashFiles('apps/tauri/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-android-
-
-      - name: Cache Gradle
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: ${{ runner.os }}-gradle-android-${{ hashFiles('apps/tauri/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-gradle-android-
-
-      - name: Install Tauri CLI
-        run: cd apps/tauri && bun install
-
-      - name: Compute version
-        id: version
-        run: |
-          # Get latest git tag, default to v0.1.0
-          LATEST_TAG=$(git tag --list 'v*' --sort=-v:refname | head -1)
-          if [ -z "$LATEST_TAG" ]; then
-            NEW_VERSION="0.1.0"
-          else
-            # Strip 'v' prefix, bump patch
-            BASE="${LATEST_TAG#v}"
-            IFS='.' read -r MAJOR MINOR PATCH <<< "$BASE"
-            PATCH=$((PATCH + 1))
-            NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
-          fi
-          echo "version=${NEW_VERSION}" >> $GITHUB_OUTPUT
-          echo "New version: ${NEW_VERSION}"
-
-          # Update tauri.conf.json
-          jq --arg v "${NEW_VERSION}" '.version = $v' apps/tauri/tauri.conf.json > /tmp/tauri.conf.json && mv /tmp/tauri.conf.json apps/tauri/tauri.conf.json
-
-          # Update Cargo.toml
-          sed -i "s/^version = \".*\"/version = \"${NEW_VERSION}\"/" apps/tauri/Cargo.toml
-
-          echo "Updated tauri.conf.json and Cargo.toml to ${NEW_VERSION}"
-
-      - name: Init Tauri Android project
-        working-directory: apps/tauri
-        env:
-          JAVA_HOME: ${{ env.JAVA_HOME_21_X64 }}
-          ANDROID_HOME: ${{ env.ANDROID_SDK_ROOT }}
-          NDK_HOME: ${{ env.ANDROID_NDK_HOME }}
-        run: |
-          rm -rf gen/android
-          bun tauri android init
-
-      - name: Generate Android launcher icons from SVG logo
-        working-directory: apps/tauri
-        run: bun run scripts/generate-icons.js
-
-      - name: Patch AndroidManifest (CAMERA permission + deep link)
-        working-directory: apps/tauri
-        run: bash scripts/patch-android-manifest.sh
-
-      - name: Build Tauri Android APK
-        working-directory: apps/tauri
-        env:
-          JAVA_HOME: ${{ env.JAVA_HOME_21_X64 }}
-          ANDROID_HOME: ${{ env.ANDROID_SDK_ROOT }}
-          NDK_HOME: ${{ env.ANDROID_NDK_HOME }}
-        run: bun tauri android build --apk
-
-      - name: Decode keystore
-        if: github.event_name != 'pull_request'
-        env:
-          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
-        run: |
-          echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > apps/tauri/zeavis.keystore
-
-      - name: Sign APK
-        if: github.event_name != 'pull_request'
-        env:
-          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
-          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
-          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
-        run: |
-          APK_UNSIGNED=$(find apps/tauri/gen/android/app/build/outputs/apk -name '*.apk' ! -name '*-signed*' | head -1)
-          APK_SIGNED="apps/tauri/gen/android/app/build/outputs/apk/universal/release/zeavis-edu-v${{ steps.version.outputs.version }}.apk"
-          $ANDROID_SDK_ROOT/build-tools/36.0.0/apksigner sign \
-            --ks apps/tauri/zeavis.keystore \
-            --ks-pass "pass:${ANDROID_KEYSTORE_PASSWORD}" \
-            --ks-key-alias "${ANDROID_KEY_ALIAS}" \
-            --key-pass "pass:${ANDROID_KEY_PASSWORD}" \
-            --out "$APK_SIGNED" \
-            "$APK_UNSIGNED"
-          echo "signed_apk=${APK_SIGNED}" >> $GITHUB_ENV
-          echo "Signed APK: $APK_SIGNED"
-          ls -lh "$APK_SIGNED"
-
-      - name: Create Release and upload APK
-        if: github.event_name != 'pull_request'
-        id: release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: v${{ steps.version.outputs.version }}
-          name: v${{ steps.version.outputs.version }}
-          body: |
-            ZeaVis Edu Android APK v${{ steps.version.outputs.version }}
-
-            📦 Built from ${{ github.sha }}
-            🔗 Triggered by ${{ github.actor }}
-
-            ### Install
-            Download the APK below and install on your Android device.
-
-            🤖 Generated with [Claude Code](https://claude.com/claude-code)
-          files: |
-            ${{ env.signed_apk }}
-            apps/tauri/gen/android/app/build/outputs/bundle/**/*.aab
-          draft: false
-          prerelease: false

.github/workflows/deploy.yml

@@ -1,209 +1,133 @@
-name: Build and Deploy
+name: Build & Deploy (Nix)
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
   workflow_dispatch:
 
+concurrency:
+  group: zeavis-deploy
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+
 env:
-  REGISTRY: ghcr.io
-  VITE_API_BASE_URL: ${{ vars.VITE_API_BASE_URL || '' }}
+  VPS_HOST: ${{ secrets.VPS_HOST }}
+  VPS_USER: ${{ secrets.VPS_USER }}
+
 jobs:
-  build:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          submodules: false
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install deps (root workspace)
+        run: bun install --frozen-lockfile
+
+      - name: Test API
+        working-directory: apps/api
+        run: bun test
+
+  build-and-deploy:
+    needs: test
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     strategy:
       fail-fast: false
+      max-parallel: 1
       matrix:
-        service:
-          - name: web
-            dockerfile: apps/web/Dockerfile
-          - name: api
-            dockerfile: apps/api/Dockerfile
-          - name: ml
-            dockerfile: apps/ml-service/Dockerfile
+        service: [api, ml-service, web]
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set image prefix
-        run: echo "IMAGE_PREFIX=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Set up Python for model download & export
-        if: matrix.service.name == 'ml'
-        uses: actions/setup-python@v5
+      - name: Checkout
+        uses: actions/checkout@v7
         with:
-          python-version: '3.11'
+          fetch-depth: 0
+          submodules: false
 
-      - name: Download ONNX model from Hugging Face
-        if: matrix.service.name == 'ml'
-        working-directory: Machine_Learning
-        env:
-          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          determinate: false
+          extra-conf: |
+            sandbox = false
+            accept-flake-config = true
+
+      - name: Cache Nix
+        uses: DeterminateSystems/magic-nix-cache-action@v14
+        with:
+          use-flakehub: false
+
+      - name: Build zeavis-${{ matrix.service }}
+        id: build
         run: |
-          set -eu
-          echo "::group::Install huggingface_hub"
-          python -m pip install --upgrade pip -q
-          python -m pip install huggingface_hub -q
-          echo "::endgroup::"
+          STORE_PATH=$(nix build .#${{ matrix.service }} --impure --option sandbox false --no-link --print-out-paths | tail -1)
+          echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT"
+          echo "Build OK zeavis-${{ matrix.service }}: $STORE_PATH"
 
-          echo "::group::Check HF_TOKEN"
-          if [ -z "${HF_TOKEN:-}" ]; then
-            echo "ERROR: HF_TOKEN secret is not set."
-            echo "Add it: https://github.com/ATLAS-PJK-GM007/ZeaVis-Edu/settings/secrets/actions"
-            exit 1
-          fi
-          echo "HF_TOKEN is set (length: ${#HF_TOKEN})"
-          echo "::endgroup::"
+      - name: Setup SSH key
+        env:
+          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          sed -i 's/\r$//' ~/.ssh/id_ed25519
+          ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
+          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
 
-          echo "::group::Download model files from Hugging Face"
-          python -c "
-          from huggingface_hub import hf_hub_download
-          import os, shutil
-          repo = 'MythEclipse2737/zeavis-edu-corn-leaf-classifier'
-          token = os.environ['HF_TOKEN']
-          base = os.path.abspath('.')
+      - name: Deploy zeavis-${{ matrix.service }} to VPS
+        run: |
+          STORE_PATH="${{ steps.build.outputs.store-path }}"
+          echo "=== Copying zeavis-${{ matrix.service }}: $STORE_PATH ==="
+          nix copy --to "ssh://$VPS_USER@$VPS_HOST" "$STORE_PATH"
 
