feat: add Nix flake for reproducible builds and deployment

- Add flake.nix with packages for all 5 apps (landing, gacha, backoffice, dimentorin, hackathon)
- Add NixOS modules for deployment (systemd service for Next.js, nginx for Vite apps)
- Add mkHackathonWithEnv function for build-time environment variables
- Add development shell with Node.js 22, npm, bun

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.envrc

@@ -0,0 +1 @@
+use flake

flake.nix

@@ -0,0 +1,115 @@
+{
+  description = "Imphnen Frontend Service - Nx Monorepo";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs { inherit system; };
+
+        # NPM dependencies hash (update with: nix run nixpkgs#prefetch-npm-deps -- package-lock.json)
+        npmDepsHash = "sha256-dKBi3bM/cpzK70s62tJTI1j/lhVlojAX2IkyNK0oICI=";
+
+        # Import helpers
+        mkViteApp = import ./nix/mkViteApp.nix {
+          inherit pkgs npmDepsHash;
+          src = ./.;
+        };
+
+        landingApp = import ./nix/landing.nix {
+          inherit pkgs npmDepsHash;
+          src = ./.;
+        };
+
+      in {
+        packages = {
+          # Static Vite apps
+          backoffice = mkViteApp { name = "backoffice"; buildScript = "backoffice:build"; };
+          gacha = mkViteApp { name = "gacha"; buildScript = "gacha:build"; };
+          dimentorin = mkViteApp { name = "dimentorin"; buildScript = "dimentorin:build"; };
+          hackathon = mkViteApp { name = "hackathon"; buildScript = "hackathon:build"; };
+
+          # Next.js app
+          landing = landingApp;
+
+          # Default package
+          default = self.packages.${system}.landing;
+        };
+
+        # Development shell
+        devShells.default = pkgs.mkShell {
+          buildInputs = with pkgs; [
+            nodejs_22
+            nodePackages.npm
+            bun
+
+            # Useful dev tools
+            git
+            jq
+          ];
+
+          shellHook = ''
+            echo "🚀 Imphnen Frontend Development Shell"
+            echo "Node.js: $(node --version)"
+            echo "npm: $(npm --version)"
+            echo ""
+            echo "Available commands:"
+            echo "  npm install     - Install dependencies"
+            echo "  nx dev <app>    - Start development server"
+            echo "  nx build <app>  - Build an app"
+            echo ""
+            echo "Apps: landing, backoffice, gacha, dimentorin, hackathon"
+            echo ""
+            echo "Build packages with:"
+            echo "  nix build .#landing"
+            echo "  nix build .#backoffice"
+            echo "  nix build .#gacha"
+            echo "  nix build .#dimentorin"
+            echo "  nix build .#hackathon"
+          '';
+        };
+      }
+    ) // {
+      # NixOS modules for deployment
+      nixosModules = {
+        landing = import ./nix/modules/landing.nix { inherit self; };
+
+        backoffice = import ./nix/modules/static-app.nix { inherit self; } { appName = "backoffice"; };
+        gacha = import ./nix/modules/static-app.nix { inherit self; } { appName = "gacha"; };
+        dimentorin = import ./nix/modules/static-app.nix { inherit self; } { appName = "dimentorin"; };
+        hackathon = import ./nix/modules/static-app.nix { inherit self; } { appName = "hackathon"; };
+
+        # All-in-one module that enables all apps
+        all = { config, lib, pkgs, ... }: {
+          imports = [
+            self.nixosModules.landing
+            self.nixosModules.backoffice
+            self.nixosModules.gacha
+            self.nixosModules.dimentorin
+            self.nixosModules.hackathon
+          ];
+        };
+      };
+
+      # Overlay for easy integration
+      overlays.default = final: prev: {
+        imphnen = {
+          landing = self.packages.${final.system}.landing;
+          backoffice = self.packages.${final.system}.backoffice;
+          gacha = self.packages.${final.system}.gacha;
+          dimentorin = self.packages.${final.system}.dimentorin;
+          hackathon = self.packages.${final.system}.hackathon;
+          # Function to build hackathon with custom environment variables (e.g., Supabase)
+          mkHackathonWithEnv = envVars: import ./nix/mkViteApp.nix {
+            pkgs = final;
+            src = self;
+            npmDepsHash = "sha256-dKBi3bM/cpzK70s62tJTI1j/lhVlojAX2IkyNK0oICI=";
+          } { name = "hackathon"; buildScript = "hackathon:build"; inherit envVars; };
+        };
+      };
+    };
+}

