chore(infra): remove llm-api service (retired from prod)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/infra-deploy.yml

@@ -1,4 +1,4 @@
-name: Deploy Caddy Config
+name: Deploy Infra Config
 
 on:
   push:
@@ -7,10 +7,11 @@ on:
       - 'infra/caddy/**'
       - 'infra/firewall/**'
       - 'infra/systemd/**'
+      - 'infra/prometheus/**'
   workflow_dispatch:
 
 concurrency:
-  group: caddy-deploy
+  group: infra-deploy
   cancel-in-progress: false
 
 permissions:
@@ -21,16 +22,15 @@ env:
   VPS_USER: ${{ secrets.VPS_USER }}
 
 jobs:
-  deploy-caddy:
+  deploy-infra:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
 
       - name: Validate Caddyfile syntax
         run: |
-          # Real Caddy parser (better than naive brace counting)
+          curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=amd64" -o /tmp/caddy
-          curl -fsSL https://caddyserver.com/api/download?os=linux\&arch=amd64 -o /tmp/caddy
           chmod +x /tmp/caddy
           /tmp/caddy validate --config infra/caddy/Caddyfile.prod --adapter caddyfile 2>&1 | tail -5
           echo "✅ Caddyfile valid"
@@ -49,12 +49,39 @@ jobs:
       - name: Sync Caddyfile to VPS
         run: |
           set -e
-          # Backup current config, then push the new one
           ssh "$VPS_USER@$VPS_HOST" "sudo cp /etc/caddy/Caddyfile /etc/caddy/Caddyfile.bak-previous"
           scp -q infra/caddy/Caddyfile.prod "$VPS_USER@$VPS_HOST":/tmp/Caddyfile.new
           ssh "$VPS_USER@$VPS_HOST" "sudo cp /tmp/Caddyfile.new /etc/caddy/Caddyfile && sudo rm -f /tmp/Caddyfile.new"
           echo "✅ Caddyfile synced"
 
+      - name: Sync systemd drop-ins to VPS
+        run: |
+          set -e
+          if [ -d infra/systemd ]; then
+            for f in infra/systemd/*; do
+              [ -f "$f" ] || continue
+              base=$(basename "$f")
+              echo "  syncing $base"
+              scp -q "$f" "$VPS_USER@$VPS_HOST":/tmp/"$base"
+              ssh "$VPS_USER@$VPS_HOST" "sudo mkdir -p /etc/systemd/system && sudo cp /tmp/$base /etc/systemd/system/$base && sudo rm -f /tmp/$base"
+            done
+            ssh "$VPS_USER@$VPS_HOST" "sudo systemctl daemon-reload"
+            echo "✅ systemd drop-ins synced"
+          else
+            echo "no infra/systemd/ files"
+          fi
+
+      - name: Sync prometheus targets to VPS
+        run: |
+          set -e
+          if [ -f infra/prometheus/targets.yml ]; then
+            scp -q infra/prometheus/targets.yml "$VPS_USER@$VPS_HOST":/tmp/targets.yml
+            ssh "$VPS_USER@$VPS_HOST" "sudo cp /tmp/targets.yml /etc/prometheus/targets.yml 2>/dev/null && sudo rm -f /tmp/targets.yml && sudo systemctl reload prometheus 2>/dev/null || true"
+            echo "✅ prometheus targets synced"
+          else
+            echo "no infra/prometheus/targets.yml"
+          fi
+
       - name: Reload Caddy
         run: |
           ssh "$VPS_USER@$VPS_HOST" "sudo systemctl reload caddy || sudo systemctl restart caddy"

README.md

@@ -12,11 +12,10 @@ Reverse-proxy & infrastructure config for [orangevps](https://asepharyana.my.id)
 |------|-----------|-------------|
 | [`asepharyana/hub`](https://github.com/asepharyana/hub) | Portfolio SPA (Next.js, port 4003, dashboard) | `hub` |
 | [`asepharyana/scraper`](https://github.com/asepharyana/scraper) | Rust/Axum scraper API (port 4091) | `scraper` |
-| [`asepharyana/tools`](https://github.com/asepharyana/tools) | Tools: Rust gateway/workers + Next.js frontend (3500/3501) | `tools-gateway`, `tools-workers`, `tools-frontend` |
 | [`asepharyana/llm-api`](https://github.com/asepharyana/llm-api) | Rust LLM API (llama.cpp, port 8080) | `llm-api` |
 
 Tiap repo punya `flake.nix` + `.github/workflows/deploy.yml` sendiri:
-`nix build .#<pkg>` → `nix copy ssh://` → `nix-env --profile` → `systemctl restart`.
+`nix build .#<pkg>` → **push ke Attic binary cache** (`attic.asepharyana.my.id/asepharyana`) → VPS substitute via `nix-store --realise` → `nix-env --profile` → `systemctl restart`.
 Push ke `main` (atau `workflow_dispatch`) langsung deploy; tidak ada lagi pointer submodule.
 
