Harden server and add Nix-native CI + self-hosted Gitea Actions

- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/
  X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail
  upstream copies via header_down on mail.severijnse.eu
- tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync
  _25/_465/_993, fail-safe placeholders; coredns zone updated
- pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint,
  deadnix); CI pre-commit job over x86_64 + aarch64 matrix
- gitea: enable Gitea Actions + self-hosted runner (native:host,
  aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook
- fix statix warnings (merge repeated systemd/database/configFile keys)
  + disable empty_pattern via statix.toml (nixpkgs standard)
- Clean up unused lambda patterns across 38 .nix files via deadnix
- Format whole repo with alejandra (27 files)
- Remove .github/workflows/ci.yml (Gitea shadows .github; runner labels differ)
- Fix CI nix-not-found: export /run/current-system/sw/bin in PATH
- Trim aarch64 from pre-commit matrix (no QEMU binfmt deployed yet)

.gitea/workflows/ci.yml

@@ -0,0 +1,84 @@
+# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
+#   https://github.com/cachix/install-nix-action
+#   (README: "Flakes CI workflow with nix build and flake check")
+# Every action used here (actions/checkout) is from an official GitHub repo.
+#
+# Adaptations for Gitea Actions:
+#   * runs-on: native  - Gitea's self-hosted native runner. cachix/install-nix-action
+#     explicitly supports self-hosted runners, and this runner's host already provides
+#     Nix (Lix), so the installer step is omitted and flakes are enabled via NIX_CONFIG
+#     (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
+#   * The native runner only puts its `hostPackages` on PATH, which does NOT include Nix.
+#     Each job therefore exports the host's system Nix (/run/current-system/sw/bin) onto
+#     PATH before invoking `nix`. This uses the host's actual Lix rather than installing a
+#     second Nix client that would mismatch the running Lix daemon.
+#   * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
+#   * matrix over x86_64-linux + aarch64-linux for flake-check (--no-build, eval-only).
+#     Pre-commit checks run on x86_64-linux only: building aarch64 derivations needs
+#     QEMU binfmt (registered via boot.binfmt.emulatedSystems) + nix extra-platforms,
+#     which require a nixos-rebuild switch that hasn't been applied yet.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Least-privilege by default; jobs opt into what they need.
+permissions: {}
+
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  NIX_CONFIG: |
+    experimental-features = nix-command flakes
+    extra-platforms = aarch64-linux
+
+jobs:
+  flake-check:
+    name: Flake check (${{ matrix.system }})
+    runs-on: native
+    strategy:
+      fail-fast: false
+      matrix:
+        system:
+          - x86_64-linux
+          - aarch64-linux
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Flake check (${{ matrix.system }})
+        run: |
+          export PATH=/run/current-system/sw/bin:$PATH
+          nix flake check --no-build --system ${{ matrix.system }}
+
+  pre-commit:
+    name: Pre-commit checks (${{ matrix.system }})
+    runs-on: native
+    strategy:
+      fail-fast: false
+      matrix:
+        # aarch64-linux omitted: building aarch64 derivations needs QEMU binfmt +
+        # extra-platforms; system hasn't been rebuilt to apply them yet.
+        system:
+          - x86_64-linux
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Pre-commit checks (${{ matrix.system }})
+        run: |
+          export PATH=/run/current-system/sw/bin:$PATH
+          nix build .#checks.${{ matrix.system }}.pre-commit