-          # Files sit at root of HF repo → copy to correct subdirs
-          # model.onnx goes to model/ for Docker COPY
-          os.makedirs(os.path.join(base, 'model'), exist_ok=True)
-          os.makedirs(os.path.join(base, 'best_model'), exist_ok=True)
-
-          # ONNX → model/model.onnx (Docker expects this path)
-          p = hf_hub_download(repo_id=repo, filename='model.onnx', token=token)
-          shutil.copy2(p, os.path.join(base, 'model', 'model.onnx'))
-          print('model/model.onnx OK')
-
-          # TFLite (optional, for edge)
-          p = hf_hub_download(repo_id=repo, filename='model.tflite', token=token)
-          shutil.copy2(p, os.path.join(base, 'model', 'model.tflite'))
-          print('model/model.tflite OK')
-
-          # Labels
-          p = hf_hub_download(repo_id=repo, filename='labels.json', token=token)
-          shutil.copy2(p, os.path.join(base, 'model', 'labels.json'))
-          print('model/labels.json OK')
-
-          # Keras model + calibration for re-export
-          p = hf_hub_download(repo_id=repo, filename='best_model.keras', token=token)
-          shutil.copy2(p, os.path.join(base, 'best_model', 'best_model.keras'))
-          print('best_model/best_model.keras OK')
-
-          p = hf_hub_download(repo_id=repo, filename='calibration.json', token=token)
-          shutil.copy2(p, os.path.join(base, 'best_model', 'calibration.json'))
-          print('best_model/calibration.json OK')
+          echo "=== Updating profile + restarting ==="
+          ssh "$VPS_USER@$VPS_HOST" "
+            set -eu
+            if [ -d /nix/var/nix/profiles/zeavis-${{ matrix.service }} ] && [ ! -L /nix/var/nix/profiles/zeavis-${{ matrix.service }} ]; then
+              rm -rf /nix/var/nix/profiles/zeavis-${{ matrix.service }}
+            fi
+            sudo /nix/var/nix/profiles/default/bin/nix-env --profile /nix/var/nix/profiles/zeavis-${{ matrix.service }} --set '$STORE_PATH'
+            sudo systemctl daemon-reload
+            sudo systemctl enable zeavis-${{ matrix.service }} 2>/dev/null || true
+            sudo systemctl restart zeavis-${{ matrix.service }}
+            for i in \$(seq 1 30); do
+              systemctl is-active --quiet zeavis-${{ matrix.service }} && break
+              sleep 1
+            done
+            systemctl is-active zeavis-${{ matrix.service }} || {
+              echo '=== SERVICE FAILED — journal ==='
+              journalctl -u zeavis-${{ matrix.service }} -n 40 --no-pager
+              exit 1
+            }
+            systemctl status zeavis-${{ matrix.service }} --no-pager 2>&1 | head -8
           "
-          ls -lh model/model.onnx model/model.tflite model/labels.json best_model/best_model.keras 2>/dev/null
-          echo "::endgroup::"
+          echo "✅ zeavis-${{ matrix.service }} deployed"
 
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.IMAGE_PREFIX }}/${{ matrix.service.name }}
-          tags: |
-            type=ref,event=branch
-            type=sha
-
-      - name: Build and push image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ${{ matrix.service.dockerfile }}
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            VITE_API_BASE_URL=${{ env.VITE_API_BASE_URL }}
-          cache-from: type=gha,scope=${{ matrix.service.name }}
-          cache-to: type=gha,mode=max,scope=${{ matrix.service.name }}
-
-  deploy:
-    needs: build
+  cleanup:
+    # Bersihkan sampah Nix di VPS SETELAH deploy: hapus generasi profile lama
+    # + nix store gc. Profil yang sedang dipakai tidak disentuh.
+    needs: build-and-deploy
+    if: always()
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
-    permissions:
-      contents: read
-      packages: read
     steps:
-      - name: Validate deploy secrets
+      - name: Nix GC on VPS
         env:
           VPS_HOST: ${{ secrets.VPS_HOST }}
           VPS_USER: ${{ secrets.VPS_USER }}
-          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         run: |
-          if [ -z "$VPS_HOST" ] || [ -z "$VPS_USER" ] || [ -z "$VPS_SSH_KEY" ]; then
-            echo "Missing deploy secrets: VPS_HOST, VPS_USER, VPS_SSH_KEY." >&2
-            exit 1
-          fi
-
-      - name: Deploy to VPS
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: ${{ secrets.VPS_HOST }}
-          username: ${{ secrets.VPS_USER }}
-          key: ${{ secrets.VPS_SSH_KEY }}
-          passphrase: ${{ secrets.VPS_SSH_PASSPHRASE }}
-          port: ${{ secrets.VPS_PORT || 22 }}
-          script: |
-            set -e
-            DEPLOY_PATH="${DEPLOY_PATH:-/opt/ZeaVis-Edu}"
-            REPO_SLUG="$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
-
-            if [ ! -d "$DEPLOY_PATH/.git" ]; then
-              mkdir -p "$DEPLOY_PATH"
-              git clone https://github.com/${{ github.repository }}.git "$DEPLOY_PATH"
-            fi
-
-            cd "$DEPLOY_PATH"
-            git fetch origin main
-            git reset --hard origin/main
-
-            {
-              printf 'GITHUB_REPOSITORY=%s\n' "$REPO_SLUG"
-              cat << 'ENVEOF'
-            DATABASE_URL=${{ secrets.DATABASE_URL }}
-            SESSION_SECRET=${{ secrets.SESSION_SECRET }}
-            WEB_APP_URL=https://zeavisedu.asepharyana.my.id
-            ML_SERVICE_URL=http://zeavis-ml:8000
-            TS_IP=${{ vars.TS_IP || '100.96.248.86' }}
-            GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }}
-            GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }}
-            GOOGLE_REDIRECT_URI=https://zeavisedu.asepharyana.my.id/api/v1/auth/google/callback
-            ENVEOF
-            } > .env
-
-            docker login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
-            docker network create app-shared-net 2>/dev/null || true
-            docker network create telemetry-net 2>/dev/null || true
-            docker compose down --remove-orphans || true
-            docker rm -f zeavis-web zeavis-api zeavis-ml zeavis-node-exporter 2>/dev/null || true
-            docker compose pull
-            docker compose up -d
-            # Wait for containers to be healthy (up to 60s)
-            wait_container() {
-              local name=$1
-              for i in $(seq 1 30); do
-                docker compose ps | grep -q "${name}.*Up" && return 0
-                sleep 2
-              done
-              return 1
-            }
-            wait_container zeavis-web || exit 1
-            wait_container zeavis-api || exit 1
-            wait_container zeavis-ml || exit 1
-            wait_container zeavis-node-exporter || echo "⚠️  node_exporter not running (non-fatal)"
-            docker compose ps
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+          ssh "$VPS_USER@$VPS_HOST" "sudo /usr/local/bin/nix-gc-vps.sh" || echo "⚠️ Nix GC gagal (non-fatal)"

.github/workflows/flakehub-publish-rolling.yaml

@@ -0,0 +1,20 @@
+name: Publish to FlakeHub
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+jobs:
+  flakehub-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: DeterminateSystems/determinate-nix-action@main
+      - uses: DeterminateSystems/flakehub-push@main
+        with:
+          visibility: public
+          rolling: true

.github/workflows/mirror-gitea.yml

@@ -0,0 +1,26 @@
+name: Mirror to Gitea
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Mirror to Gitea
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          git remote add gitea "https://oauth2:${GITEA_TOKEN}@git.imrnes.team/MythEclipse/zeavis-edu.git"
+          git push --mirror gitea
+          echo "✅ Mirrored to Gitea (MythEclipse/zeavis-edu)"

CLAUDE.md

@@ -162,7 +162,7 @@ Each ZeaVis Edu service exposes a `GET /metrics` endpoint:
 
 All three share the `zeavis_` metric prefix and are scraped by Prometheus via `file_sd_configs` (see `telemetry/prometheus/targets/zeavis-edu.json`).
 
-**IMPORTANT — Production architecture:** ZeaVis Edu apps and the Telemetry stack run on **separate VPS instances** connected via **Tailscale** (mesh VPN). Prometheus scrapes the API and ML service through their **Tailscale IPs** (e.g. `100.x.x.a:3000`), not via Docker hostnames. The target file has `__CHANGE_ME__` placeholders — replace with actual Tailscale IPs before deploying.
+**IMPORTANT — Production architecture:** ZeaVis Edu apps and the Telemetry stack run on **separate VPS instances** connected via **Tailscale** (mesh VPN). Prometheus scrapes the API and ML service through their **Tailscale IPs** (e.g. `100.121.180.82:4006`), not via Docker hostnames. The target file has `__CHANGE_ME__` placeholders — replace with actual Tailscale IPs before deploying.
 
 The telemetry stack is managed from the project root via `make telemetry-*` targets (see `Makefile`). Docker Compose defines 5 services (Prometheus, Node Exporter, Query Proxy, Grafana, Telemetry UI).
 

