Asep Haryana
b5596e1398
- flake.nix: 6 derivations (hub, scraper, tools-gateway, tools-workers, tools-frontend, llm-api) - Fetch submodule source via builtins.fetchGit with pinned revs - Fix cargo HOME/TMPDIR for Nix sandbox permission issues - Fix llm-api: CMake/Clang deps for llama.cpp-sys2 bindgen - Add LIBCLANG_PATH, LD_LIBRARY_PATH for Rust bindgen builds - Systemd units: tools-gateway (3501), tools-frontend (3500), tools-workers, llm-api (8080) - tools.target for grouped management - Env configs: /etc/tools/env, /etc/llm-api/env - GitHub Actions: nix-build.yml — matrix build + nix copy + deploy - Update Traefik apps.yaml: tools/host.docker.internal:3500, llm-api/host.docker.internal:8080 - iptables: allow Docker→host on 3099, 4091, 3500, 3501, 8080 - Add scripts/nix-deploy.sh for CI/CD deploy step
107 lines
3.2 KiB
YAML
107 lines
3.2 KiB
YAML
name: Nix Build & Deploy — All Services
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'apps/**'
|
|
- 'infra/**'
|
|
- 'flake.nix'
|
|
- 'flake.lock'
|
|
- '.github/workflows/nix-build.yml'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: nix-deploy
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
VPS_HOST: ${{ secrets.VPS_HOST }}
|
|
VPS_USER: ${{ secrets.VPS_USER }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
service: [hub, scraper, tools-gateway, tools-workers, tools-frontend, llm-api]
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
submodules: recursive
|
|
fetch-depth: 0
|
|
|
|
- name: Install Nix
|
|
uses: DeterminateSystems/nix-installer-action@v16
|
|
with:
|
|
extra-conf: |
|
|
sandbox = false
|
|
accept-flake-config = true
|
|
|
|
- name: Cache Nix
|
|
uses: DeterminateSystems/magic-nix-cache-action@v8
|
|
|
|
- name: Build ${{ matrix.service }}
|
|
run: nix build .#${{ matrix.service }} --impure --option sandbox false
|
|
|
|
- name: Nix copy to VPS
|
|
env:
|
|
SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "$SSH_KEY" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
|
nix copy --to "ssh://$VPS_USER@$VPS_HOST" ./result
|
|
|
|
deploy:
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Install Nix
|
|
uses: DeterminateSystems/nix-installer-action@v16
|
|
|
|
- name: Deploy all services on VPS
|
|
env:
|
|
SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "$SSH_KEY" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
for service in hub scraper tools-gateway tools-workers tools-frontend llm-api; do
|
|
echo "=== Deploying $service ==="
|
|
ssh "$VPS_USER@$VPS_HOST" "
|
|
PROFILE=\"/nix/var/nix/profiles/\$service\"
|
|
CURRENT=\$(readlink -f \"\$PROFILE\" 2>/dev/null || echo "")
|
|
LATEST=\$(ls -1d /nix/store/*-\$service-* 2>/dev/null | tail -1)
|
|
if [ -n \"\$LATEST\" ] && [ \"\$CURRENT\" != \"\$LATEST\" ]; then
|
|
sudo /nix/var/nix/profiles/default/bin/nix-env --profile \"\$PROFILE\" --set \"\$LATEST\" &&
|
|
sudo systemctl restart \"\$service\" &&
|
|
echo \" ✅ \$service updated to \$LATEST\"
|
|
elif [ -z \"\$LATEST\" ]; then
|
|
echo \" ⚠️ \$service: no store path found\"
|
|
else
|
|
echo \" ➖ \$service: already up-to-date\"
|
|
fi
|
|
"
|
|
done
|
|
|
|
- name: Verify services
|
|
env:
|
|
SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
|
|
run: |
|
|
ssh "$VPS_USER@$VPS_HOST" "
|
|
for service in hub scraper tools-gateway tools-workers tools-frontend llm-api; do
|
|
state=\$(systemctl is-active \$service 2>/dev/null || echo 'not-found')
|
|
echo \" \$service: \$state\"
|
|
done
|
|
"
|