diff --git a/.DS_Store b/.DS_Store
deleted file mode 100644
index e39247fd..00000000
Binary files a/.DS_Store and /dev/null differ
diff --git a/.air.toml b/.air.toml
deleted file mode 100644
index c463b5b2..00000000
--- a/.air.toml
+++ /dev/null
@@ -1,13 +0,0 @@
-# .air.toml
-root = "."
-tmp_dir = "tmp"
-
-[build]
-cmd = "go build -buildvcs=false -o ./tmp/main ./cmd/api"
-bin = "tmp/main"
-full_bin = "APP_ENV=dev ./tmp/main"
-include_ext = ["go", "tpl", "tmpl", "html"]
-exclude_dir = ["vendor", "tmp"]
-
-[log]
-time = true
diff --git a/.gitignore b/.gitignore
index 82524f71..4a814ebe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,7 +13,8 @@ bin/
 Makefile
 docker-compose.local.yml
 docker-compose.yaml
-Dockerfile.local
+Dockerfile
+.gitlab-ci.yml
 # Go build cache
 .gocache/
 vendor
@@ -27,3 +28,4 @@ coverage/
 .vscode/
 .idea/
 *.swp
+.DS_Store
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 53f28b3e..b0e3883e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,90 +1,173 @@
 stages:
+  - build
+  - migrate
   - deploy
+  - seed
 
-deploy-dev:
+default:
+  tags:
+    - self-hosted-stg
+
+workflow:
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "staging"'
+      when: always
+    - when: never
+
+variables:
+  DOCKER_BUILDKIT: "1"
+
+  IMAGE_TAG: "staging_${CI_COMMIT_SHORT_SHA}"
+  IMAGE_NAME: "${CI_REGISTRY_IMAGE}:${IMAGE_TAG}"
+  IMAGE_LATEST: "${CI_REGISTRY_IMAGE}:staging_latest"
+
+  DEPLOY_DIR: "/opt/deploy/stg-lti-api"
+  COMPOSE_FILE: "docker-compose.yaml"
+
+# =========================
+# BUILD (AUTO)
+# =========================
+build_staging:
+  stage: build
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "staging"'
+  script: |
+    set -e
+    docker info
+
+    echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
+
+    echo "✅ Build image: $IMAGE_NAME"
+    docker build -t "$IMAGE_NAME" -f Dockerfile .
+
+    echo "✅ Push image: $IMAGE_NAME"
+    docker push "$IMAGE_NAME"
+
+    echo "✅ Tag latest: $IMAGE_LATEST"
+    docker tag "$IMAGE_NAME" "$IMAGE_LATEST"
+    docker push "$IMAGE_LATEST"
+
+
+# =========================
+# MIGRATE (AUTO)
+# =========================
+migrate_staging:
+  stage: migrate
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "staging"'
+  needs:
+    - job: build_staging
+      artifacts: false
+  script: |
+    set -e
+    echo "✅ Running migrations (staging) ..."
+
+    cd "$DEPLOY_DIR"
+    test -f "$COMPOSE_FILE" || (echo "❌ $COMPOSE_FILE not found in $DEPLOY_DIR" && exit 1)
+    test -f .env || (echo "❌ .env not found in $DEPLOY_DIR" && exit 1)
+
+    # ✅ load env dari server
+    set -a
+    . ./.env
+    set +a
+
+    # ✅ validasi
+    test -n "$DB_HOST" || (echo "❌ DB_HOST empty" && exit 1)
+    test -n "$DB_PORT" || (echo "❌ DB_PORT empty" && exit 1)
+    test -n "$DB_USER" || (echo "❌ DB_USER empty" && exit 1)
+    test -n "$DB_PASSWORD" || (echo "❌ DB_PASSWORD empty" && exit 1)
+    test -n "$DB_NAME" || (echo "❌ DB_NAME empty" && exit 1)
+
+    export DATABASE_URL="postgres://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME}?sslmode=${DB_SSLMODE:-disable}"
+    echo "✅ DATABASE_URL=$DATABASE_URL"
+
+    # ✅ Pastikan postgres & redis ON (sesuaikan nama service compose kamu!)
+    echo "✅ Ensuring postgres & redis running ..."
+    docker compose -f "$COMPOSE_FILE" up -d stg-postgres-lti stg-redis-lti || true
+
+    # ✅ Ambil network key dari compose
+    COMPOSE_NETWORK_KEY="$(docker compose -f "$COMPOSE_FILE" config | awk '/networks:/ {getline; print $1}' | tr -d ':')"
+    echo "✅ Compose network key: $COMPOSE_NETWORK_KEY"
+
+    # ✅ Cari network name yang dipakai docker
+    NETWORK_NAME="$(docker network ls --format '{{.Name}}' | grep "_${COMPOSE_NETWORK_KEY}$" | head -n 1)"
+    test -n "$NETWORK_NAME" || (echo "❌ Cannot find docker network for compose ($COMPOSE_NETWORK_KEY)" && exit 1)
+
+    echo "✅ Docker network detected: $NETWORK_NAME"
+
+    # ✅ Migrations dari repo (CI workspace)
+    echo "✅ Checking migrations from repo..."
+    ls -lah "$CI_PROJECT_DIR/internal/database/migrations"
+
+    echo "✅ Running migrations via migrate/migrate container"
+    set +e
+    out=$(docker run --rm \
+      --network "$NETWORK_NAME" \
+      -v "$CI_PROJECT_DIR/internal/database/migrations:/migrations:ro" \
+      migrate/migrate:v4.15.2 \
+      -path=/migrations -database "$DATABASE_URL" up 2>&1)
+    code=$?
+    set -e
+
+    echo "$out"
+
+    # ✅ Handle no change dengan benar (tidak false-success)
+    if echo "$out" | grep -qi "no change"; then
+      echo "✅ No change (already up to date)"
+      exit 0
+    fi
+
+    if [ $code -ne 0 ]; then
+      echo "❌ Migration failed with exit code $code"
+      exit $code
+    fi
+
+    echo "✅ Migration applied successfully"
+
+
+# =========================
+# DEPLOY (AUTO) 
+# =========================
+deploy_staging:
   stage: deploy
-  image: alpine:3.20
-  variables:
-    DEPLOY_APP: "LTI-MBUGROUP"
-    # Opsional: kalau pakai submodule, ini bikin clone submodule pakai SSH juga
-    GIT_SUBMODULE_STRATEGY: recursive
-    GIT_DEPTH: "1"
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "staging"'
+  needs:
+    - job: migrate_staging
+      artifacts: false
+    - job: build_staging
+      artifacts: false
+  script: |
+    set -e
+    docker info
+    echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
 