.github/workflows/ci.yml

@@ -1,71 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-# Least-privilege by default; jobs opt into what they need.
-permissions: {}
-
-# Cancel superseded runs on the same ref.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  check:
-    name: Flake check (${{ matrix.system }})
-    strategy:
-      fail-fast: false
-      matrix:
-        system:
-          - x86_64-linux
-          - aarch64-linux
-    # Match the architecture to a native runner, exactly like nixpkgs
-    # (its treefmt/parse/owners jobs run on ubuntu-24.04-arm).
-    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-
-      # Evaluate the flake for this system (incl. nixosConfigurations) without
-      # building. Catches the class of break we hit with the duplicate module block.
-      - name: Flake check (${{ matrix.system }})
-        run: nix flake check --no-build --system ${{ matrix.system }}
-
-  format:
-    name: Formatting check (${{ matrix.system }})
-    strategy:
-      fail-fast: false
-      matrix:
-        system:
-          - x86_64-linux
-          - aarch64-linux
-    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
-
-      # alejandra is the configured formatter (flake.nix perSystem.formatter).
-      # Checked per-system so both architectures stay formatted.
-      - name: Formatting check (${{ matrix.system }})
-        run: nix run .#formatter.${{ matrix.system }} -- --check .

README.md

@@ -19,7 +19,10 @@
 
 ### ⚠ <sup><sub><samp>PLEASE RESPECT THE CREDITS IF YOU USE SOMETHING FROM MY DESKTOP/SETUP.</samp></sub></sup>
 
-> **Note:** This configuration has been refactored to remove Home Manager to reduce evaluation overhead. While projects like `hjem` and `hjem-rum` were considered, a pure NixOS approach was chosen for simplicity and performance.
+> **Note:** Built with [flake-parts](https://flake.parts/). The client
+> configurations (`desktop`, `laptop`, `tty`) use Home Manager, while the
+> Hetzner server is isolated on `nixos-24.05`. The flake builds for both
+> **x86_64-linux** and **aarch64-linux**.
 
 ---
 
@@ -48,12 +51,17 @@
 ## 🌼 <samp>INSTALLATION (NixOS)</samp>
 
 > Request:
-> [NixOs](https://channels.nixos.org/nixos-25.05/latest-nixos-minimal-x86_64-linux.iso)
+> [NixOS](https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso)
 
-- Download ISO.
+This flake targets **both** `x86_64-linux` and `aarch64-linux`, so grab the
+minimal ISO for your architecture:
 
 ```bash
-wget -O https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso
+# x86_64
+wget -O nixos-minimal.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso
+
+# aarch64 (e.g. Raspberry Pi / ARM boxes)
+wget -O nixos-minimal-aarch64.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-aarch64-linux.iso
 ```
 
 - Boot Into the Installer.
@@ -118,10 +126,10 @@ rm -rf /mnt/etc/nixos/hosts/aesthetic/configuration.nix
 
 ```bash
 # Move to folder
-cd mnt/etc/nixos
+cd /mnt/etc/nixos
 
-# Install
-nixos-install --flake .#aesthetic
+# Install (desktop for a graphical machine, or #laptop)
+nixos-install --flake .#desktop
 ```
 
 - Reboot
@@ -143,7 +151,7 @@ If you're using this NixOS configuration flake locally, you can simplify the pro
 To switch your system configuration with `nh`, use:
 
 ```bash
-NH_FLAKE=/home/someone/Dev/kaku/ nh os switch
+NH_FLAKE=/etc/nixos nh os switch
 ```
 
 This avoids needing to type out the full `nixos-rebuild` command manually and provides a cleaner workflow when iterating on your setup.

flake.lock

@@ -82,6 +82,22 @@
         "type": "github"
       }
     },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -122,6 +138,27 @@
         "type": "github"
       }
     },
+    "git-hooks-nix": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783008725,
+        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
     "helium": {
       "inputs": {
         "nixpkgs": [
@@ -254,6 +291,7 @@
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
         "flake-utils": "flake-utils",
+        "git-hooks-nix": "git-hooks-nix",
         "helium": "helium",
         "import-tree": "import-tree",
         "nix-index-db": "nix-index-db",

flake.nix

@@ -5,7 +5,7 @@
     inputs.flake-parts.lib.mkFlake {inherit inputs;} {
       systems = ["x86_64-linux" "aarch64-linux"];
 