nix/example-infrastructure.nix

@@ -0,0 +1,89 @@
+# Example: How to use in imphnen-infrastructure
+#
+# In your imphnen-infrastructure flake.nix:
+#
+# {
+#   inputs = {
+#     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+#     imphnen-frontend = {
+#       url = "github:your-org/imphnen-frontend-service";
+#       # Or use local path during development:
+#       # url = "path:/path/to/imphnen-frontend-service";
+#     };
+#   };
+#
+#   outputs = { self, nixpkgs, imphnen-frontend, ... }: {
+#     nixosConfigurations.your-server = nixpkgs.lib.nixosSystem {
+#       system = "x86_64-linux";
+#       modules = [
+#         # Import all modules at once
+#         imphnen-frontend.nixosModules.all
+#
+#         # Or import individually:
+#         # imphnen-frontend.nixosModules.landing
+#         # imphnen-frontend.nixosModules.backoffice
+#
+#         ./your-server-config.nix
+#       ];
+#     };
+#   };
+# }
+#
+# Then in your-server-config.nix:
+
+{ config, pkgs, ... }:
+
+{
+  # Enable Landing (Next.js) - runs as systemd service
+  services.imphnen-landing = {
+    enable = true;
+    port = 3000;
+    hostname = "0.0.0.0";
+    openFirewall = true;
+    # environmentFile = /run/secrets/landing-env;  # For secrets
+  };
+
+  # Enable Backoffice (Static) - served by nginx
+  services.imphnen-backoffice = {
+    enable = true;
+    domain = "backoffice.imphnen.dev";
+    enableSSL = true;
+  };
+
+  # Enable Gacha (Static)
+  services.imphnen-gacha = {
+    enable = true;
+    domain = "gacha.imphnen.dev";
+    enableSSL = true;
+  };
+
+  # Enable Dimentorin (Static)
+  services.imphnen-dimentorin = {
+    enable = true;
+    domain = "dimentorin.imphnen.dev";
+    enableSSL = true;
+  };
+
+  # Enable Hackathon (Static)
+  services.imphnen-hackathon = {
+    enable = true;
+    domain = "hackathon.imphnen.dev";
+    enableSSL = true;
+  };
+
+  # Nginx reverse proxy for landing (if needed)
+  services.nginx.virtualHosts."imphnen.dev" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:3000";
+      proxyWebsockets = true;
+    };
+  };
+
+  # Enable ACME for SSL
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "admin@imphnen.dev";
+  };
+}

nix/landing.nix

@@ -0,0 +1,50 @@
+# Next.js Landing App Package
+{ pkgs, src, npmDepsHash }:
+
+pkgs.buildNpmPackage {
+  pname = "imphnen-landing";
+  version = "0.0.1";
+  inherit src npmDepsHash;
+
+  nativeBuildInputs = with pkgs; [
+    nodejs_22
+    nodePackages.npm
+    python3  # Required for node-gyp (sharp, etc.)
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    export NX_DAEMON=false
+    export HOME=$TMPDIR
+    npm run landing:build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin $out/share/landing
+
+    # Copy standalone server
+    cp -r dist/apps/landing/.next/standalone/* $out/share/landing/
+
+    # Copy public assets
+    mkdir -p $out/share/landing/apps/landing/public
+    cp -r dist/apps/landing/public/* $out/share/landing/apps/landing/public/ || true
+
+    # Copy static files
+    mkdir -p $out/share/landing/dist/apps/landing/.next/static
+    cp -r dist/apps/landing/.next/static/* $out/share/landing/dist/apps/landing/.next/static/
+
+    # Create wrapper script
+    cat > $out/bin/imphnen-landing <<EOF
+    #!/usr/bin/env bash
+    cd $out/share/landing
+    exec ${pkgs.nodejs_22}/bin/node apps/landing/server.js "\$@"
+    EOF
+    chmod +x $out/bin/imphnen-landing
+
+    runHook postInstall
+  '';
+
+  dontNpmBuild = true;
+}

nix/mkViteApp.nix

@@ -0,0 +1,33 @@
+# Helper function to build Vite-based static apps
+{ pkgs, src, npmDepsHash }:
+
+{ name, buildScript, envVars ? {} }:
+
+pkgs.buildNpmPackage {
+  pname = "imphnen-${name}";
+  version = "0.0.1";
+  inherit src npmDepsHash;
+
+  nativeBuildInputs = with pkgs; [
+    nodejs_22
+    nodePackages.npm
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    export NX_DAEMON=false
+    export HOME=$TMPDIR
+    ${pkgs.lib.concatStringsSep "\n" (pkgs.lib.mapAttrsToList (k: v: "export ${k}=\"${v}\"") envVars)}
+    npm run ${buildScript}
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r dist/apps/${name}/* $out/
+    runHook postInstall
+  '';
+
+  dontNpmBuild = true;
+}

nix/modules/landing.nix

@@ -0,0 +1,83 @@
+# NixOS Module for Imphnen Landing
+{ self }:
+
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.imphnen-landing;
+in {
+  options.services.imphnen-landing = {
+    enable = lib.mkEnableOption "Imphnen Landing Page";
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3000;
+      description = "Port to run the landing server on";
+    };
+
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "0.0.0.0";
+      description = "Hostname to bind to";
+    };
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = self.packages.${pkgs.system}.landing;
+      description = "The landing package to use";
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Open firewall for the landing port";
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = "Environment file for secrets";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.imphnen-landing = {
+      description = "Imphnen Landing Page";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      environment = {
+        NODE_ENV = "production";
+        PORT = toString cfg.port;
+        HOSTNAME = cfg.hostname;
+      };
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${cfg.package}/bin/imphnen-landing";
+        Restart = "on-failure";
+        RestartSec = "5s";
+
+        # Hardening
+        DynamicUser = true;
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      } // lib.optionalAttrs (cfg.environmentFile != null) {
+        EnvironmentFile = cfg.environmentFile;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+  };
+}

nix/modules/static-app.nix

@@ -0,0 +1,76 @@
+# NixOS Module for Static Vite Apps (nginx-based)
+{ self }:
+
+{ appName }:
+
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services."imphnen-${appName}";
+in {
+  options.services."imphnen-${appName}" = {
+    enable = lib.mkEnableOption "Imphnen ${appName}";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      description = "Domain name for the app";
+    };
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = self.packages.${pkgs.system}.${appName};
+      description = "The ${appName} package to use";
+    };
+
+    enableSSL = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Enable ACME SSL";
+    };
+
+    extraLocations = lib.mkOption {
+      type = lib.types.attrsOf lib.types.anything;
+      default = {};
+      description = "Additional nginx locations";
+    };
+
+    extraConfig = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = "Extra nginx configuration";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+
+      virtualHosts.${cfg.domain} = {
+        forceSSL = cfg.enableSSL;
+        enableACME = cfg.enableSSL;
+        root = cfg.package;
+
+        locations = {
+          "/" = {
+            tryFiles = "$uri $uri/ /index.html";
+          };
+
+          # Cache static assets
+          "~* \\.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$" = {
+            tryFiles = "$uri =404";
+            extraConfig = ''
+              expires 1y;
+              add_header Cache-Control "public, immutable";
+            '';
+          };
+        } // cfg.extraLocations;
+
+        extraConfig = cfg.extraConfig;
+      };
+    };
+  };
+}