METRICS.md

@@ -10,15 +10,15 @@ application stack and the payload each service provides.
 | Service               | Host (prod)                       | Metrics Endpoint           | Port (local) |
 |-----------------------|-----------------------------------|----------------------------|--------------|
 | Web (Vite dev)        | `zeavisedu.asepharyana.my.id`     | `GET /metrics`             | 5173         |
-| API (Elysia)          | `api-zeavisedu.asepharyana.my.id`   | `GET /metrics`           | 3000         |
-| ML Service (Axum)     | `ml-zeavisedu.asepharyana.my.id`    | `GET /metrics`           | 8000         |
+| API (Elysia)          | `api-zeavisedu.asepharyana.my.id`   | `GET /metrics`           | 4006         |
+| ML Service (Axum)     | `ml-zeavisedu.asepharyana.my.id`    | `GET /metrics`           | 4012         |
 | Prometheus Collector  | —                                 | `GET /metrics` (self)      | 9090         |
 
 > In production all metrics are scraped by the Prometheus collector running in the
 > Telemetry stack on a **separate VPS** connected via **Tailscale**.
 > See [`telemetry/prometheus/targets/`](./telemetry/prometheus/targets/)
 > for the auto‑discovery configuration. Target files must use **Tailscale IPs**
-> (e.g. `100.x.x.a:3000`), not Docker hostnames, because the services are on
+> (e.g. `100.121.180.82:4006`), not Docker hostnames, because the services are on
 > different hosts.
 >
 > In production (nginx), the web app proxies `/metrics` to the API service:
@@ -101,11 +101,11 @@ The Telemetry submodule includes a Prometheus instance that uses
 ```json
 [
   {
-    "targets": ["100.x.x.a:3000"],
+    "targets": ["100.121.180.82:4006"],
     "labels": { "service": "zeavis-api", "component": "backend", "env": "production" }
   },
   {
-    "targets": ["100.x.x.b:8000"],
+    "targets": ["100.121.180.82:4012"],
     "labels": { "service": "zeavis-ml", "component": "inference", "env": "production" }
   }
 ]
@@ -113,8 +113,8 @@ The Telemetry submodule includes a Prometheus instance that uses
 
 > ⚠️ **Cross-VPS:** Gunakan **IP Tailscale** (bukan Docker hostname) karena
 > Prometheus dan ZeaVis Edu berjalan di VPS berbeda. Pastikan port service
-> (`:3000`, `:8000`) terekspos di `0.0.0.0` atau diizinkan oleh aturan
-> `iptables`/`ufw` untuk interface Tailscale (`tailscale0`/`100.x.x.x/10`).
+> (`:4006`, `:4012`) terekspos di `0.0.0.0` atau diizinkan oleh aturan
+> `iptables`/`ufw` untuk interface Tailscale (`tailscale0`/`100.121.180.82`).
 
 The Prometheus config (in `telemetry/prometheus/prometheus.yml`) will
 automatically pick up new files within its 15‑second scrape interval —

Machine_Learning/README.md

@@ -92,7 +92,7 @@ Proyek ini menggabungkan **3 dataset** dari sumber berbeda untuk menghasilkan da
 ### Dataset 1 — Kaggle (Corn Leaf Disease - Indonesia)
 > 🔗 https://www.kaggle.com/datasets/ndisan/corn-leaf-disease
 
-Berisi gambar penyakit daun jagung dengan label dalam Bahasa Indonesia. Dataset ini memiliki **4 folder**, namun label **"Karat Daun" tidak digunakan** karena gambar di dalamnya tidak merepresentasikan penyakit karat yang sebenarnya.
+Dataset ini berisi 4.000 citra RGB daun jagung yang terbagi ke dalam empat kelas, yaitu daun sehat, hawar daun, bercak daun, dan karat daun. Data dikumpulkan dari lahan jagung di Kabupaten Sampang menggunakan kamera ponsel 16 MP dengan teknik pengambilan gambar yang terkontrol untuk mendukung proses klasifikasi. Pelabelan dan validasi data dilakukan oleh pihak Dinas Pertanian dan POPT Kabupaten Sampang guna menjamin kualitas serta keakuratan dataset.
 
 | Folder di Dataset 1 | Tindakan |
 |---|---|
@@ -104,6 +104,7 @@ Berisi gambar penyakit daun jagung dengan label dalam Bahasa Indonesia. Dataset
 ### Dataset 2 — Kaggle (Corn or Maize Leaf Disease)
 > 🔗 https://www.kaggle.com/datasets/smaranjitghose/corn-or-maize-leaf-disease-dataset
 
+Dataset Corn or Maize Leaf Disease Dataset berisi 4.188 citra RGB daun jagung yang terbagi ke dalam empat kelas, yaitu Common Rust, Gray Leaf Spot, Blight, dan Healthy. Dataset ini merupakan hasil penggabungan PlantVillage dan PlantDoc, sehingga cocok digunakan untuk penelitian klasifikasi penyakit daun jagung menggunakan metode Machine Learning maupun Deep Learning.
 Digunakan untuk **menggantikan** data Karat Daun dari Dataset 1 dan menambah variasi gambar Daun Sehat.
 
 | Folder di Dataset 2 | Dipetakan ke Label |
@@ -116,7 +117,7 @@ Digunakan untuk **menggantikan** data Karat Daun dari Dataset 1 dan menambah var
 ### Dataset 3 — SciDB (China Agricultural Dataset)
 > 🔗 https://www.scidb.cn/en/detail?dataSetId=19536c73f6d74946a212719a94f53ab3
 
-Dataset dengan label berbahasa Mandarin. Digunakan untuk **menambah variasi data** pada tiga kelas utama. Pemetaan label dilakukan menggunakan file `desc.json` yang disertakan dalam dataset.
+Dataset dengan label berbahasa Mandarin. Digunakan untuk **menambah variasi data** pada tiga kelas utama. Pemetaan label dilakukan menggunakan file `desc.json` yang disertakan dalam dataset. Dataset ini terdiri dari 1.653 pasangan data gambar dan deskripsi teks penyakit daun tanaman. Data gambar dikumpulkan dari berbagai sumber terbuka dan sumber internal, mencakup sembilan jenis penyakit daun. Sementara itu, data teks dibuat melalui anotasi manual berdasarkan literatur dan sumber ilmiah, yang memuat informasi mengenai jenis penyakit, ciri patologis, serta tingkat keparahannya.
 
 | Label Mandarin | Dipetakan ke Label |
 |---|---|

Machine_Learning/validate_onnx_parity.py

@@ -10,10 +10,10 @@ import onnxruntime as ort
 import tensorflow as tf
 from PIL import Image, UnidentifiedImageError
 
-
+# Definisi label kelas sesuai urutan output model klasifikasi
 LABELS = ["Bercak Daun", "Daun Sehat", "Karat Daun", "Hawar Daun"]
 
-
+# Kelas eksepsi kustom untuk menangani ketidaksesuaian akurasi prediksi
 class ParityError(RuntimeError):
     """Raised when Keras and ONNX predictions do not match."""
     pass
@@ -33,16 +33,19 @@ def preprocess_image(image_path, input_size):
     Raises:
         ParityError: If image cannot be loaded or processed.
     """
+    # Penanganan error secara aman saat memuat gambar ke format RGB
     try:
         img = Image.open(image_path).convert("RGB")
     except (FileNotFoundError, UnidentifiedImageError, OSError) as e:
         raise ParityError(f"Failed to load image {image_path}: {e}")
 
+    # Penyesuaian resolusi gambar menggunakan metode interpolasi Bilinear
     try:
         img = img.resize((input_size, input_size), Image.Resampling.BILINEAR)
     except Exception as e:
         raise ParityError(f"Failed to resize image {image_path}: {e}")
 
+    # Konversi ke matriks float32 dan penambahan dimensi batch (1, H, W, C)
     img_array = np.array(img, dtype=np.float32)
     img_batch = np.expand_dims(img_array, axis=0)
 
@@ -60,6 +63,7 @@ def predict_keras(model, image_batch):
     Returns:
         Predictions array (1, num_classes).
     """
+    # Eksekusi inferensi pada model TensorFlow/Keras tanpa log proses
     predictions = model.predict(image_batch, verbose=0)
     return predictions
 
@@ -75,6 +79,7 @@ def predict_onnx(session, image_batch):
     Returns:
         Predictions array (1, num_classes).
     """
+    # Eksekusi inferensi secara dinamis pada model ONNX menggunakan sesi runtime
     input_name = session.get_inputs()[0].name
     predictions = session.run(None, {input_name: image_batch})
     return predictions[0]
@@ -94,14 +99,18 @@ def validate_image(image_path, keras_model, onnx_session, input_size, atol):
     Raises:
         ParityError: If predictions do not match or image cannot be processed.
     """
+    # Menyiapkan tensor gambar untuk pengujian
     img_batch = preprocess_image(image_path, input_size)
 
+    # Mengekstrak matriks probabilitas dari kedua format model
     keras_pred = predict_keras(keras_model, img_batch)
     onnx_pred = predict_onnx(onnx_session, img_batch)
 
+    # Mendapatkan indeks kelas dengan probabilitas tertinggi (Top-1)
     keras_label_idx = np.argmax(keras_pred[0])
     onnx_label_idx = np.argmax(onnx_pred[0])
 
+    # Validasi keselarasan keputusan klasifikasi utama
     if keras_label_idx != onnx_label_idx:
         keras_label = LABELS[keras_label_idx]
         onnx_label = LABELS[onnx_label_idx]
@@ -110,6 +119,7 @@ def validate_image(image_path, keras_model, onnx_session, input_size, atol):
             f"Keras={keras_label}, ONNX={onnx_label}"
         )
 
+    # Validasi selisih nilai desimal probabilitas menggunakan toleransi absolut
     if not np.allclose(keras_pred, onnx_pred, atol=atol):
         max_diff = np.max(np.abs(keras_pred - onnx_pred))
         raise ParityError(
@@ -117,6 +127,7 @@ def validate_image(image_path, keras_model, onnx_session, input_size, atol):
             f"max difference={max_diff:.6e} (atol={atol})"
         )
 
+    # Pencatatan log sistem jika kedua model presisi 100%
     label = LABELS[keras_label_idx]
     logging.info(f"PASS: {image_path} -> {label}")
 
@@ -125,6 +136,7 @@ def main():
     """Validate parity between Keras and ONNX models."""
     logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
 
+    # Inisialisasi parser argumen untuk antarmuka CLI (Command Line Interface)
     parser = argparse.ArgumentParser(
         description="Validate parity between Keras and ONNX models"
     )
@@ -161,6 +173,7 @@ def main():
 
     args = parser.parse_args()
 
+    # Pengecekan eksistensi berkas model sebelum memuat memori
     if not args.keras_model.exists():
         msg = f"Keras model not found at {args.keras_model}"
         logging.error(msg)
@@ -171,15 +184,18 @@ def main():
         logging.error(msg)
         raise FileNotFoundError(msg)
 
+    # Memuat model Keras (tanpa kompilasi agar lebih hemat beban komputasi)
     logging.info(f"Loading Keras model from {args.keras_model}...")
     keras_model = tf.keras.models.load_model(args.keras_model, compile=False)
 
+    # Memuat sesi ONNX dengan penyedia eksekusi CPU murni
     logging.info(f"Loading ONNX model from {args.onnx_model}...")
     onnx_session = ort.InferenceSession(
         str(args.onnx_model),
         providers=["CPUExecutionProvider"],
     )
 
+    # Iterasi pengujian paritas (kesetaraan performa) untuk setiap gambar
     logging.info(f"Validating {len(args.images)} image(s)...")
     for image_path in args.images:
         try:

README.md

@@ -36,7 +36,7 @@ Proyek ini merupakan **Capstone Project** dalam program **Pijak × IBM SkillsBui
 
 | NPM | Nama | Learning Path | Peran |
 |---|---|---|---|
-| APC246D6Y0028 | **Asep Haryana Saputra** | Back-End | Arsitektur sistem, RESTful API, deployment Docker/Cloud, keamanan upload stream |
+| APC246D6Y0028 | **Asep Haryana Saputra** | Back-End | Arsitektur sistem, RESTful API, deployment Nix/Cloud, keamanan upload stream |
 | APC013D6X0081 | **Selly Supriyatin** | Front-End | UI/UX responsif, mekanisme unggah gambar, modul edukasi (rekomendasi obat & penanganan) |
 | APC013D6Y0091 | **Taufik Pathurrohman** | Machine Learning | Data Engineering — ekstraksi dataset, cleaning, augmentasi gambar |
 | APC414D6Y0138 | **Luhung Pandyaska Suyi** | Machine Learning | Model Architecture & Training — CNN, hyperparameter tuning |
@@ -66,8 +66,11 @@ ZeaVis Edu menggunakan **Computer Vision** sebagai asisten edukasi interaktif:
 |---|---|
 | Arsitektur Model | **EfficientNetV2B0** — keseimbangan optimal antara akurasi dan efisiensi parameter |
 | Metode Pelatihan | **Transfer Learning** pada Google Colab (GPU T4) |
-| Sumber Dataset | Kaggle — [Corn Leaf Disease](https://www.kaggle.com/datasets/ndisan/corn-leaf-disease) |
-| Deployment | VPS dengan Docker, ONNX Runtime untuk inferensi real-time |
+| Sumber Dataset 1 | Kaggle — [Corn Leaf Disease](https://www.kaggle.com/datasets/ndisan/corn-leaf-disease) |
+| Sumber Dataset 2 | Kaggle — [Corn or Maize Leaf Disease Dataset](https://www.kaggle.com/datasets/smaranjitghose/corn-or-maize-leaf-disease-dataset) |
+| Sumber Dataset 3 | scidb — [Dataset of Corn Leaf Diseases based on Manual Annotation and Contrast Generation Model](https://www.scidb.cn/en/detail?dataSetId=19536c73f6d74946a212719a94f53ab3) |
+
+| Deployment | VPS dengan Nix + systemd + Caddy, ONNX Runtime untuk inferensi real-time |
 
 ---
 
@@ -98,7 +101,7 @@ ZeaVis Edu menggunakan **Computer Vision** sebagai asisten edukasi interaktif:
 | 1 | **Pengumpulan Data** | Dataset gambar 3 penyakit + 1 daun sehat dari Kaggle beserta pelabelan |
 | 2 | **Model ML** | Model Computer Vision terlatih di Google Colab, siap produksi |
 | 3 | **UI Antarmuka** | Front-End berbasis React + Vite dengan fitur unggah gambar |
-| 4 | **Back-End Integration** | API + ML Service untuk inferensi real-time via Docker |
+| 4 | **Back-End Integration** | API + ML Service untuk inferensi real-time via Nix + systemd |
 | 5 | **Prototipe Akhir** | Aplikasi Web + Android (Tauri 2) dengan klasifikasi & modul edukasi (rekomendasi obat & penanganan) |
 
 ---
@@ -120,7 +123,7 @@ ZeaVis Edu menggunakan **Computer Vision** sebagai asisten edukasi interaktif:
 | Risiko | Solusi |
 |---|---|
 | **Overfitting akibat imbalanced data** | Augmentasi tingkat lanjut (kecerahan, noise, rotasi) + confidence threshold < 75% → minta user foto ulang |
-| **Server downtime / latensi tinggi** | Batasan upload ≤ 5 MB + kompresi server-side + rate limiting + container Docker isolasi resource |
+| **Server downtime / latensi tinggi** | Batasan upload ≤ 5 MB + kompresi server-side + rate limiting + isolasi resource per-service (systemd) |
 | **Foto blur / objek bukan daun jagung** | Panduan visual (overlay) pada UI + validasi anomali + disclaimer "alat bantu edukasi, bukan pengganti POPT" |
 | **Bottleneck integrasi ML ↔ API ↔ UI** | API Contract ketat di minggu ke-1 + integrasi bertahap (CI) mulai minggu ke-3 |
 
@@ -141,7 +144,7 @@ ZeaVis Edu menggunakan **Computer Vision** sebagai asisten edukasi interaktif:
 │   └── README.md             # ⤷ Panduan deployment multi-VPS
 ├── packages/shared/          # Tipe & utilitas TypeScript bersama
 ├── telemetry/                # Submodule — Prometheus → ClickHouse pipeline
-├── docker-compose.yml        # Konfigurasi deployment container
+├── flake.nix                 # Konfigurasi deployment Nix (systemd services)
 ├── package.json              # Root workspace Bun + Moon
 └── README.md                 # ⤷ Anda di sini
 ```
@@ -153,7 +156,7 @@ ZeaVis Edu menggunakan **Computer Vision** sebagai asisten edukasi interaktif:
 | API Backend | Bun, Elysia, Drizzle ORM, PostgreSQL | `apps/api/` |
 | ML Inference Engine | Rust, Axum, ONNX Runtime | [`apps/ml-service/README.md`](apps/ml-service/README.md) |
 | ML Pipeline | Python, TensorFlow/Keras, EfficientNetV2B0 | [`Machine_Learning/README.md`](Machine_Learning/README.md) |
-| Infrastruktur | Docker, Coolify, Traefik, Tailscale | [`infra/README.md`](infra/README.md) |
+| Infrastruktur | Nix, systemd, Caddy, Tailscale | [`infra/README.md`](infra/README.md) |
 | Telemetry | Prometheus, ClickHouse, Vector, Vue 3 | `telemetry/` |
 