-      imports = [./hosts ./pkgs];
+      imports = [./hosts ./pkgs inputs.git-hooks-nix.flakeModule];
 
       perSystem = {
         config,
@@ -21,6 +21,37 @@
         };
         # Nix Formatter
         formatter = pkgs.alejandra;
+
+        # Pre-commit hooks (flake-parts module from cachix/git-hooks.nix).
+        # `nix build .#checks.<system>.pre-commit` runs these in CI; the same
+        # set is installed in `nix develop` for local use.
+        # alejandra.settings.check = true => verify-only (no in-place writes),
+        # which is what we want in the read-only CI sandbox.
+        pre-commit.settings.hooks = {
+          alejandra = {
+            enable = true;
+            settings.check = true;
+          };
+          statix = {
+            enable = true;
+            # hardware-configuration.nix is auto-generated by NixOS; it legitimately
+            # repeats `boot` keys, which statix would otherwise flag. Exclude it here.
+            settings.ignore = ["hardware-configuration.nix"];
+            # Lint config (statix.toml at repo root). Disables `empty_pattern`, which
+            # flags the standard NixOS `{ ... }:` module pattern that nixpkgs likewise
+            # permits.
+            settings.config = "./statix.toml";
+          };
+          deadnix.enable = true;
+          actionlint.enable = true;
+          trim-trailing-whitespace.enable = true;
+          end-of-file-fixer.enable = true;
+          check-yaml.enable = true;
+          check-toml.enable = true;
+          check-added-large-files.enable = true;
+          check-merge-conflicts.enable = true;
+          detect-private-keys.enable = true;
+        };
       };
     };
 
@@ -40,6 +71,14 @@
       inputs.nixpkgs-lib.follows = "nixpkgs";
     };
 
+    # Nix-native pre-commit framework (maintained successor to
+    # pre-commit-hooks.nix). Follows our nixpkgs to avoid version skew
+    # with the rest of the flake.
+    git-hooks-nix = {
+      url = "github:cachix/git-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
     # rest of inputs, alphabetical order

home/editors/nvim/default.nix

@@ -1,5 +1,4 @@
 {
-  config,
   lib,
   pkgs,
   ...

home/editors/zed/default.nix

@@ -1,5 +1,4 @@
 {
-  config,
   lib,
   pkgs,
   ...

home/packages/android.nix

@@ -1,8 +1,4 @@
-{
-  inputs,
-  pkgs,
-  ...
-}: let
+{pkgs, ...}: let
   kotlin-lsp = pkgs.runCommand "kotlin-lsp" {} ''
     mkdir -p $out/bin
     ln -s ${pkgs.kotlin-language-server}/bin/kotlin-language-server $out/bin/kotlin-lsp

home/packages/packages.nix

@@ -1,8 +1,4 @@
-{
-  inputs,
-  pkgs,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = with pkgs; [
     # screenshot
     grim

home/packages/wayland/niri/_binds.nix

@@ -1,4 +1,4 @@
-{pkgs}: {
+{}: {
   "XF86AudioPlay" = {
     _props.allow-when-locked = true;
     spawn._args = ["playerctl" "play-pause"];

home/packages/wayland/niri/_to-KDL.nix

@@ -36,10 +36,11 @@
     (
       if typeOf element == "null"
       then "null"
-      else if element == false
-      then "false"
-      else if element == true
-      then "true"
+      else if typeOf element == "bool"
+      then
+        if element
+        then "true"
+        else "false"
       else if typeOf element == "string"
       then ''"${sanitizeString element}"''
       else toString element

home/packages/wayland/niri/default.nix

@@ -8,7 +8,7 @@
   binds = import ./_binds.nix {inherit pkgs;};
   rules = import ./_rules.nix;
 
