ops: deploy diskpush.com to dev2 on merge

.github/workflows/deploy-dev2.yml

@@ -0,0 +1,60 @@
+# Ship every merge to dev2, where diskpush.com runs since it left Railway (which
+# deployed on merge by itself). The box pulls the merged commit, rebuilds the
+# image(s) from this repo and restarts the compose stack under
+# /home/anthony/www/diskpush.com. Generated by cli-tools/dev2/dev2-site scaffold.
+name: Deploy to dev2
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref to deploy (defaults to the pushed commit)
+        required: false
+        type: string
+
+concurrency:
+  group: deploy-dev2
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      # ${{ }} values go through env, never straight into a run: body.
+      - name: Resolve target revision
+        id: rev
+        env:
+          REF: ${{ inputs.ref || github.sha }}
+        run: echo "sha=$REF" >> "$GITHUB_OUTPUT"
+
+      - name: Set up ssh
+        env:
+          SSH_KEY: ${{ secrets.DEV2_SSH_KEY }}
+          KNOWN_HOSTS: ${{ secrets.DEV2_KNOWN_HOSTS }}
+        run: |
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Deploy
+        env:
+          DEV2_USER: ${{ secrets.DEV2_USER }}
+          DEV2_HOST: ${{ secrets.DEV2_HOST }}
+          SHA: ${{ steps.rev.outputs.sha }}
+        run: |
+          ssh -o BatchMode=yes "$DEV2_USER@$DEV2_HOST" \
+            /home/anthony/www/diskpush.com/deploy-app.sh "$SHA"
+
+      - name: Verify the site answers
+        run: |
+          for i in $(seq 1 10); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' "https://diskpush.com/" || true)
+            case "$code" in 2*|3*|401|403) echo "diskpush.com $code"; exit 0;; esac
+            echo "attempt $i: $code"; sleep 10
+          done
+          echo "diskpush.com never answered"; exit 1

.nixpacks/Dockerfile

@@ -0,0 +1,35 @@
+FROM ghcr.io/railwayapp/nixpacks:ubuntu-1745885067
+
+ENTRYPOINT ["/bin/bash", "-l", "-c"]
+WORKDIR /app/
+
+
+COPY .nixpacks/nixpkgs-23f9169c4ccce521379e602cc82ed873a1f1b52b.nix .nixpacks/nixpkgs-23f9169c4ccce521379e602cc82ed873a1f1b52b.nix
+RUN nix-env -if .nixpacks/nixpkgs-23f9169c4ccce521379e602cc82ed873a1f1b52b.nix && nix-collect-garbage -d
+
+
+ARG CI NIXPACKS_METADATA NODE_ENV NPM_CONFIG_PRODUCTION
+ENV CI=$CI NIXPACKS_METADATA=$NIXPACKS_METADATA NODE_ENV=$NODE_ENV NPM_CONFIG_PRODUCTION=$NPM_CONFIG_PRODUCTION
+
+# setup phase
+# noop
+
+# install phase
+ENV NIXPACKS_PATH=/app/node_modules/.bin:$NIXPACKS_PATH
+COPY . /app/.
+RUN --mount=type=cache,id=8nFwAs26cBU-/root/local/share/pnpm/store/v3,target=/root/.local/share/pnpm/store/v3 npm install -g corepack@0.36.0 && corepack enable
+RUN --mount=type=cache,id=8nFwAs26cBU-/root/local/share/pnpm/store/v3,target=/root/.local/share/pnpm/store/v3 pnpm install --frozen-lockfile --prod=false --filter @diskpush/web...
+
+# build phase
+COPY . /app/.
+RUN --mount=type=cache,id=8nFwAs26cBU-apps/desktop/next/cache,target=/app/apps/desktop/.next/cache --mount=type=cache,id=8nFwAs26cBU-apps/web/next/cache,target=/app/apps/web/.next/cache --mount=type=cache,id=8nFwAs26cBU-node_modules/cache,target=/app/node_modules/.cache pnpm --filter @diskpush/web build
+
+
+RUN printf '\nPATH=/app/node_modules/.bin:$PATH' >> /root/.profile
+
+
+# start
+COPY . /app
+
+CMD ["pnpm --filter @diskpush/web start"]
+

.nixpacks/build.sh

@@ -0,0 +1 @@
+docker build . -f ./.nixpacks/Dockerfile -t e28a68b1-8df8-4e57-a812-4038e72cd5be --build-arg CI=true --build-arg NIXPACKS_METADATA=node --build-arg NODE_ENV=production --build-arg NPM_CONFIG_PRODUCTION=false

.nixpacks/nixpkgs-23f9169c4ccce521379e602cc82ed873a1f1b52b.nix

@@ -0,0 +1,21 @@
+{ }:
+
+let pkgs = import (fetchTarball "https://github.com/NixOS/nixpkgs/archive/23f9169c4ccce521379e602cc82ed873a1f1b52b.tar.gz") { overlays = [ (import (builtins.fetchTarball "https://github.com/railwayapp/nix-npm-overlay/archive/main.tar.gz")) ]; };
+in with pkgs;
+  let
+    APPEND_LIBRARY_PATH = "${lib.makeLibraryPath [ gcc-unwrapped ] }";
+    myLibraries = writeText "libraries" ''
+      export LD_LIBRARY_PATH="${APPEND_LIBRARY_PATH}:$LD_LIBRARY_PATH"
+
+    '';
+  in
+    buildEnv {
+      name = "23f9169c4ccce521379e602cc82ed873a1f1b52b-env";
+      paths = [
+        (runCommand "23f9169c4ccce521379e602cc82ed873a1f1b52b-env" { } ''
+          mkdir -p $out/etc/profile.d
+          cp ${myLibraries} $out/etc/profile.d/23f9169c4ccce521379e602cc82ed873a1f1b52b-env.sh
+        '')
+        nodejs_24 pnpm-9_x
+      ];
+    }

nixpacks.toml

@@ -5,7 +5,9 @@
 # no start script on purpose: the web app is one workspace of several.
 [phases.install]
 cmds = [
-  "npm install -g corepack@0.24.1 && corepack enable",
+  # corepack 0.24.1 (nixpacks' default) cannot launch pnpm 10+ on Node 24:
+  # ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING. 0.36 can.
+  "npm install -g corepack@0.36.0 && corepack enable",
   "pnpm install --frozen-lockfile --prod=false --filter @diskpush/web...",
 ]