-  before_script:
-    - echo "🧰 Installing dependencies..."
-    - apk update && apk add --no-cache openssh git curl bash
+    cd "$DEPLOY_DIR"
+    test -f "$COMPOSE_FILE" || (echo "❌ $COMPOSE_FILE not found in $DEPLOY_DIR" && exit 1)
+    test -f .env || (echo "❌ .env not found in $DEPLOY_DIR" && exit 1)
 
-    # Setup SSH di runner
-    - mkdir -p ~/.ssh
-    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' > ~/.ssh/id_rsa
-    - chmod 600 ~/.ssh/id_rsa
-    - eval "$(ssh-agent -s)"
-    - ssh-add ~/.ssh/id_rsa
+    docker compose -f "$COMPOSE_FILE" pull
+    docker compose -f "$COMPOSE_FILE" up -d --force-recreate
+    docker image prune -f
 
-    # Trust host keys (server + gitlab) biar SSH gak nanya interaktif
-    - ssh-keyscan -H "$SERVER_IP" >> ~/.ssh/known_hosts
-    - ssh-keyscan -H gitlab.com >> ~/.ssh/known_hosts
 
-  script:
-    - echo "🚀 Deploying latest code to $SERVER_USER@$SERVER_IP"
+# =========================
+# SEED (MANUAL)
+# =========================
+seed_staging:
+  stage: seed
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "staging"'
+  needs:
+    - job: deploy_staging
+      artifacts: false
+  when: manual
+  allow_failure: false
+  script: |
+    set -e
+    cd "$DEPLOY_DIR"
+    test -f "$COMPOSE_FILE" || (echo "❌ $COMPOSE_FILE not found" && exit 1)
+    test -f .env || (echo "❌ .env not found" && exit 1)
 