-  finalConfig = toKDL.generate "niri-config.kdl" (settings // {binds = binds;} // rules);
+  finalConfig = toKDL.generate "niri-config.kdl" (settings // {inherit binds;} // rules);
 in {
   environment.sessionVariables = {
     NIRI_CONFIG = "$HOME/.config/niri/config.kdl";

home/services/wayland/ashell.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = [pkgs.ashell];
 
   xdg.configFile."ashell/config.toml".text = ''

home/services/wayland/mako.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = [pkgs.mako];
 
   xdg.configFile."mako/config".text = ''

home/services/wayland/walker.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = [pkgs.walker pkgs.elephant];
 
   xdg.configFile."walker/config.toml".text = ''

home/terminal/emulators/alacritty.nix

@@ -1,8 +1,4 @@
-{
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   alacritty-wrapped = pkgs.writeShellScriptBin "alacritty-wayland" ''
     export WAYLAND_DISPLAY="wayland-1"
     export XDG_CURRENT_DESKTOP="Niri"

home/terminal/software/ssh.nix

@@ -2,9 +2,7 @@
   config,
   pkgs,
   ...
-}: let
-  sshConfigFile = "ssh/config";
-in {
+}: {
   users.users.someone.packages = with pkgs; [
     openssh
   ];

home/terminal/software/tui.nix

@@ -1,8 +1,4 @@
-{
-  inputs,
-  pkgs,
-  ...
-}: {
+{pkgs, ...}: {
   users.users.someone.packages = with pkgs; [
     # archives
     zip

home/terminal/software/xdg.nix

@@ -80,19 +80,21 @@ in {
       enable = true;
       defaultApplications = associations;
     };
-    configFile."xdg-desktop-portal-termfilechooser/config".text = ''
-      [filechooser]
-      cmd=${yaziWrapper}/bin/yazi-wrapper
-      default_dir=$HOME
-      open_mode=suggested
-      save_mode=suggested
-    '';
-    configFile."user-dirs.dirs".source = userDirsConfig;
-    configFile."mimeapps.list".text = ''
-      [Default Applications]
-      ${lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k}=${lib.concatStringsSep ";" v}") associations)}
-      [Added Associations]
-      ${lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k}=${lib.concatStringsSep ";" v}") associations)}
-    '';
+    configFile = {
+      "xdg-desktop-portal-termfilechooser/config".text = ''
+        [filechooser]
+        cmd=${yaziWrapper}/bin/yazi-wrapper
+        default_dir=$HOME
+        open_mode=suggested
+        save_mode=suggested
+      '';
+      "user-dirs.dirs".source = userDirsConfig;
+      "mimeapps.list".text = ''
+        [Default Applications]
+        ${lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k}=${lib.concatStringsSep ";" v}") associations)}
+        [Added Associations]
+        ${lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k}=${lib.concatStringsSep ";" v}") associations)}
+      '';
+    };
   };
 }

home/xdg-compat.nix

@@ -159,7 +159,7 @@ in {
       ${lib.concatStringsSep "\n" (
         lib.flatten (
           lib.mapAttrsToList (
-            user: userCfg:
+            _user: userCfg:
               (lib.mapAttrsToList (mkLinkScript cfg.configHome) userCfg.configFiles)
               ++ (lib.mapAttrsToList (mkLinkScript cfg.cacheHome) userCfg.cacheFiles)
               ++ (lib.mapAttrsToList (mkLinkScript cfg.dataHome) userCfg.dataFiles)

hosts/aesthetic/default.nix

@@ -3,7 +3,6 @@
   inputs,
   lib,
   pkgs,
-  self,
   ...
 }: {
   imports = [

hosts/default.nix

@@ -55,8 +55,7 @@ in {
     hetzner = nixosSystem24 {
       system = "x86_64-linux";
       specialArgs = {
-        inherit inputs self;
-        unstablePkgs = unstablePkgs;
+        inherit inputs self unstablePkgs;
       };
       modules = [
         inputs.disko.nixosModules.disko

servers/hetzner/hosts/hetzner/default.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   imports = [
     ./networking.nix
     ./users.nix

servers/hetzner/hosts/hetzner/hardware-configuration.nix

@@ -2,9 +2,7 @@
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 {
-  config,
   lib,
-  pkgs,
   modulesPath,
   ...
 }: {

servers/hetzner/hosts/hetzner/hardware.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   boot = {
     loader = {
       grub = {

servers/hetzner/hosts/hetzner/networking.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   networking = {
     hostName = "debian-4gb-fsn1-1";
     domain = "severijnse.eu";

servers/hetzner/hosts/hetzner/users.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   users.users = {
     root = {
       openssh.authorizedKeys.keys = [

servers/hetzner/modules/security/acme.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   # NOTE: Caddy handles all TLS natively via its ACME integration.
   # This module is kept as a fallback for non-Caddy services.
   # Currently NOT imported in default.nix — uncomment there to activate.

servers/hetzner/modules/services/backup.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   backupScript = pkgs.writeShellScript "weekly-backup" ''
     BACKUP_DIR="/home/admin/backups"
     SRC="/home/admin"

servers/hetzner/modules/services/caddy.nix

@@ -1,10 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  domain = "severijnse.eu";
+{...}: let
   antiScrape = ''
     @bad_bot {
       header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*"

servers/hetzner/modules/services/coredns.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   zoneFile = pkgs.writeText "severijnse.eu.db" ''
     $ORIGIN severijnse.eu.
     $TTL 3600
@@ -71,37 +66,48 @@
     severijnse.eu IN SSHFP 4 2 c02f4b13aef78579f3466851fcc741c0169eaa63237463ceacc9bb72a2be0519
   '';
 in {
-  # Decrypt DNSSEC keys from sops-encrypted file using the age key at /etc/age/keys.txt
-  # Uses sops CLI directly instead of sops-nix's sops-install-secrets (avoids Go 1.25 build dep)
-  systemd.services.decrypt-coredns-keys = {
-    description = "Decrypt CoreDNS DNSSEC signing keys";
-    before = ["coredns.service"];
-    wantedBy = ["coredns.service"];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      Environment = "SOPS_AGE_KEY_FILE=/etc/age/keys.txt";
+  systemd = {
+    services = {
+      decrypt-coredns-keys = {
+        description = "Decrypt CoreDNS DNSSEC signing keys";
+        before = ["coredns.service"];
+        wantedBy = ["coredns.service"];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          Environment = "SOPS_AGE_KEY_FILE=/etc/age/keys.txt";
+        };
+        script = ''
+          SOPS_FILE=${../../secrets/coredns-keys.yaml}
+          KEYS_DIR=/var/lib/coredns/keys
+          mkdir -p "$KEYS_DIR"
+
+          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.key"
+          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.private"
+          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.key"
+          ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.private"
+
+          chmod 644 "$KEYS_DIR/"*
+        '';
+      };
+      coredns = {
+        after = ["decrypt-coredns-keys.service"];
+        requires = ["decrypt-coredns-keys.service"];
+
+        # Copy zone file from Nix store to writable location on service start
+        # TLSA updater will modify the writable copy at runtime
+        preStart = ''
+          cp -f ${zoneFile} /var/lib/coredns/zones/severijnse.eu.db
+          chown coredns:coredns /var/lib/coredns/zones/severijnse.eu.db
+        '';
+      };
     };
-    script = ''
-      SOPS_FILE=${../../secrets/coredns-keys.yaml}
-      KEYS_DIR=/var/lib/coredns/keys
-      mkdir -p "$KEYS_DIR"
-
-      ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.key"
-      ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.private"
-      ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.key"
-      ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.private"
-
-      chmod 644 "$KEYS_DIR/"*
-    '';
+    tmpfiles.rules = [
+      "d /var/lib/coredns 0750 coredns coredns -"
+      "d /var/lib/coredns/zones 0750 coredns coredns -"
+      "d /var/lib/coredns/keys 0750 coredns coredns -"
+    ];
   };
-
-  # Ensure coredns waits for key decryption
-  systemd.services.coredns = {
-    after = ["decrypt-coredns-keys.service"];
-    requires = ["decrypt-coredns-keys.service"];
-  };
-
   services.coredns = {
     enable = true;
     config = ''
@@ -126,19 +132,4 @@ in {
       }
     '';
   };
-
-  # Copy zone file from Nix store to writable location on service start
-  # TLSA updater will modify the writable copy at runtime
-  systemd.services.coredns = {
-    preStart = ''
-      cp -f ${zoneFile} /var/lib/coredns/zones/severijnse.eu.db
-      chown coredns:coredns /var/lib/coredns/zones/severijnse.eu.db
-    '';
-  };
-
-  systemd.tmpfiles.rules = [
-    "d /var/lib/coredns 0750 coredns coredns -"
-    "d /var/lib/coredns/zones 0750 coredns coredns -"
-    "d /var/lib/coredns/keys 0750 coredns coredns -"
-  ];
 }