 ---
@@ -174,7 +177,7 @@ Python &bull; TensorFlow/Keras &bull; EfficientNetV2B0 &bull; Google Colab (GPU
 **Rust** &bull; **Axum** &bull; **ONNX Runtime** &bull; TFLite &bull; TensorFlow.js
 
 ### DevOps & Infrastruktur
-Docker &bull; Docker Compose &bull; Coolify &bull; Traefik &bull; Tailscale &bull; GitHub Actions (CI/CD)
+Nix &bull; systemd &bull; Caddy &bull; Tailscale &bull; GitHub Actions (CI/CD)
 
 ### Observabilitas
 Prometheus &bull; Metric Ingester (Go) &bull; Vector &bull; ClickHouse &bull; Query Proxy (Go) &bull; Telemetry UI (Vue 3)
@@ -189,8 +192,8 @@ Prometheus &bull; Metric Ingester (Go) &bull; Vector &bull; ClickHouse &bull; Qu
 - **Python 3.9–3.11** — pipeline ML
 - **Rust & Cargo** — `apps/ml-service` (inference) & `apps/tauri` (Android)
 - **Java 21 + Android SDK** — build Android APK
-- **Docker & Docker Compose** — deployment & telemetry
-- **PostgreSQL** — backend API
+- **Nix** — build & deployment produksi (flake.nix, systemd services)
+- **PostgreSQL (Neon)** — backend API (via pgbouncer pool imrnes `100.121.180.82:6432`)
 