-    - >
-      if ssh -o StrictHostKeyChecking=no "$SERVER_USER@$SERVER_IP" "
-        set -e
-
-        cd /home/devops/docker/deployment/development/lti-api
-
-        # Pastikan remote origin SSH (antisipasi kalau pernah ke-set HTTPS)
-        git remote set-url origin git@gitlab.com:mbugroup/lti-api.git
-
-        # Pastikan server percaya gitlab.com juga (untuk git fetch via SSH)
-        mkdir -p ~/.ssh
-        ssh-keyscan -H gitlab.com >> ~/.ssh/known_hosts
-
-        # Fetch/reset pakai SSH
-        GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no' git fetch origin development
-        git reset --hard origin/development
-
-        docker compose restart dev-api-lti || docker compose up -d dev-api-lti
-      "; then
-        STATUS='success';
-      else
-        STATUS='failed';
-      fi;
-
-      RUN_URL="${CI_PROJECT_URL}/-/pipelines/${CI_PIPELINE_ID}";
-
-      if [ "$STATUS" = "success" ]; then
-        COLOR=3066993;
-        TITLE="✅ Deployment API Succeeded";
-        DESC="Deployment job on branch \`${CI_COMMIT_REF_NAME}\` completed successfully.";
-      else
-        COLOR=15158332;
-        TITLE="❌ Deployment API Failed Gaes";
-        DESC="Deployment job on branch \`${CI_COMMIT_REF_NAME}\` failed.";
-      fi;
-
-      echo "{
-        \"username\": \"CI Bot\",
-        \"embeds\": [{
-          \"title\": \"$TITLE\",
-          \"description\": \"$DESC\",
-          \"color\": $COLOR,
-          \"fields\": [
-            {\"name\": \"Repository\", \"value\": \"${CI_PROJECT_PATH}\", \"inline\": true},
-            {\"name\": \"Actor\", \"value\": \"${GITLAB_USER_LOGIN}\", \"inline\": true},
-            {\"name\": \"Commit\", \"value\": \"${CI_COMMIT_SHA}\", \"inline\": false},
-            {\"name\": \"Pipeline\", \"value\": \"[Open run](${RUN_URL})\", \"inline\": false}
-          ]
-        }]
-      }" > payload.json;
-
-      echo "📡 Sending notification to Discord...";
-      curl -sS -H "Content-Type: application/json" \
-        -d @payload.json "$DISCORD_WEBHOOK_URL";
-
-  only:
-    - development
-
-  environment:
-    name: development
\ No newline at end of file
+    docker compose -f "$COMPOSE_FILE" pull seed || true
+    docker compose -f "$COMPOSE_FILE" run --rm seed
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 87781228..32e0688d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,20 +1,38 @@
-FROM golang:1.23-alpine
+# =========================
+# Builder stage
+# =========================
+FROM golang:1.23-alpine AS builder
 
-# Install dependensi dasar
-RUN apk add --no-cache git curl bash build-base
+RUN apk add --no-cache git ca-certificates tzdata
+WORKDIR /app
 
-# Install Air (pakai repo baru air-verse)
-RUN go install github.com/air-verse/air@v1.52.3
-
-WORKDIR /lti-api
-
-# Cache dependencies
 COPY go.mod go.sum ./
 RUN go mod download
 
-# Copy source code
 COPY . .
 
+# Build API binary
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" -o lti-api ./cmd/api
+
+# Build SEED binary (pastikan cmd/seed ada)
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" -o lti-seed ./cmd/seed
+
+# =========================
+# Runtime stage
+# =========================
+FROM alpine:3.20
+
+RUN apk add --no-cache ca-certificates tzdata curl bash postgresql-client \
+  && adduser -D -H -u 10001 appuser
+
+WORKDIR /app
+
+COPY --from=builder /app/lti-api /app/lti-api
+COPY --from=builder /app/lti-seed /app/lti-seed
+
+USER appuser
 EXPOSE 8081
 
