Auto-merge PR #42

chore(deps-dev): bump @biomejs/biome from 2.5.13 to 2.5.14 in the development group

.github/workflows/deploy.yml

@@ -0,0 +1,132 @@
+name: Deploy Hub
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: hub-deploy
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  VPS_HOST: ${{ secrets.VPS_HOST }}
+  VPS_USER: ${{ secrets.VPS_USER }}
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          determinate: false
+          extra-conf: |
+            sandbox = false
+            accept-flake-config = true
+            # Attic binary cache as substituter on the runner: lets CI pull the
+            # prebuilt attic client (and cached deps/builds) over HTTPS, no SSH.
+            # extra-substituters (NOT extra-trusted-substituters) is required —
+            # Determinate Nix never merges trusted-* for nix-store CLI clients.
+            extra-substituters = https://attic.asepharyana.my.id/asepharyana https://attic.asepharyana.my.id/gmw
+            extra-trusted-public-keys = asepharyana:zBpY6vNI1nDJ4mU6W4q880BB0JB1qb3gRKkO/tGSMiQ= gmw:Fq2Anzuhkb+T/hftWnPcveHSi21/RzIgIOeG8pCJa88=
+
+      - name: Cache Nix
+        uses: DeterminateSystems/magic-nix-cache-action@v14
+        with:
+          use-flakehub: false
+
+      - name: Build hub
+        id: build
+        run: |
+          nix build .#hub --impure --option sandbox false --print-build-logs
+          STORE_PATH=$(readlink result)
+          echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT"
+          echo "Build OK hub: $STORE_PATH"
+
+      - name: Push to Attic cache
+        env:
+          ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+        run: |
+          if [ -z "$ATTIC_TOKEN" ]; then
+            echo "ATTIC_TOKEN not set; skipping attic push"
+            exit 0
+          fi
+          STORE_PATH="${{ steps.build.outputs.store-path }}"
+          ATTIC_DIR="/nix/store/fygyy3yk4rqdknxkiwkqambpnhyax0k4-attic-0.1.0"
+
+          # ── Get an attic client on the runner ────────────────────────────
+          ATTIC_BIN=""
+          if command -v attic >/dev/null 2>&1; then
+            ATTIC_BIN="$(command -v attic)"
+          elif nix-store --realise "$ATTIC_DIR" 2>/tmp/attic-bootstrap.err; then
+            echo "✅ Pulled attic client from attic cache (HTTPS substituter)"
+            ATTIC_BIN="$ATTIC_DIR/bin/attic"
+          else
+            echo "attic client unavailable on runner; skipping attic push (VPS will substitute or fall back)"
+            tail -5 /tmp/attic-bootstrap.err 2>/dev/null || true
+            exit 0
+          fi
+
+          mkdir -p "$HOME/.config/attic"
+          cat > "$HOME/.config/attic/config.toml" <<EOF
+          default-server = "pub"
+
+          [servers.pub]
+          endpoint = "https://attic.asepharyana.my.id"
+          token = "$ATTIC_TOKEN"
+          EOF
+
+          # Retry the direct push — attic push is idempotent.
+          push_ok=""
+          for attempt in 1 2 3; do
+            if "$ATTIC_BIN" push pub:asepharyana "$STORE_PATH" --jobs 4 --ignore-upstream-cache-filter; then
+              echo "✅ Pushed $STORE_PATH to attic directly from runner"
+              push_ok=1
+              break
+            fi
+            echo "⚠️ Direct attic push attempt $attempt/3 failed; retrying in 10s..."
+            sleep 10
+          done
+          if [ -z "$push_ok" ]; then
+            echo "Direct attic push failed after 3 attempts; deploy will fall back to ssh copy"
+          fi
+
+      - name: Setup SSH key
+        env:
+          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          sed -i 's/\r$//' ~/.ssh/id_ed25519
+          ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
+          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Deploy hub to VPS
+        run: |
+          STORE_PATH="${{ steps.build.outputs.store-path }}"
+          echo "=== Realising hub: $STORE_PATH (substitute from attic, fallback ssh copy) ==="
+          if ssh "$VPS_USER@$VPS_HOST" "sudo /nix/var/nix/profiles/default/bin/nix-store --realise '$STORE_PATH'" 2>/dev/null; then
+            echo "Substituted hub from Attic cache"
+          else
+            echo "Attic substitute failed; falling back to ssh copy"
+            nix copy --to "ssh://${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }}" "$STORE_PATH"
+          fi
+
+          echo "=== Updating profile ==="
+          ssh "$VPS_USER@$VPS_HOST" "sudo /nix/var/nix/profiles/default/bin/nix-env --profile /nix/var/nix/profiles/hub --set '$STORE_PATH'"
+
+          echo "=== Restarting service ==="
+          ssh "$VPS_USER@$VPS_HOST" "sudo systemctl restart hub && for i in \$(seq 1 15); do state=\$(systemctl is-active hub 2>/dev/null || echo inactive); [ \"\$state\" = \"active\" ] && break; sleep 2; done; echo \"final-state=\$state\"; [ \"\$state\" = \"active\" ]"
+
+          echo "✅ hub deployed"

.github/workflows/notify-parent.yml

@@ -1,25 +0,0 @@
-name: Notify Parent Repo
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-jobs:
-  dispatch:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger root monorepo build
-        uses: peter-evans/repository-dispatch@v3
-        with:
-          token: ${{ secrets.DISPATCH_TOKEN }}
-          repository: asepharyana/asepharyana-hub
-          event-type: submodule-updated
-          client-payload: |
-            {
-              "service": "hub",
-              "ref": "${{ github.ref }}",
-              "sha": "${{ github.sha }}",
-              "actor": "${{ github.actor }}"
-            }

flake.nix

@@ -0,0 +1,81 @@
+{
+  description = "Asepharyana Hub — personal portfolio SPA (Next.js)";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachSystem [ "x86_64-linux" ] (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          config.allowUnfree = true;
+          overlays = [
+            (self: super: {
+              bun = super.bun.overrideAttrs (old: rec {
+                version = "1.4.0";
+                src = super.fetchzip {
+                  url = "https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip";
+                  sha256 = "sha256:Poy0vf7yJ/hzk33QiQj5gnshI5Q7dfbaMD7xgwiyDKw=";
+                };
+              });
+            })
+          ];
+        };
+
+        hub = pkgs.stdenv.mkDerivation {
+          name = "hub-0.1.0";
+          src = ./.;
+
+          nativeBuildInputs = with pkgs; [ bun nodejs-slim_22 ];
+          buildInputs = with pkgs; [ nodejs openssl stdenv.cc.cc.lib libffi ];
+
+          LIBCLANG_PATH = "${pkgs.libclang.lib}/lib";
+          LD_LIBRARY_PATH = "${pkgs.libclang.lib}/lib:${pkgs.stdenv.cc.cc.lib}/lib:${pkgs.libffi}/lib";
+          NIX_ENFORCE_PURITY = "0";
+
+          SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+          NODE_EXTRA_CA_CERTS = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+          NODE_ENV = "production";
+
+          phases = [ "unpackPhase" "buildPhase" "installPhase" ];
+          buildPhase = ''
+            export HOME="$TMPDIR"
+            echo "=== Installing dependencies ==="
+            bun install 2>&1
+            echo "=== Building Next.js ==="
+            bun run build 2>&1
+          '';
+          installPhase = ''
+            mkdir -p $out/share/hub $out/bin
+            cp -r .next $out/share/hub/
+            cp -r public $out/share/hub/ 2>/dev/null || true
+            cp package.json $out/share/hub/
+            cp next.config.{ts,mjs,js} $out/share/hub/ 2>/dev/null || true
+            cp -r node_modules $out/share/hub/
+            cat > $out/bin/hub << WRAPPER
+#!${pkgs.runtimeShell}
+exec ${pkgs.bun}/bin/bun run --cwd $out/share/hub start
+WRAPPER
+            chmod +x $out/bin/hub
+          '';
+        };
+      in
+      {
+        packages = {
+          inherit hub;
+          default = hub;
+        };
+
+        apps.hub = {
+          type = "app";
+          program = "${hub}/bin/hub";
+        };
+
+        devShells.default = pkgs.mkShell {
+          buildInputs = with pkgs; [ nodejs-slim_22 bun ];
+        };
+      });
+}

package.json

@@ -1,13 +1,20 @@
 {
+  "$schema": "https://json.schemastore.org/package.json",
   "name": "hub",
   "version": "0.1.0",
+  "description": "Asepharyana Hub — personal portfolio SPA (Next.js)",
   "private": true,
+  "packageManager": "bun@1.4.0",
+  "engines": {
+    "bun": ">=1.4.0",
+    "node": ">=22"
+  },
   "scripts": {
-    "dev": "next dev",
     "build": "next build",
-    "start": "next start",
+    "dev": "next dev",
+    "format": "biome format --write",
     "lint": "biome check",
-    "format": "biome format --write"
+    "start": "next start"
   },
   "dependencies": {
     "@base-ui/react": "^1.7.0",
@@ -20,11 +27,11 @@
     "framer-motion": "^13.1.1",
     "input-otp": "^1.5.0",
     "lucide-react": "^1.33.0",
-    "next": "16.3.2",
+    "next": "16.3.5",
     "next-themes": "^0.4.6",
-    "react": "19.2.8",
+    "react": "19.3.0",
     "react-day-picker": "^10.0.1",
-    "react-dom": "19.2.8",
+    "react-dom": "19.3.0",
     "react-resizable-panels": "^4.12.3",
     "recharts": "3.10.1",
     "shadcn": "^4.19.0",
@@ -33,7 +40,7 @@
     "tw-animate-css": "^1.4.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
+    "@biomejs/biome": "2.5.14",
     "@tailwindcss/postcss": "^4",
     "@types/node": "^26",
     "@types/react": "^19",