 ### Instalasi
 
@@ -206,7 +209,7 @@ bun install
 bun run dev                # Semua service (web + api)
 cd apps/web && bun run dev # Hanya frontend
 cd apps/api && bun run start # Hanya backend API
-cd apps/ml-service && cargo run  # ML inference engine (port 8000)
+cd apps/ml-service && cargo run  # ML inference engine (port 4012)
 cd apps/tauri && bun run tauri dev        # Tauri desktop dev
 cd apps/tauri && bun run tauri android dev  # Tauri Android dev
 ```
@@ -236,9 +239,14 @@ Salin `.env.example` ke `.env` dan isi:
 
 ### Deployment
 
+Produksi: **Nix + systemd + Caddy** (Docker sudah dihapus dari produksi 2026-08-02).
+Deploy via GitHub Actions → `nix build .#<service>` → `nix copy ssh://imrnes` → `systemctl restart zeavis-<service>`.
+Reverse proxy: Caddy 2.11.4 (`systemd caddy.service`, auto-TLS Let's Encrypt, HTTP/3).
+
 ```bash
-docker compose up -d       # App services
-make telemetry-up          # Telemetry stack
+# Port produksi: zeavis-api 4006, zeavis-web (nginx) 4011, zeavis-ml 4012
+# Database: Neon via pgbouncer pool imrnes 100.121.180.82:6432
+make telemetry-up          # Telemetry stack (dev/local)
 ```
 
 > 📖 **Panduan infrastruktur:** [`infra/README.md`](infra/README.md)
@@ -304,7 +312,7 @@ bun run tauri android build --apk # Build APK production
 | `bun install` gagal | `bun --version` — pastikan ≥ 1.x |
 | API perlu database | Isi `DATABASE_URL` di root `.env` |
 | ML service gagal muat model | `ls Machine_Learning/model/model.onnx` — jalankan pipeline ML jika belum ada |
-| Docker Compose gagal | `docker network create app-shared-net` |
+| Service tidak restart setelah deploy | `systemctl restart zeavis-api zeavis-web zeavis-ml` (Nix+systemd, bukan Docker) |
 | Konversi TFJS gagal | `export PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python` |
 
 ---

apps/api/Dockerfile

@@ -11,7 +11,7 @@ RUN bun install --production
 FROM oven/bun:1.3.14 AS runner
 WORKDIR /app
 ENV NODE_ENV=production
-ENV API_PORT=3000
+ENV API_PORT=4006
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=deps /app/apps/api/node_modules apps/api/node_modules
@@ -20,5 +20,5 @@ COPY package.json bunfig.toml tsconfig.base.json ./
 COPY apps/api apps/api
 COPY packages/shared packages/shared
 
-EXPOSE 3000
+EXPOSE 4006
 CMD ["bun", "apps/api/src/index.ts"]

apps/api/drizzle.config.ts

@@ -5,6 +5,6 @@ export default defineConfig({
   out: './drizzle',
   dialect: 'postgresql',
   dbCredentials: {
-    url: process.env.DATABASE_URL ?? 'postgres://postgres:postgres@localhost:5432/zeavis_edu',
+    url: process.env.DATABASE_URL ?? 'postgres://asephs:***@100.121.180.82:6432/zeavis_edu',
   },
 });

apps/api/src/config/env.ts

@@ -18,7 +18,7 @@ const allowedOrigins = [
 const secureCookies = Bun.env.SECURE_COOKIES === 'true' || webAppUrl.startsWith('https://');
 
 export const env = {
-  port: Number(Bun.env.API_PORT ?? 3000),
+  port: Number(Bun.env.API_PORT ?? 4006),
   databaseUrl: Bun.env.DATABASE_URL,
   sessionSecret: Bun.env.SESSION_SECRET,
   uploaderBaseUrl: Bun.env.UPLOADER_BASE_URL ?? 'https://upload.asepharyana.my.id',

apps/ml-service/.env.example

@@ -1,4 +1,4 @@
 MODEL_PATH=../../Machine_Learning/model/model.onnx
 MODEL_INPUT_SIZE=224
 ML_SERVICE_HOST=0.0.0.0
-ML_SERVICE_PORT=8001
+ML_SERVICE_PORT=4012

apps/ml-service/Dockerfile

@@ -11,7 +11,7 @@ WORKDIR /app
 ENV MODEL_PATH=/app/model/model.onnx
 ENV MODEL_INPUT_SIZE=224
 ENV ML_SERVICE_HOST=0.0.0.0
-ENV ML_SERVICE_PORT=8000
+ENV ML_SERVICE_PORT=4012
 ENV RUST_LOG=info
 
 RUN pacman -Syu --noconfirm ca-certificates 2>/dev/null
@@ -19,5 +19,5 @@ RUN pacman -Syu --noconfirm ca-certificates 2>/dev/null
 COPY --from=builder /app/target/release/zeavis-ml-service /usr/local/bin/zeavis-ml-service
 COPY Machine_Learning/model/model.onnx /app/model/model.onnx
 
-EXPOSE 8000
+EXPOSE 4012
 CMD ["zeavis-ml-service"]

apps/ml-service/README.md

@@ -48,7 +48,7 @@ Output build lokal berada di `target/` dan direktori tersebut diabaikan oleh Git
 
 Semua perintah di bawah dijalankan dari direktori `apps/ml-service`.
 
-### Opsi 1: Default (Port 8000)
+### Opsi 1: Default (Port 4012)
 
 ```bash
 cargo run
@@ -59,7 +59,7 @@ Service akan mencari model di path default:
 ../../Machine_Learning/model/model.onnx
 ```
 
-### Opsi 2: Local Development dengan .env.example (Port 8001)
+### Opsi 2: Local Development dengan .env.example (Port 4012)
 
 ```bash
 source .env.example
@@ -79,7 +79,7 @@ ML_SERVICE_PORT=9000 MODEL_PATH=/path/to/model.onnx cargo run
 | Variable | Default | Keterangan |
 |---|---|---|
 | `ML_SERVICE_HOST` | `0.0.0.0` | Bind address |
-| `ML_SERVICE_PORT` | `8000` | Bind port |
+| `ML_SERVICE_PORT` | `4012` | Bind port |
 | `MODEL_PATH` | `../../Machine_Learning/model/model.onnx` | Path ke file model ONNX |
 | `MODEL_INPUT_SIZE` | `224` | Ukuran input gambar (224×224 untuk EfficientNetV2B0) |
 | `RUST_LOG` | `info` | Level logging (debug, info, warn, error) |
@@ -91,7 +91,7 @@ ML_SERVICE_PORT=9000 MODEL_PATH=/path/to/model.onnx cargo run
 ### Health Check
 
 ```bash
-curl http://localhost:8000/health
+curl http://localhost:4012/health
 ```
 
 ```json
@@ -104,7 +104,7 @@ curl http://localhost:8000/health
 ### Metadata
 
 ```bash
-curl http://localhost:8000/metadata
+curl http://localhost:4012/metadata
 ```
 
 ```json
@@ -123,7 +123,7 @@ curl http://localhost:8000/metadata
 Upload gambar daun jagung untuk klasifikasi:
 
 ```bash
-curl -X POST http://localhost:8000/predict \
+curl -X POST http://localhost:4012/predict \
   -F "file=@/path/to/corn-leaf.jpg"
 ```
 
@@ -157,20 +157,20 @@ cargo build --release
 cargo test
 ```
 
-### Verifikasi Manual (default port 8000)
+### Verifikasi Manual (default port 4012)
 
 ```bash
 # 1. Start service
 cargo run
 
 # 2. Health check
-curl http://localhost:8000/health
+curl http://localhost:4012/health
 
 # 3. Metadata
-curl http://localhost:8000/metadata
+curl http://localhost:4012/metadata
 
 # 4. Prediksi
-curl -X POST http://localhost:8000/predict \
+curl -X POST http://localhost:4012/predict \
   -F "file=@../../Machine_Learning/dataset/Daun\ Sehat/sample.jpg"
 ```
 
@@ -182,7 +182,7 @@ Service dapat di-deploy via Docker. Build dari root repository karena Dockerfile
 
 ```bash
 docker build -f apps/ml-service/Dockerfile -t zeavis-ml-service .
-docker run -p 8000:8000 zeavis-ml-service
+docker run -p 4012:4012 zeavis-ml-service
 ```
 
 Pastikan `Machine_Learning/model/model.onnx` sudah dibuat sebelum build image.
@@ -210,7 +210,7 @@ MODEL_PATH=/absolute/path/to/model.onnx cargo run
 ```bash
 ML_SERVICE_PORT=9000 cargo run
 # Cek port yang digunakan:
-lsof -i :8000
+lsof -i :4012
 ```
 
 ### ONNX Runtime tidak kompatibel

apps/ml-service/src/config.rs

@@ -30,7 +30,7 @@ impl Config {
 
     pub fn from_env_with_base_dir(base_dir: &Path) -> Result<Self> {
         let host = env::var("ML_SERVICE_HOST").unwrap_or_else(|_| "0.0.0.0".to_string());
-        let port = parse_env_u16("ML_SERVICE_PORT", 8000)?;
+        let port = parse_env_u16("ML_SERVICE_PORT", 4012)?;
         let input_size = parse_env_u32("MODEL_INPUT_SIZE", DEFAULT_INPUT_SIZE)?;
         let model_path = env::var("MODEL_PATH").unwrap_or_else(|_| DEFAULT_MODEL_PATH.to_string());
         let temperature = parse_env_f32("MODEL_TEMPERATURE", DEFAULT_TEMPERATURE)?;
@@ -116,7 +116,7 @@ mod tests {
                 let config = Config::from_env_with_base_dir(Path::new("/repo/apps/ml-service")).unwrap();
 
                 assert_eq!(config.host, "0.0.0.0");
-                assert_eq!(config.port, 8000);
+                assert_eq!(config.port, 4012);
                 assert_eq!(config.input_size, 224);
                 assert_eq!(
                     config.model_path,

apps/web/nginx.conf

@@ -5,7 +5,7 @@ server {
   index index.html;
 
   location /api/ {
-    proxy_pass http://zeavis-api:3000/api/;
+    proxy_pass http://zeavis-api:4006/api/;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -14,7 +14,7 @@ server {
 
   # Expose API metrics through the web endpoint (Prometheus scrape target)
   location /metrics {
-    proxy_pass http://zeavis-api:3000/metrics;
+    proxy_pass http://zeavis-api:4006/metrics;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

apps/web/src/pages/telemetry-page.tsx

@@ -225,25 +225,25 @@ export function TelemetryPage() {
         queryInstant(`rate(node_network_receive_bytes_total{instance="${INST}:9100",device="eth0"}[5m])`),
         queryInstant(`rate(node_network_transmit_bytes_total{instance="${INST}:9100",device="eth0"}[5m])`),
         // API
-        queryInstant(`zeavis_api_http_requests_total{instance="${INST}:3000"}`),
-        queryInstant(`zeavis_api_http_requests_active{instance="${INST}:3000"}`),
-        queryInstant(`zeavis_api_http_request_duration_seconds_sum{instance="${INST}:3000"} / zeavis_api_http_request_duration_seconds_count{instance="${INST}:3000"}`),
-        queryRange(`zeavis_api_http_requests_total{instance="${INST}:3000"}`, 60),
-        queryRange(`zeavis_api_http_request_duration_seconds_sum{instance="${INST}:3000"} / zeavis_api_http_request_duration_seconds_count{instance="${INST}:3000"}`, 60),
+        queryInstant(`zeavis_api_http_requests_total{instance="${INST}:4006"}`),
+        queryInstant(`zeavis_api_http_requests_active{instance="${INST}:4006"}`),
+        queryInstant(`zeavis_api_http_request_duration_seconds_sum{instance="${INST}:4006"} / zeavis_api_http_request_duration_seconds_count{instance="${INST}:4006"}`),
+        queryRange(`zeavis_api_http_requests_total{instance="${INST}:4006"}`, 60),
+        queryRange(`zeavis_api_http_request_duration_seconds_sum{instance="${INST}:4006"} / zeavis_api_http_request_duration_seconds_count{instance="${INST}:4006"}`, 60),
         // ML
-        queryInstant(`zeavis_ml_zeavis_ml_model_load_status{instance="${INST}:8000"}`),
+        queryInstant(`zeavis_ml_zeavis_ml_model_load_status{instance="${INST}:4012"}`),
         // NodeJS
-        queryInstant(`nodejs_heap_size_used_bytes{instance="${INST}:3000"}`),
-        queryInstant(`nodejs_heap_size_total_bytes{instance="${INST}:3000"}`),
-        queryInstant(`nodejs_eventloop_lag_seconds{instance="${INST}:3000"}`),
-        queryInstant(`nodejs_active_handles_total{instance="${INST}:3000"}`),
-        queryInstant(`nodejs_active_requests_total{instance="${INST}:3000"}`),
-        queryRange(`nodejs_heap_size_used_bytes{instance="${INST}:3000"}`, 60),
-        queryRange(`nodejs_eventloop_lag_seconds{instance="${INST}:3000"}`, 60),
+        queryInstant(`nodejs_heap_size_used_bytes{instance="${INST}:4006"}`),
+        queryInstant(`nodejs_heap_size_total_bytes{instance="${INST}:4006"}`),
+        queryInstant(`nodejs_eventloop_lag_seconds{instance="${INST}:4006"}`),
+        queryInstant(`nodejs_active_handles_total{instance="${INST}:4006"}`),
+        queryInstant(`nodejs_active_requests_total{instance="${INST}:4006"}`),
+        queryRange(`nodejs_heap_size_used_bytes{instance="${INST}:4006"}`, 60),
+        queryRange(`nodejs_eventloop_lag_seconds{instance="${INST}:4006"}`, 60),
         // Process
-        queryInstant(`rate(process_cpu_seconds_total{instance="${INST}:3000"}[5m])`),
-        queryInstant(`process_resident_memory_bytes{instance="${INST}:3000"}`),
-        queryInstant(`process_open_fds{instance="${INST}:3000"}`),
+        queryInstant(`rate(process_cpu_seconds_total{instance="${INST}:4006"}[5m])`),
+        queryInstant(`process_resident_memory_bytes{instance="${INST}:4006"}`),
+        queryInstant(`process_open_fds{instance="${INST}:4006"}`),
       ]);
 
       setCpuData(cpuR); setMemData(memR); setDiskData(diskR);

apps/web/vite.config.ts

@@ -6,7 +6,7 @@ import { metricsPlugin } from './vite-plugin-metrics';
 
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd(), '');
-  const apiProxyTarget = env.VITE_API_PROXY_TARGET || 'http://localhost:3000';
+  const apiProxyTarget = env.VITE_API_PROXY_TARGET || 'http://localhost:4006';
 
   return {
     plugins: [

docker-compose.yml

@@ -32,21 +32,21 @@ services:
       - app-shared-net
       - telemetry-net
     ports:
-      - "${TS_IP:-0.0.0.0}:3000:3000"
+      - "${TS_IP:-0.0.0.0}:4006:4006"
     env_file:
       - .env
     environment:
       NODE_ENV: production
-      API_PORT: "3000"
+      API_PORT: "4006"
       WEB_APP_URL: https://zeavisedu.asepharyana.my.id
-      ML_SERVICE_URL: ${ML_SERVICE_URL:-http://zeavis-ml:8000}
+      ML_SERVICE_URL: ${ML_SERVICE_URL:-http://zeavis-ml:4012}
     labels:
       traefik.enable: "true"
       traefik.http.routers.zeavis-api.rule: Host(`api-zeavisedu.asepharyana.my.id`)
       traefik.http.routers.zeavis-api.entrypoints: websecure
       traefik.http.routers.zeavis-api.tls: "true"
       traefik.http.routers.zeavis-api.tls.certresolver: cloudflare
-      traefik.http.services.zeavis-api.loadbalancer.server.port: "3000"
+      traefik.http.services.zeavis-api.loadbalancer.server.port: "4006"
 
   # Node Exporter — expose system metrics (CPU, RAM, disk) for Prometheus scraping
   node_exporter:
@@ -73,7 +73,7 @@ services:
       - app-shared-net
       - telemetry-net
     ports:
-      - "${TS_IP:-0.0.0.0}:8000:8000"
+      - "${TS_IP:-0.0.0.0}:4012:4012"
     env_file:
       - .env
     environment:
@@ -85,4 +85,4 @@ services:
       traefik.http.routers.zeavis-ml.entrypoints: websecure
       traefik.http.routers.zeavis-ml.tls: "true"
       traefik.http.routers.zeavis-ml.tls.certresolver: cloudflare
-      traefik.http.services.zeavis-ml.loadbalancer.server.port: "8000"
+      traefik.http.services.zeavis-ml.loadbalancer.server.port: "4012"

docs/superpowers/plans/2026-05-22-api-ml-service-migration.md

@@ -532,3 +532,7 @@ Verified:
 - ML service health: <actual result if run>
 - classifyImage against running ML service: <actual result if run>
 ```
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/plans/2026-05-22-backend-image-classification.md

@@ -631,3 +631,7 @@ Open `/dashboard`. Confirm the image classification form renders. If no database
 - Spec coverage: backend TFJS inference, uploader integration, DB persistence, API routes, shared types, frontend upload/result/history, and verification are covered.
 - Placeholder scan: no TBD/TODO/fill-later placeholders remain; every file and route has explicit behavior.
 - Type consistency: `ImageClassificationRecord`, `PredictionProbability`, and `UploaderMetadata` are defined once in shared and used consistently across API and web.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/plans/2026-05-22-docker-deployment.md

@@ -289,6 +289,8 @@ git commit -m "feat: add ML service Docker image"
 
 ## Task 5: Add production Docker Compose
 
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.
+
 **Files:**
 - Create: `docker-compose.yml`
 

docs/superpowers/plans/2026-05-22-fullstack-education-catalog.md

@@ -802,3 +802,7 @@ If no fixes were required, do not create an empty commit.
 - Spec coverage: shared contract, backend schema/routes, frontend pages/manual flow, error states, and verification are all covered.
 - Placeholder scan: no TBD/TODO/fill-later placeholders are present. Task 4 uses explicit behavior requirements for page files because page markup is lengthy, but all required states and wiring are specified.
 - Type consistency: shared names (`DiseaseSlug`, `DiseaseCatalogItem`, `ManualClassificationRequest`, `ManualClassificationRecord`, `DashboardSummary`) are consistent across tasks.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/plans/2026-05-22-fullstack-monorepo-scaffold.md