-CMD ["air", "-c", ".air.toml"]
+CMD ["/app/lti-api"]
diff --git a/docker-compose.local.yml b/docker-compose.local.yml
deleted file mode 100644
index cdc4652d..00000000
--- a/docker-compose.local.yml
+++ /dev/null
@@ -1,77 +0,0 @@
-services:
-  postgresdb:
-    image: postgres:alpine
-    restart: always
-    ports:
-      - "${DB_PORT_HOST:-5542}:5432"
-    environment:
-      POSTGRES_USER: ${DB_USER:-postgres}
-      POSTGRES_PASSWORD: ${DB_PASSWORD:-postgres}
-      POSTGRES_DB: ${DB_NAME:-db_lti_erp}
-    volumes:
-      - dbdata:/var/lib/postgresql/data
-      - ./internal/database/init:/docker-entrypoint-initdb.d
-    networks: [go-network]
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-db_lti_erp}",
-        ]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    ports:
-      - "${REDIS_PORT_HOST:-6381}:6379"
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [go-network]
-
-  app:
-    build:
-      context: .
-      dockerfile: Dockerfile.local
-    image: cosmtrek/air:v1.52.3
-    working_dir: /lti-api
-    volumes:
-      - .:/lti-api
-      - ./internal/config/jwtRS256.key:/run/keys/jwtRS256.key
-      - ./internal/config/jwtRS256.key.pub:/run/keys/jwtRS256.key.pub
-    command: air -c .air.toml
-    env_file:
-      - .env
-    environment:
-      DB_HOST: postgresdb
-      DB_PORT: 5432
-      DB_USER: ${DB_USER:-postgres}
-      DB_PASSWORD: ${DB_PASSWORD:-postgres}
-      DB_NAME: ${DB_NAME:-db_lti_erp}
-      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
-    ports:
-      - "${APP_PORT:-8081}:8081"
-    depends_on:
-      postgresdb:
-        condition: service_healthy
-    networks: [go-network]
-    healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:8081/healthz || exit 1"]
-      interval: 10s
-      timeout: 3s
-      retries: 10
-      start_period: 10s
-
-volumes:
-  dbdata:
-  go-mod-cache:
-  go-build-cache:
-
-networks:
-  go-network:
-    name: lti-api_go-network
-    driver: bridge
diff --git a/docker-compose.yaml b/docker-compose.yaml
deleted file mode 100644
index ab6daeba..00000000
--- a/docker-compose.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
-services:
-  dev-api-lti:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    container_name: dev-api-lti
-    working_dir: /lti-api
-    command: ["/bin/sh", "scripts/entrypoint.sh"]
-    ports:
-      - "8081:8081"
-    env_file:
-      - .env
-    environment:
-      # override agar koneksi ke container internal
-      DB_HOST: dev-postgres-lti
-      DB_PORT: 5432
-      REDIS_URL: redis://dev-redis-lti:6379/0
-    volumes:
-      - .:/lti-api
-      - ./.air.toml:/lti-api/.air.toml:ro
-      - ./internal/config/jwtRS256.key:/run/keys/jwtRS256.key
-      - ./internal/config/jwtRS256.key.pub:/run/keys/jwtRS256.key.pub
-    depends_on:
-      - dev-postgres-lti
-      - dev-redis-lti
-    networks:
-      - lti-network
-    healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:8081/healthz || exit 1"]
-      interval: 10s
-      timeout: 3s
-      retries: 10
-      start_period: 10s
-    deploy:
-      resources:
-        limits:
-          cpus: "2.0"
-          memory: 2G
-        reservations:
-          cpus: "1.0"
-          memory: 512M
-
-  dev-postgres-lti:
-    image: postgres:15-alpine
-    container_name: dev-postgres-lti
-    restart: always
-    env_file:
-      - credential/.env.db
-    ports:
-      - "5433:5432"
-    volumes:
-      - dev-postgres-lti-data:/var/lib/postgresql/data
-      - ./credential:/docker-entrypoint-initdb.d:ro
-    networks:
-      - lti-network
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-db_lti_erp}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 5s
-    deploy:
-      resources:
-        limits:
-          cpus: "1.0"
-          memory: 2G
-        reservations:
-          cpus: "0.5"
-          memory: 512M
-
-  dev-redis-lti:
-    image: redis:7-alpine
-    container_name: dev-redis-lti
-    restart: always
-    ports:
-      - "6380:6379"
-    networks:
-      - lti-network
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 10s
-      timeout: 3s
-      retries: 10
-    deploy:
-      resources:
-        limits:
-          cpus: "0.5"
-          memory: 512M
-        reservations:
-          cpus: "0.2"
-          memory: 256M
-
-networks:
-  lti-network:
-    driver: bridge
-
-volumes:
-  dev-postgres-lti-data: