Harden server and add Nix-native CI + self-hosted Gitea Actions

- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/
  X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail
  upstream copies via header_down on mail.severijnse.eu
- tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync
  _25/_465/_993, fail-safe placeholders; coredns zone updated
- pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint,
  deadnix); CI pre-commit job over x86_64 + aarch64 matrix
- gitea: enable Gitea Actions + self-hosted runner (native:host,
  aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook
- fix statix warnings (merge repeated systemd/database/configFile keys)
  + disable empty_pattern via statix.toml (nixpkgs standard)
- Clean up unused lambda patterns across 38 .nix files via deadnix
- Format whole repo with alejandra (27 files)
- Remove .github/workflows/ci.yml (Gitea shadows .github; runner labels differ)
- Fix CI nix-not-found: export /run/current-system/sw/bin in PATH
- Trim aarch64 from pre-commit matrix (no QEMU binfmt deployed yet)

servers/hetzner/modules/services/coredns.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   zoneFile = pkgs.writeText "severijnse.eu.db" ''
     $ORIGIN severijnse.eu.
     $TTL 3600
@@ -71,37 +66,48 @@
     severijnse.eu IN SSHFP 4 2 c02f4b13aef78579f3466851fcc741c0169eaa63237463ceacc9bb72a2be0519
   '';
 in {
-  # Decrypt DNSSEC keys from sops-encrypted file using the age key at /etc/age/keys.txt
-  # Uses sops CLI directly instead of sops-nix's sops-install-secrets (avoids Go 1.25 build dep)
-  systemd.services.decrypt-coredns-keys = {
-    description = "Decrypt CoreDNS DNSSEC signing keys";
-    before = ["coredns.service"];
-    wantedBy = ["coredns.service"];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      Environment = "SOPS_AGE_KEY_FILE=/etc/age/keys.txt";
+  systemd = {
+    services = {
+      decrypt-coredns-keys = {
+        description = "Decrypt CoreDNS DNSSEC signing keys";
+        before = ["coredns.service"];
+        wantedBy = ["coredns.service"];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          Environment = "SOPS_AGE_KEY_FILE=/etc/age/keys.txt";
+        };
+        script = ''
+          SOPS_FILE=${../../secrets/coredns-keys.yaml}
+          KEYS_DIR=/var/lib/coredns/keys
+          mkdir -p "$KEYS_DIR"
+
+          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.key"
+          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.private"
+          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.key"
+          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.private"
+
+          chmod 644 "$KEYS_DIR/"*
+        '';
+      };
+      coredns = {
+        after = ["decrypt-coredns-keys.service"];
+        requires = ["decrypt-coredns-keys.service"];
+
+        # Copy zone file from Nix store to writable location on service start
+        # TLSA updater will modify the writable copy at runtime
+        preStart = ''
+          cp -f ${zoneFile} /var/lib/coredns/zones/severijnse.eu.db
+          chown coredns:coredns /var/lib/coredns/zones/severijnse.eu.db
+        '';
+      };
     };
-    script = ''
-      SOPS_FILE=${../../secrets/coredns-keys.yaml}
-      KEYS_DIR=/var/lib/coredns/keys
-      mkdir -p "$KEYS_DIR"
-
-      ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.key"
-      ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.private"
-      ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.key"
-      ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.private"
-
-      chmod 644 "$KEYS_DIR/"*
-    '';
+    tmpfiles.rules = [
+      "d /var/lib/coredns 0750 coredns coredns -"
+      "d /var/lib/coredns/zones 0750 coredns coredns -"
+      "d /var/lib/coredns/keys 0750 coredns coredns -"
+    ];
   };
-
-  # Ensure coredns waits for key decryption
-  systemd.services.coredns = {
-    after = ["decrypt-coredns-keys.service"];
-    requires = ["decrypt-coredns-keys.service"];
-  };
-
   services.coredns = {
     enable = true;
     config = ''
@@ -126,19 +132,4 @@ in {
       }
     '';
   };
-
-  # Copy zone file from Nix store to writable location on service start
-  # TLSA updater will modify the writable copy at runtime
-  systemd.services.coredns = {
-    preStart = ''
-      cp -f ${zoneFile} /var/lib/coredns/zones/severijnse.eu.db
-      chown coredns:coredns /var/lib/coredns/zones/severijnse.eu.db
-    '';
-  };
-
-  systemd.tmpfiles.rules = [
-    "d /var/lib/coredns 0750 coredns coredns -"
-    "d /var/lib/coredns/zones 0750 coredns coredns -"
-    "d /var/lib/coredns/keys 0750 coredns coredns -"
-  ];
 }