feat(hetzner): add restricted release hosting and update CI

.gitea/workflows/ci.yml

@@ -13,10 +13,13 @@
 #     PATH before invoking `nix`. This uses the host's actual Lix rather than installing a
 #     second Nix client that would mismatch the running Lix daemon.
 #   * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
-#   * matrix over x86_64-linux + aarch64-linux for flake-check (--no-build, eval-only).
+#   * matrix over x86_64-linux + aarch64-linux.
-#     Pre-commit checks run on x86_64-linux only: building aarch64 derivations needs
+#     All jobs use --no-build (eval-only) because the runner has 2 cores / 4GB RAM:
-#     QEMU binfmt (registered via boot.binfmt.emulatedSystems) + nix extra-platforms,
+#     building nix derivations would exhaust memory and crash the server.
-#     which require a nixos-rebuild switch that hasn't been applied yet.
+#     Pre-commit hooks run locally via git-hooks-nix on the developer's machine.
+#   * aarch64 builds need QEMU binfmt (boot.binfmt.emulatedSystems) + nix extra-platforms,
+#     which require a nixos-rebuild switch not yet applied. Flake-check for aarch64
+#     runs eval-only (no build) and passes.
 
 name: CI
 
@@ -61,24 +64,3 @@ jobs:
         run: |
           export PATH=/run/current-system/sw/bin:$PATH
           nix flake check --no-build --system ${{ matrix.system }}
-
-  pre-commit:
-    name: Pre-commit checks (${{ matrix.system }})
-    runs-on: native
-    strategy:
-      fail-fast: false
-      matrix:
-        # aarch64-linux omitted: building aarch64 derivations needs QEMU binfmt +
-        # extra-platforms; system hasn't been rebuilt to apply them yet.
-        system:
-          - x86_64-linux
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - name: Pre-commit checks (${{ matrix.system }})
-        run: |
-          export PATH=/run/current-system/sw/bin:$PATH
-          nix build .#checks.${{ matrix.system }}.pre-commit

result

@@ -0,0 +1 @@
+/nix/store/d8ysys9mxibkvpiskrvsdiybhwkdnj3d-nixos-system-debian-4gb-fsn1-1-24.05.20241230.b134951

servers/hetzner/modules/services/backup.nix

@@ -89,4 +89,4 @@ in {
     requires = ["restic-password.service"];
     after = ["restic-password.service"];
   };
-}
+}

servers/hetzner/modules/services/caddy.nix

@@ -1,7 +1,4 @@
-{
+{unstablePkgs, ...}: let
-  unstablePkgs,
-  ...
-}: let
   antiScrape = ''
     @bad_bot {
       header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*"
@@ -30,6 +27,13 @@ in {
         @notvpn not remote_ip 10.8.0.0/24
         respond @notvpn "Forbidden" 403
       }
+      # Restrict access to the server itself (loopback + public IPs) or the
+      # WireGuard VPN. Gitea reaches this from the server when publishing a
+      # release, and VPN clients can download from it; the public cannot.
+      (release_gate) {
+        @deny not remote_ip 127.0.0.1 ::1 10.8.0.0/24 49.13.92.205 2a01:4f8:c014:2585::1
+        respond @deny "Forbidden" 403
+      }
       # Security headers applied to every response of every site that
       # imports this snippet (covers all current and future hosts).
       # For proxied hosts whose upstream sets its own copies, strip them
@@ -245,6 +249,16 @@ in {
         '';
       };
 
+      "releases.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import release_gate
+          root * /srv/releases
+          file_server browse
+          encode zstd gzip
+        '';
+      };
+
       "http://ip.severijnse.eu" = {
         extraConfig = ''
           import security_headers
@@ -259,5 +273,6 @@ in {
   systemd.tmpfiles.rules = [
     "d /srv 0755 caddy caddy -"
     "d /srv/jory 0755 caddy caddy -"
+    "d /srv/releases 0755 admin caddy -"
   ];
 }

servers/hetzner/modules/services/stalwart.nix

@@ -85,7 +85,10 @@ in {
       session.auth.mechanisms = "[plain]";
       session.auth.directory = "'internal'";
       session.auth.require = [
-        {"if" = "listener != 'smtp'"; "then" = true;}
+        {
+          "if" = "listener != 'smtp'";
+          "then" = true;
+        }
         {"else" = false;}
       ];
 
@@ -182,4 +185,4 @@ in {
   systemd.tmpfiles.rules = [
     "d /var/lib/bulwark 0755 1001 1001 - -"
   ];
-}
+}

servers/hetzner/modules/services/wireguard.nix

@@ -7,7 +7,7 @@
     ];
     environment = {
       WG_HOST = "severijnse.eu";
-      PASSWORD_HASH = "$2a$12$b3n4drXgS3B6ubMZxxjPUOQ1XktZ1EuDwm4AIdVulhtoD7b1.WQGC";
+      PASSWORD_HASH = "$2a$14$f6l9jto2Uwn9hNudNo7cHeq08M8UDYzrUiOofWSH522QDRhgTlddC";
       WG_DEFAULT_ADDRESS = "10.8.0.x";
       WG_DEFAULT_DNS = "1.1.1.1";
       WG_PORT = "51820";

servers/hetzner/modules/system/opencode.nix

@@ -1,7 +1,4 @@
-{
+{pkgs, ...}: {
-  pkgs,
-  ...
-}: {
   environment.systemPackages = [
     (pkgs.writeShellScriptBin "opencode" ''
       exec /home/admin/.local/bin/opencode "$@"