@@ -1323,3 +1323,7 @@ git commit -m "Document fullstack app commands"
 - Placeholder scan: no TBD/TODO placeholders are present; deferred features are explicitly listed in the design and not implemented.
 - Type consistency: `AppStatus`, `createAppStatus`, route paths, package names, and project paths are consistent across tasks.
 - Known execution note: Task 4 requires adding `@radix-ui/react-slot` because the shadcn-style `Button` uses `Slot` for `asChild` support.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/plans/2026-05-22-js-ts-dependency-update.md

@@ -197,3 +197,7 @@ Do not claim completion unless the final verification command passed.
 - Spec coverage: The plan updates only JS/TS manifests, regenerates `bun.lock`, allows minimal compatibility refactors, and verifies with `bun run typecheck` and `bun run build`.
 - Placeholder scan: No TODO/TBD placeholders remain.
 - Scope check: Python/ML dependencies are explicitly out of scope and verified unchanged.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/plans/2026-05-22-ml-service.md

@@ -581,3 +581,7 @@ Verified:
 ```
 
 Expected: final response only claims checks that were actually run.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/plans/2026-05-22-production-mvp.md

@@ -2490,3 +2490,7 @@ Spec coverage:
 Red-flag scan: no unresolved planning markers are intentionally present. The only implementation choice left to workers is resolving compile errors revealed by real typecheck output, which must be fixed directly before completing each task.
 
 Type consistency: shared DTO names are introduced first and reused by backend/frontend tasks. Diagnosis status strings match the design spec.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/plans/2026-05-22-root-readme.md

@@ -220,6 +220,8 @@ curl -X POST http://localhost:8001/predict -F "file=@/path/to/corn-leaf.jpg"
 
 ## Docker Deployment
 
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.
+
 File `docker-compose.yml` di root menyiapkan tiga service produksi:
 
 - `web` untuk frontend

docs/superpowers/plans/2026-05-23-rust-onnx-ml-service.md

@@ -1474,6 +1474,8 @@ git commit -m "test: add ONNX parity validation script"
 
 ## Task 10: Update Docker image for Rust ML service
 
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.
+
 **Files:**
 - Modify: `apps/ml-service/Dockerfile`
 

docs/superpowers/specs/2026-05-22-api-ml-service-migration-design.md

@@ -99,3 +99,7 @@ Required verification after implementation:
 - Exercise `classifyImage(file)` against the running ML service with a local image file or synthetic image and confirm it returns `predictedDiseaseSlug`, `confidence`, and sorted probabilities.
 
 If full API route testing is blocked by external database or upload service requirements, report that explicitly and include the lower-level verification evidence.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/specs/2026-05-22-backend-image-classification-design.md

@@ -88,3 +88,7 @@ The implementation should pass:
 - `bun run build`
 
 Manual verification should launch API and web locally, open the dashboard, select an image, submit it, and verify that uploader/model/database success or structured error states render without crashing.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/specs/2026-05-22-docker-deployment-design.md

@@ -48,6 +48,8 @@ Each image will also receive a SHA tag for traceability.
 
 ## Compose deployment
 
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.
+
 The VPS will run `docker compose` from `/opt/ZeaVis-Edu`.
 
 The compose file will define:

docs/superpowers/specs/2026-05-22-fullstack-education-catalog-design.md

@@ -68,3 +68,7 @@ The implementation should pass:
 - `bun run build`
 
 Because this includes frontend behavior, the app should also be launched locally and the main pages/manual flow should be checked in a browser if the environment allows it.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/specs/2026-05-22-fullstack-monorepo-scaffold-design.md

@@ -74,3 +74,7 @@ No test framework is added in this scaffold. Tests should be introduced with the
 - Real dashboard data.
 - Database migrations for domain entities.
 - Deployment configuration.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/specs/2026-05-22-js-ts-dependency-update-design.md

@@ -33,3 +33,7 @@ If either command fails due to dependency updates, fix the underlying compatibil
 - ML pipeline changes
 - UI redesigns or feature additions
 - Database schema changes unless a dependency update requires a generated type/config compatibility fix
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/specs/2026-05-22-ml-service-design.md

@@ -82,3 +82,7 @@ Manual verification for the initial implementation:
 - Call `POST /predict` with a real image file when an example corn leaf image is available.
 
 The repository does not currently have a Python test suite for this new service. Automated tests can be added later if the service grows beyond the initial capstone scope.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/specs/2026-05-22-production-mvp-design.md

@@ -283,3 +283,7 @@ Manual error path:
 2. Call a diagnosis endpoint while logged out and confirm unauthorized response.
 3. Access expert review as a non-expert and confirm forbidden response.
 4. Temporarily omit Google OAuth env and confirm Google login is hidden.
+
+---
+
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.

docs/superpowers/specs/2026-05-23-rust-onnx-ml-service-design.md

@@ -143,6 +143,8 @@ The repository has no existing global test suite, so the Rust service checks bec
 
 ## Documentation and deployment updates
 
+> Catatan (2026-08-02): port produksi sekarang API 4006, nginx 4011, ML 4012; deploy Nix+systemd+Caddy.
+
 Update documentation so runtime serving no longer describes FastAPI/TensorFlow as the production ML service. Keep Python/TensorFlow documentation for training and export.
 
 Update:

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1785301185,
+        "narHash": "sha256-eoS3KQTO0aPWXZvIaRbRAzSSHW3l5wdMFXtT1ISfoKA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9bc02893134c733dd85de46ee4fb2fac696b5529",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,145 @@
+{
+  description = "ZeaVis Edu — Bun API + Rust ML + Vite web (Nix build)";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachSystem [ "x86_64-linux" ] (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+      in
+      {
+        packages = {
+          # ── API: Bun + Elysia + Drizzle (workspace) ────────────────
+          api = pkgs.stdenvNoCC.mkDerivation {
+            pname = "zeavis-api";
+            version = "0.1.0";
+            src = ./.;
+            nativeBuildInputs = [ pkgs.bun ];
+
+            buildPhase = ''
+              export HOME="$TMPDIR"
+              bun install --frozen-lockfile
+              bun run --cwd packages/shared build
+            '';
+
+            installPhase = ''
+              mkdir -p $out/bin $out/lib/zeavis-api
+              cp -r package.json bun.lock bunfig.toml tsconfig.base.json $out/lib/zeavis-api/
+              cp -r node_modules $out/lib/zeavis-api/node_modules
+              cp -r apps $out/lib/zeavis-api/apps
+              cp -r packages $out/lib/zeavis-api/packages
+              cat > $out/bin/zeavis-api << WRAPPER
+#!${pkgs.runtimeShell}
+cd $out/lib/zeavis-api
+exec ${pkgs.bun}/bin/bun apps/api/src/index.ts
+WRAPPER
+              chmod +x $out/bin/zeavis-api
+            '';
+          };
+
+          # ── ML Service: Rust (axum + ort/onnxruntime) ──────────────
+          ml-service = pkgs.stdenv.mkDerivation {
+            pname = "zeavis-ml-service";
+            version = "0.1.0";
+            src = ./.;
+            nativeBuildInputs = [ pkgs.rustc pkgs.cargo pkgs.pkg-config pkgs.cacert ];
+            buildInputs = [ pkgs.openssl ];
+
+            buildPhase = ''
+              export HOME="$TMPDIR" CARGO_HOME="$TMPDIR/.cargo"
+              export SRC_ROOT="$PWD"
+              cd apps/ml-service
+              cargo build --locked --release
+            '';
+
+            installPhase = ''
+              cd "$SRC_ROOT"
+              mkdir -p $out/bin $out/share/zeavis-ml
+              cp apps/ml-service/target/release/zeavis-ml-service $out/bin/.zeavis-ml-service
+              cp Machine_Learning/model/model.onnx $out/share/zeavis-ml/model.onnx
+              cat > $out/bin/zeavis-ml-service << WRAPPER
+#!${pkgs.runtimeShell}
+export MODEL_PATH="$out/share/zeavis-ml/model.onnx"
+export MODEL_INPUT_SIZE="224"
+export ML_SERVICE_HOST="0.0.0.0"
+export ML_SERVICE_PORT="4012"
+export RUST_LOG="info"
+exec $out/bin/.zeavis-ml-service
+WRAPPER
+              chmod +x $out/bin/zeavis-ml-service
+            '';
+          };
+
+          # ── Web: Vite static + nginx ───────────────────────────────
+          web = pkgs.stdenvNoCC.mkDerivation {
+            pname = "zeavis-web";
+            version = "0.1.0";
+            src = ./.;
+            nativeBuildInputs = [ pkgs.bun ];
+
+            buildPhase = ''
+              export HOME="$TMPDIR"
+              bun install --frozen-lockfile
+              bun run --cwd packages/shared build
+              bun run --cwd apps/web build
+            '';
+
+            installPhase = ''
+              mkdir -p $out/bin $out/etc $out/share/zeavis-web/html
+              cp -r apps/web/dist/* $out/share/zeavis-web/html/
+              cat > $out/etc/nginx.conf << CONF
+error_log /var/lib/zeavis-web/nginx-error.log;
+pid /var/lib/zeavis-web/nginx.pid;
+events {}
+http {
+  include ${pkgs.nginx}/conf/mime.types;
+  access_log /var/lib/zeavis-web/nginx-access.log;
+  server {
+    listen 4011;
+    server_name _;
+    root $out/share/zeavis-web/html;
+    index index.html;
+
+    location /api/ {
+      proxy_pass http://127.0.0.1:4006/api/;
+      proxy_set_header Host \$host;
+      proxy_set_header X-Real-IP \$remote_addr;
+      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+
+    location /metrics {
+      proxy_pass http://127.0.0.1:4006/metrics;
+      proxy_set_header Host \$host;
+      proxy_set_header X-Real-IP \$remote_addr;
+      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto \$scheme;
+    }
+
+    location / {
+      try_files \$uri \$uri/ /index.html;
+    }
+  }
+}
+CONF
+              cat > $out/bin/zeavis-web << WRAPPER
+#!${pkgs.runtimeShell}
+mkdir -p /var/lib/zeavis-web
+exec ${pkgs.nginx}/bin/nginx -c $out/etc/nginx.conf -p /var/lib/zeavis-web -g "daemon off;"
+WRAPPER
+              chmod +x $out/bin/zeavis-web
+            '';
+          };
+
+          default = self.packages.${system}.api;
+        };
+
+        devShells.default = pkgs.mkShell {
+          buildInputs = [ pkgs.bun pkgs.nodejs_22 pkgs.rustc pkgs.cargo ];
+        };
+      });
+}

infra/README.md

@@ -1,6 +1,8 @@
 # Infrastruktur — ZeaVis Edu
 
 > Arsitektur multi-VPS untuk deployment produksi ZeaVis Edu dengan Tailscale mesh VPN dan observabilitas penuh.
+>
+> > **Catatan (2026-08-02):** Produksi kini memakai **Nix + systemd + Caddy 2.11.4** (Docker/Traefik/Coolify dihapus). Deploy: GitHub Actions → `nix build` → `nix copy ssh://` → `systemctl restart`.
 
 ← [Kembali ke README utama](../README.md)
 
@@ -24,12 +26,12 @@ ZeaVis Edu berjalan di **dua VPS terpisah** yang terhubung melalui **Tailscale**
 ```
 ┌─────────────────────────────────────────────┐     ┌──────────────────────────────────────────────┐
 │              App VPS (imrnes)               │     │         Telemetry VPS (orange)                │
-│             100.108.1.124                   │     │         100.96.248.86                        │
+│             100.121.180.82                   │     │         100.96.248.86                        │
 │             Arch Linux                      │     │         Ubuntu                               │
 │                                             │     │                                              │
 │  ┌──────────┐  ┌──────────┐  ┌──────────┐  │     │  ┌──────────┐  ┌──────────────┐             │
 │  │  Web     │  │  API     │  │  ML      │  │     │  │Prometheus│  │Metric        │             │
-│  │:80       │  │:3000     │  │:8000     │  │     │  │:9090     │  │Ingester      │             │
+│  │:4011     │  │:4006     │  │:4012     │  │     │  │:9090     │  │Ingester      │             │
 │  │/metrics  │  │/metrics  │  │/metrics  │  │     │  │          │  │:9091         │             │
 │  └──────────┘  └──────────┘  └──────────┘  │     │  └────┬─────┘  └──────┬───────┘             │
 │  ┌──────────────────────────────────────┐  │     │       │               │                     │
@@ -38,8 +40,8 @@ ZeaVis Edu berjalan di **dua VPS terpisah** yang terhubung melalui **Tailscale**
 │  └──────────────────────────────────────┘  │     │  ┌──────────────────────────────────────┐   │
 │                                             │     │  │          Vector                      │   │
 │     ┌──────────────┐                        │     │  │          :9001                       │   │
-│     │   Traefik    │                        │     │  └────────────────┬─────────────────────┘   │
-│     │ (Coolify)    │                        │     │                   │                         │
+│     │    Caddy     │                        │     │  └────────────────┬─────────────────────┘   │
+│     │  2.11.4      │                        │     │                   │                         │
 │     └──────────────┘                        │     │                   ▼                         │
 │                                             │     │  ┌──────────────────────────────────────┐   │
 │  ZeaVis Edu Apps via                        │     │  │           ClickHouse                  │   │
@@ -58,14 +60,14 @@ ZeaVis Edu berjalan di **dua VPS terpisah** yang terhubung melalui **Tailscale**
 │                                             │     │  │      :8181                          │   │
 │                                             │     │  └──────────────────────────────────────┘   │
 │                                             │     │                                              │
-│                                             │     │  Coolify + Traefik handles:                 │
-│                                             │     │  telemetry.zeavisedu.asepharyana.my.id       │
+│                                             │     │  Caddy handles:                          │
+│                                             │     │  telemetry.zeavisedu.asepharyana.my.id    │
 └─────────────────────────────────────────────┘     └──────────────────────────────────────────────┘
 ```
 
 | VPS | Hostname | OS | Peran |
 |---|---|---|---|
-| **App VPS** | `imrnes` | Arch Linux | Web (:80), API (:3000), ML Service (:8000) |
+| **App VPS** | `imrnes` | Arch Linux | Web nginx (:4011), API (:4006), ML Service (:4012) |
 | **Telemetry VPS** | `orange` | Ubuntu | Prometheus, ClickHouse, Telemetry UI |
 
 ---
@@ -76,7 +78,7 @@ ZeaVis Edu berjalan di **dua VPS terpisah** yang terhubung melalui **Tailscale**
 
 | Secret | Keterangan |
 |---|---|
-| `VPS_HOST` | `100.108.1.124` (imrnes) |
+| `VPS_HOST` | `100.121.180.82` (imrnes) |
 | `VPS_USER` | `mytheclipse` |
 | `VPS_SSH_KEY` | Private SSH key untuk imrnes |
 | `VPS_PORT` | `22` |
@@ -97,14 +99,12 @@ ZeaVis Edu berjalan di **dua VPS terpisah** yang terhubung melalui **Tailscale**
 
 ## 3. Setup VPS
 
-### App VPS (imrnes — 100.108.1.124)
+### App VPS (imrnes — 100.121.180.82)
 