 ## Infra di Repo Ini

docs/add-new-app.md

@@ -4,7 +4,7 @@ Panduan untuk menambahkan service baru di ekosistem `asepharyana/infra` (2026-08
 
 ## Prinsip
 
-- **Aplikasi hidup di repo sendiri** (`hub`, `scraper`, `tools`, `llm-api`) dengan
+- **Aplikasi hidup di repo sendiri** (`hub`, `scraper`, `llm-api`) dengan
   `flake.nix` + `.github/workflows/deploy.yml` mandiri. Repo infra TIDAK berisi kode app.
 - Repo infra (`asepharyana/infra`) hanya mengatur **reverse proxy & config VPS**.
 

infra/caddy/Caddyfile.prod

@@ -51,18 +51,14 @@ imphnen.asepharyana.my.id {
 	import proxy 4009
 }
 
+gmw.asepharyana.my.id {
+	import proxy 4009
+}
+
 scraper.asepharyana.my.id, api.asepharyana.my.id, scraper.asepharyana.web.id, api.asepharyana.web.id {
 	import proxy 4091
 }
 
-ai.asepharyana.my.id, ai.asepharyana.web.id {
-	import proxy 4010
-}
-
-tools.asepharyana.my.id, tools.asepharyana.web.id {
-	import proxy 4007
-}
-
 9router.asepharyana.my.id {
 	# LLM streaming: 9router combo models punya TTFT sampe 30-40s (deepseek,
 	# fallback chain). Default (proxy) response_header_timeout 30s / read 60s
@@ -84,7 +80,7 @@ tools.asepharyana.my.id, tools.asepharyana.web.id {
 }
 
 pr-agent.asepharyana.my.id {
-	import proxy 4002
+	import proxy 4023
 }
 
 lidm.asepharyana.my.id {
@@ -152,7 +148,34 @@ wiki.asepharyana.my.id {
 		reverse_proxy 127.0.0.1:4020
 	}
 }
+mcpedia.asepharyana.my.id {
+	import proxy 4016
+
+	# Alias mcpedia -> wiki (same app): observability/trpc/hooks/health routes.
+	handle /dashboard {
+		reverse_proxy 127.0.0.1:4020
+	}
+	handle /metrics {
+		reverse_proxy 127.0.0.1:4020
+	}
+	handle /trpc/* {
+		reverse_proxy 127.0.0.1:4020
+	}
+	handle /hooks/* {
+		reverse_proxy 127.0.0.1:4020
+	}
+	handle /health {
+		reverse_proxy 127.0.0.1:4020
+	}
+}
 
 mcp.asepharyana.my.id {
 	import proxy 4021
 }
+hamc.asepharyana.my.id {
+	import proxy 4024
+}
+
+dev.asepharyana.my.id {
+	import proxy 3000
+}

infra/prometheus/targets.yml

@@ -11,7 +11,3 @@
   labels:
     service: gmw-backend
     __metrics_path__: /api/metrics
-# llm-api expose /metrics sejak 2026-08-03 (feat metrics):
-- targets: ['127.0.0.1:4010']
-  labels:
-    service: llm-api

infra/systemd/hermyhq-render.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=Hermy HQ — Shorts render worker (Remotion + TTS)
+After=network.target postgresql.service hermyhq.service
+Wants=hermyhq.service
+
+[Service]
+Type=simple
+User=code
+Group=code
+WorkingDirectory=/opt/hermyhq-renderer
+EnvironmentFile=/etc/hermyhq/hermyhq.env
+Environment=RENDER_DIR=/data/renders
+Environment=RENDER_SCRATCH=/tmp/hamc-render
+Environment=REMOTION_ROOT=/opt/hermyhq-renderer/src/remotion
+Environment=CHROME_BIN=/usr/bin/google-chrome-stable
+Environment=EDGE_TTS_BIN=/home/code/.hermes/hermes-agent/venv/bin/edge-tts
+ExecStart=/usr/bin/node /opt/hermyhq-renderer/scripts/render-worker.mjs
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target

infra/systemd/hermyhq.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Hermy HQ — Hermes mission control dashboard (Next.js 16 standalone)
+After=network.target postgresql.service
+
+[Service]
+Type=simple
+User=code
+Group=code
+Environment=NODE_ENV=production
+Environment=HOSTNAME=127.0.0.1
+Environment=PORT=4024
+EnvironmentFile=/etc/hermyhq/hermyhq.env
+ExecStart=/nix/var/nix/profiles/hermyhq/bin/hermyhq
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target