feat: add Nix flake for reproducible builds and deployment
- Add flake.nix with packages for all 5 apps (landing, gacha, backoffice, dimentorin, hackathon) - Add NixOS modules for deployment (systemd service for Next.js, nginx for Vite apps) - Add mkHackathonWithEnv function for build-time environment variables - Add development shell with Node.js 22, npm, bun 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
maulanasdqn
co-authored by
Claude Opus 4.5
Claude Opus 4.5
parent
f77967a092
commit
5be9ec1edf
@@ -0,0 +1,89 @@
|
||||
# Example: How to use in imphnen-infrastructure
|
||||
#
|
||||
# In your imphnen-infrastructure flake.nix:
|
||||
#
|
||||
# {
|
||||
# inputs = {
|
||||
# nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
# imphnen-frontend = {
|
||||
# url = "github:your-org/imphnen-frontend-service";
|
||||
# # Or use local path during development:
|
||||
# # url = "path:/path/to/imphnen-frontend-service";
|
||||
# };
|
||||
# };
|
||||
#
|
||||
# outputs = { self, nixpkgs, imphnen-frontend, ... }: {
|
||||
# nixosConfigurations.your-server = nixpkgs.lib.nixosSystem {
|
||||
# system = "x86_64-linux";
|
||||
# modules = [
|
||||
# # Import all modules at once
|
||||
# imphnen-frontend.nixosModules.all
|
||||
#
|
||||
# # Or import individually:
|
||||
# # imphnen-frontend.nixosModules.landing
|
||||
# # imphnen-frontend.nixosModules.backoffice
|
||||
#
|
||||
# ./your-server-config.nix
|
||||
# ];
|
||||
# };
|
||||
# };
|
||||
# }
|
||||
#
|
||||
# Then in your-server-config.nix:
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# Enable Landing (Next.js) - runs as systemd service
|
||||
services.imphnen-landing = {
|
||||
enable = true;
|
||||
port = 3000;
|
||||
hostname = "0.0.0.0";
|
||||
openFirewall = true;
|
||||
# environmentFile = /run/secrets/landing-env; # For secrets
|
||||
};
|
||||
|
||||
# Enable Backoffice (Static) - served by nginx
|
||||
services.imphnen-backoffice = {
|
||||
enable = true;
|
||||
domain = "backoffice.imphnen.dev";
|
||||
enableSSL = true;
|
||||
};
|
||||
|
||||
# Enable Gacha (Static)
|
||||
services.imphnen-gacha = {
|
||||
enable = true;
|
||||
domain = "gacha.imphnen.dev";
|
||||
enableSSL = true;
|
||||
};
|
||||
|
||||
# Enable Dimentorin (Static)
|
||||
services.imphnen-dimentorin = {
|
||||
enable = true;
|
||||
domain = "dimentorin.imphnen.dev";
|
||||
enableSSL = true;
|
||||
};
|
||||
|
||||
# Enable Hackathon (Static)
|
||||
services.imphnen-hackathon = {
|
||||
enable = true;
|
||||
domain = "hackathon.imphnen.dev";
|
||||
enableSSL = true;
|
||||
};
|
||||
|
||||
# Nginx reverse proxy for landing (if needed)
|
||||
services.nginx.virtualHosts."imphnen.dev" = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://127.0.0.1:3000";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Enable ACME for SSL
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "admin@imphnen.dev";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
# Next.js Landing App Package
|
||||
{ pkgs, src, npmDepsHash }:
|
||||
|
||||
pkgs.buildNpmPackage {
|
||||
pname = "imphnen-landing";
|
||||
version = "0.0.1";
|
||||
inherit src npmDepsHash;
|
||||
|
||||
nativeBuildInputs = with pkgs; [
|
||||
nodejs_22
|
||||
nodePackages.npm
|
||||
python3 # Required for node-gyp (sharp, etc.)