 ```bash
-# Create Docker network
-docker network create app-shared-net
-docker network create telemetry-net
-
-# ZeaVis Edu apps deploy automatically via GitHub Actions
+# Semua service dikelola Nix + systemd — deploy otomatis via GitHub Actions:
+#   nix build .#<service> → nix copy ssh://imrnes → systemctl restart zeavis-<service>
+# Reverse proxy: Caddy 2.11.4 (systemd caddy.service, /etc/caddy/Caddyfile, auto-TLS LE)
 ```
 
 ### Telemetry VPS (orange — 100.96.248.86)
@@ -113,10 +113,8 @@ Deploy via GitHub Actions atau manual:
 
 ```bash
 ssh mytheclipse@100.96.248.86
-mkdir -p /opt/telemetry
-cd /opt/telemetry
-docker compose up -d
-bash clickhouse/init.sh
+# Telemetry stack juga Nix + systemd (Docker dihapus dari produksi 2026-08-02)
+# Deploy otomatis via GitHub Actions → nix build → nix copy ssh:// → systemctl restart
 ```
 
 ---
@@ -127,16 +125,17 @@ bash clickhouse/init.sh
 
 | Port | Service | Akses |
 |---|---|---|
-| 80/443 | Web (via Traefik/Coolify) | Public |
-| 3000 | API metrics | Tailscale-only |
-| 8000 | ML service metrics | Tailscale-only |
+| 80/443 | Web entry (Caddy, auto-TLS LE) | Public |
+| 4011 | Web nginx (`zeavisedu.asepharyana.my.id`) | Public (via Caddy) |
+| 4006 | API metrics (zeavis-api) | via Caddy / Tailscale-only |
+| 4012 | ML service metrics (zeavis-ml) | Tailscale-only |
 | 9100 | Node Exporter | Tailscale-only |
 
 ### Telemetry VPS (orange)
 
 | Port | Service | Akses |
 |---|---|---|
-| 80/443 | Telemetry UI (via Coolify Traefik) | Public |
+| 80/443 | Telemetry UI (via Caddy) | Public |
 | 8181 | Telemetry UI (direct) | Tailscale-only |
 | 9090 | Prometheus | Tailscale-only |
 | 9091 | Metric Ingester | Tailscale-only |
@@ -149,7 +148,7 @@ bash clickhouse/init.sh
 ## 5. Metrics Flow
 
 1. **App services** mengekspos `GET /metrics` di port masing-masing
-2. **Prometheus** di orange VPS scrape via Tailscale IP (`100.108.1.124:PORT`)
+2. **Prometheus** di orange VPS scrape via Tailscale IP (`100.121.180.82:PORT`)
 3. Prometheus forward ke **Metric Ingester** via `remote_write`
 4. Metric Ingester enrich → filter → forward ke **Vector**
 5. Vector buffer → write ke **ClickHouse**