chore: update hub to c891439857df

chore(deps): bump actions/checkout from 6 to 7 in the github-actions group

.github/workflows/flakehub-publish-rolling.yaml

@@ -12,7 +12,7 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: DeterminateSystems/determinate-nix-action@main
       - uses: DeterminateSystems/flakehub-push@main
         with:

.github/workflows/nix-build.yml

@@ -82,3 +82,22 @@ jobs:
           ssh "$VPS_USER@$VPS_HOST" "sudo systemctl restart ${{ matrix.service }}" || echo "  ⚠️ restart failed (may not be enabled yet)"
 
           echo "✅ ${{ matrix.service }} deployed"
+
+  cleanup:
+    # Bersihkan sampah Nix di VPS SETELAH deploy: hapus generasi profile lama
+    # + nix store gc. Profil yang sedang dipakai tidak disentuh.
+    needs: build-and-deploy
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Nix GC on VPS
+        env:
+          VPS_HOST: ${{ secrets.VPS_HOST }}
+          VPS_USER: ${{ secrets.VPS_USER }}
+          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+          ssh "$VPS_USER@$VPS_HOST" "sudo /usr/local/bin/nix-gc-vps.sh" || echo "⚠️ Nix GC gagal (non-fatal)"

infra/caddy/Caddyfile.prod

@@ -40,6 +40,14 @@ asepharyana.my.id, www.asepharyana.my.id, asepharyana.web.id, www.asepharyana.we
 }
 
 dashboard.asepharyana.my.id {
+	import proxy 4013
+}
+
+imphnen.asepharyana.my.id {
+	import proxy 4009
+}
+
+scraper.asepharyana.my.id, api.asepharyana.my.id, scraper.asepharyana.web.id, api.asepharyana.web.id {
 	import proxy 4091
 }
 
@@ -53,7 +61,23 @@ tools.asepharyana.my.id, tools.asepharyana.web.id {
 
 9router.asepharyana.my.id {
 	# LLM streaming: 9router combo models punya TTFT sampe 30-40s (deepseek,
-}
+	# fallback chain). Default (proxy) response_header_timeout 30s / read 60s
+	# bikin false-positive 504 walau 9router masih ngolah. Longgarkan khusus
+	# biar health-check & request PR-Agent real gak kena timeout transient.
+	encode zstd gzip
+	header {
+		-Server
+		X-Content-Type-Options "nosniff"
+	}
+	reverse_proxy 127.0.0.1:4014 {
+		transport http {
+			dial_timeout 3s
+			response_header_timeout 120s
+			read_timeout 300s
+			write_timeout 300s
+		}
+	}
+}
 
 pr-agent.asepharyana.my.id {
 	import proxy 4002
@@ -80,26 +104,21 @@ ml-zeavisedu.asepharyana.my.id {
 }
 
 upload.asepharyana.my.id, upload.asepharyana.web.id {
-	import proxy 4013
-}
-
-imphnen.asepharyana.my.id {
-	import proxy 4009
-}
-
-upload.asepharyana.my.id, upload.asepharyana.web.id {
 	# Upload/download besar: JANGAN kompres, JANGAN limit body, flush instan (no buffering)
-	reverse_proxy 127.0.0.1:4000 {
-		transport http {
-			keepalive 120s
-			keepalive_interval 30s
-			max_conns_per_host 100
-			dial_timeout 3s
-		}
-		flush_interval -1
-	}
+	header {
+		-Server
+		X-Content-Type-Options "nosniff"
+	}
 	request_body {
 		max_size 0
 	}
 	reverse_proxy 127.0.0.1:4000 {
+		transport http {
+			dial_timeout 3s
+			read_timeout 300s
+			write_timeout 300s
+		}
+		flush_interval -1
+	}
+}
 }

infra/firewall/firewall.sh

@@ -2,10 +2,30 @@
 # ============================================================
 # firewall.sh — deny-by-default firewall untuk orangevps
 # Public: 22 (SSH), 80/443 (Caddy), 4013 (hermes dashboard)
+#         25565 (Minecraft) — WHITELIST TCPShield proxy only
 # Tailscale CGNAT 100.64/10: semua port (imrnes & node lain)
 # Localhost: semua
 # Sisanya: DROP + log
 # ============================================================
+# TCPShield proxy ranges (https://tcpshield.com/v4/ + /v4-cf/)
+# Update saat TCPShield publish range baru.
+TCPSHIELD_V4=(
+  198.178.119.0/24
+  104.234.6.0/24
+)
+TCPSHIELD_V4_CF=(
+  89.222.122.36/31
+  152.233.22.8/31
+  89.222.108.246/31
+  84.17.55.186/31
+  51.79.45.52/31
+  5.135.84.92/30
+  51.75.35.44/30
+  51.161.27.110/31
+  152.233.30.16/31
+  152.233.30.232/31
+  203.205.31.160/31
+)
 set -e
 
 ### IPv4 ###
@@ -33,6 +53,10 @@ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
 iptables -A INPUT -p tcp --dport 443 -j ACCEPT
 # Public: hermes dashboard (auth-protected)
 iptables -A INPUT -p tcp --dport 4013 -j ACCEPT
+# Public: Minecraft (FTB sky) — hanya dari proxy TCPShield
+for cidr in "${TCPSHIELD_V4[@]}" "${TCPSHIELD_V4_CF[@]}"; do
+  iptables -A INPUT -s "$cidr" -p tcp --dport 25565 -j ACCEPT
+done
 
 # ICMP (ping, PMTU)
 iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 10 -j ACCEPT
@@ -66,15 +90,10 @@ ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT
 ip6tables -A INPUT -p tcp --dport 4013 -j ACCEPT
-# ICMPv6/MLD: ping + neighbor discovery (NIC multicast ff02::1 = MLDv2 reports
-# dari host lain; kena LOG+DROP tiap menit — 1800 baris/6h di journal).
-# IPv6 layer-2 discovery WAJIB di-ACCEPT, bukan cuma dropped.
+# Minecraft 25565: TCPShield IPv4 only — tidak ada range IPv6 publik
 ip6tables -A INPUT -p icmpv6 -j ACCEPT
-ip6tables -A INPUT -d ff02::1 -j ACCEPT
-ip6tables -A INPUT -d ff02::2 -j ACCEPT
-ip6tables -A INPUT -d ff02::fb -j ACCEPT
 ip6tables -A INPUT -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "FW6-DROP " --log-level 4
 ip6tables -A INPUT -j DROP
 
 echo "Firewall applied:"
-iptables -L INPUT -n --line-numbers | head -20
+iptables -L INPUT -n --line-numbers | head -24