|
||||
];
|
||||
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
export NX_DAEMON=false
|
||||
export HOME=$TMPDIR
|
||||
npm run landing:build
|
||||
runHook postBuild
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p $out/bin $out/share/landing
|
||||
|
||||
# Copy standalone server
|
||||
cp -r dist/apps/landing/.next/standalone/* $out/share/landing/
|
||||
|
||||
# Copy public assets
|
||||
mkdir -p $out/share/landing/apps/landing/public
|
||||
cp -r dist/apps/landing/public/* $out/share/landing/apps/landing/public/ || true
|
||||
|
||||
# Copy static files
|
||||
mkdir -p $out/share/landing/dist/apps/landing/.next/static
|
||||
cp -r dist/apps/landing/.next/static/* $out/share/landing/dist/apps/landing/.next/static/
|
||||
|
||||
# Create wrapper script
|
||||
cat > $out/bin/imphnen-landing <<EOF
|
||||
#!/usr/bin/env bash
|
||||
cd $out/share/landing
|
||||
exec ${pkgs.nodejs_22}/bin/node apps/landing/server.js "\$@"
|
||||
EOF
|
||||
chmod +x $out/bin/imphnen-landing
|
||||
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
dontNpmBuild = true;
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
# Helper function to build Vite-based static apps
|
||||
{ pkgs, src, npmDepsHash }:
|
||||
|
||||
{ name, buildScript, envVars ? {} }:
|
||||
|
||||
pkgs.buildNpmPackage {
|
||||
pname = "imphnen-${name}";
|
||||
version = "0.0.1";
|
||||
inherit src npmDepsHash;
|
||||
|
||||
nativeBuildInputs = with pkgs; [
|
||||
nodejs_22
|
||||
nodePackages.npm
|
||||
];
|
||||
|
||||
buildPhase = ''
|
||||
runHook preBuild
|
||||
export NX_DAEMON=false
|
||||
export HOME=$TMPDIR
|
||||
${pkgs.lib.concatStringsSep "\n" (pkgs.lib.mapAttrsToList (k: v: "export ${k}=\"${v}\"") envVars)}
|
||||
npm run ${buildScript}
|
||||
runHook postBuild
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p $out
|
||||
cp -r dist/apps/${name}/* $out/
|
||||
runHook postInstall
|
||||
'';
|
||||
|
||||
dontNpmBuild = true;
|
||||
}
|
||||
@@ -0,0 +1,83 @@
|
||||
# NixOS Module for Imphnen Landing
|
||||
{ self }:
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.imphnen-landing;
|
||||
in {
|
||||
options.services.imphnen-landing = {
|
||||
enable = lib.mkEnableOption "Imphnen Landing Page";
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 3000;
|
||||
description = "Port to run the landing server on";
|
||||
};
|
||||
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "0.0.0.0";
|
||||
description = "Hostname to bind to";
|
||||
};
|
||||
|
||||
package = lib.mkOption {
|
||||
type = lib.types.package;
|
||||
default = self.packages.${pkgs.system}.landing;
|
||||
description = "The landing package to use";
|
||||
};
|
||||
|
||||
openFirewall = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open firewall for the landing port";
|
||||
};
|
||||
|
||||
environmentFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
description = "Environment file for secrets";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.services.imphnen-landing = {
|
||||
description = "Imphnen Landing Page";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
|
||||
environment = {
|
||||
NODE_ENV = "production";
|
||||
PORT = toString cfg.port;
|
||||
HOSTNAME = cfg.hostname;
|
||||
};
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "${cfg.package}/bin/imphnen-landing";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5s";
|
||||
|
||||
# Hardening
|
||||
DynamicUser = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
PrivateTmp = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectControlGroups = true;
|
||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
|
||||
RestrictNamespaces = true;
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
} // lib.optionalAttrs (cfg.environmentFile != null) {
|
||||
EnvironmentFile = cfg.environmentFile;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
# NixOS Module for Static Vite Apps (nginx-based)
|
||||
{ self }:
|
||||
|
||||
{ appName }:
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services."imphnen-${appName}";
|
||||
in {
|
||||
options.services."imphnen-${appName}" = {
|
||||
enable = lib.mkEnableOption "Imphnen ${appName}";
|
||||
|
||||
domain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Domain name for the app";
|
||||
};
|
||||
|
||||
package = lib.mkOption {
|
||||
type = lib.types.package;
|
||||
default = self.packages.${pkgs.system}.${appName};
|
||||
description = "The ${appName} package to use";
|
||||
};
|
||||
|
||||
enableSSL = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "Enable ACME SSL";
|
||||
};
|
||||
|
||||
extraLocations = lib.mkOption {
|
||||
type = lib.types.attrsOf lib.types.anything;
|
||||
default = {};
|
||||
description = "Additional nginx locations";
|
||||
};
|
||||
|
||||
extraConfig = lib.mkOption {
|
||||
type = lib.types.lines;
|
||||
default = "";
|
||||
description = "Extra nginx configuration";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
virtualHosts.${cfg.domain} = {
|
||||
forceSSL = cfg.enableSSL;
|
||||
enableACME = cfg.enableSSL;
|
||||
root = cfg.package;
|
||||
|
||||
locations = {
|
||||
"/" = {
|
||||
tryFiles = "$uri $uri/ /index.html";
|
||||
};
|
||||
|
||||
# Cache static assets
|
||||
"~* \\.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$" = {
|
||||
tryFiles = "$uri =404";
|
||||
extraConfig = ''
|
||||
expires 1y;
|
||||
add_header Cache-Control "public, immutable";
|
||||
'';
|
||||
};
|
||||
} // cfg.extraLocations;
|
||||
|
||||
extraConfig = cfg.extraConfig;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user