Harden server and add Nix-native CI + self-hosted Gitea Actions

- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/
  X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail
  upstream copies via header_down on mail.severijnse.eu
- tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync
  _25/_465/_993, fail-safe placeholders; coredns zone updated
- pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint,
  deadnix); CI pre-commit job over x86_64 + aarch64 matrix
- gitea: enable Gitea Actions + self-hosted runner (native:host,
  aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook
- fix statix warnings (merge repeated systemd/database/configFile keys)
  + disable empty_pattern via statix.toml (nixpkgs standard)
- Clean up unused lambda patterns across 38 .nix files via deadnix
- Format whole repo with alejandra (27 files)
- Remove .github/workflows/ci.yml (Gitea shadows .github; runner labels differ)
- Fix CI nix-not-found: export /run/current-system/sw/bin in PATH
- Trim aarch64 from pre-commit matrix (no QEMU binfmt deployed yet)

README.md

@@ -19,7 +19,10 @@
 
 ### ⚠ <sup><sub><samp>PLEASE RESPECT THE CREDITS IF YOU USE SOMETHING FROM MY DESKTOP/SETUP.</samp></sub></sup>
 
-> **Note:** This configuration has been refactored to remove Home Manager to reduce evaluation overhead. While projects like `hjem` and `hjem-rum` were considered, a pure NixOS approach was chosen for simplicity and performance.
+> **Note:** Built with [flake-parts](https://flake.parts/). The client
+> configurations (`desktop`, `laptop`, `tty`) use Home Manager, while the
+> Hetzner server is isolated on `nixos-24.05`. The flake builds for both
+> **x86_64-linux** and **aarch64-linux**.
 
 ---
 
@@ -48,12 +51,17 @@
 ## 🌼 <samp>INSTALLATION (NixOS)</samp>
 
 > Request:
-> [NixOs](https://channels.nixos.org/nixos-25.05/latest-nixos-minimal-x86_64-linux.iso)
+> [NixOS](https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso)
 
-- Download ISO.
+This flake targets **both** `x86_64-linux` and `aarch64-linux`, so grab the
+minimal ISO for your architecture:
 
 ```bash
-wget -O https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso
+# x86_64
+wget -O nixos-minimal.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso
+
+# aarch64 (e.g. Raspberry Pi / ARM boxes)
+wget -O nixos-minimal-aarch64.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-aarch64-linux.iso
 ```
 
 - Boot Into the Installer.
@@ -118,10 +126,10 @@ rm -rf /mnt/etc/nixos/hosts/aesthetic/configuration.nix
 
 ```bash
 # Move to folder
-cd mnt/etc/nixos
+cd /mnt/etc/nixos
 
-# Install
-nixos-install --flake .#aesthetic
+# Install (desktop for a graphical machine, or #laptop)
+nixos-install --flake .#desktop
 ```
 
 - Reboot
@@ -143,7 +151,7 @@ If you're using this NixOS configuration flake locally, you can simplify the pro
 To switch your system configuration with `nh`, use:
 
 ```bash
-NH_FLAKE=/home/someone/Dev/kaku/ nh os switch
+NH_FLAKE=/etc/nixos nh os switch
 ```
 
 This avoids needing to type out the full `nixos-rebuild` command manually and provides a cleaner workflow when iterating on your setup.