servers/hetzner/modules/services/fail2ban.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   # Keep fail2ban as OCI container to preserve the web UI
   virtualisation.oci-containers.containers.fail2ban = {
     image = "crazymax/fail2ban:latest";

servers/hetzner/modules/services/gitea.nix

@@ -1,54 +1,87 @@
 {
-  config,
   pkgs,
-  lib,
   unstablePkgs,
   ...
 }: {
-  services.postgresql = {
-    enable = true;
-    package = pkgs.postgresql_14;
-    ensureDatabases = ["gitea"];
-    ensureUsers = [
-      {
+  services = {
+    postgresql = {
+      enable = true;
+      package = pkgs.postgresql_14;
+      ensureDatabases = ["gitea"];
+      ensureUsers = [
+        {
+          name = "gitea";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    gitea = {
+      enable = true;
+      package = unstablePkgs.gitea;
+      database = {
+        type = "postgres";
         name = "gitea";
-        ensureDBOwnership = true;
-      }
-    ];
+        user = "gitea";
+      };
+      appName = "Jory's Git";
+      lfs.enable = true;
+      settings = {
+        server = {
+          DOMAIN = "git.severijnse.eu";
+          ROOT_URL = "https://git.severijnse.eu/";
+          HTTP_PORT = 3000;
+          SSH_PORT = 222;
+          SSH_LISTEN_PORT = 2222;
+          START_SSH_SERVER = true;
+          SSH_USER = "git";
+          BUILTIN_SSH_SERVER_USER = "git";
+          LANDING_PAGE = "explore";
+        };
+        service = {
+          DISABLE_REGISTRATION = true;
+          REQUIRE_SIGNIN_VIEW = false;
+        };
+        repository = {
+          DEFAULT_BRANCH = "main";
+        };
+        actions = {
+          ENABLED = true;
+        };
+      };
+    };
+
+    gitea-actions-runner = {
+      # nixos-24-05's gitea-actions-runner module hardcodes bin/act_runner,
+      # but the current upstream package (1.0.3, matching gitea 1.26) ships
+      # bin/gitea-runner. Wrap it so both names resolve.
+      package = pkgs.runCommand "gitea-actions-runner-wrapped" {} ''
+        mkdir -p $out/bin
+        ln -s ${unstablePkgs.gitea-actions-runner}/bin/gitea-runner $out/bin/act_runner
+      '';
+      instances.default = {
+        enable = true;
+        name = "hetzner";
+        url = "https://git.severijnse.eu";
+        tokenFile = "/var/lib/secrets/gitea-runner-token";
+        labels = ["native:host"];
+        hostPackages = with pkgs; [
+          bash
+          coreutils
+          curl
+          gawk
+          gitMinimal
+          gnused
+          nodejs
+          wget
+        ];
+      };
+    };
   };
 
   # Gitea connects to local Postgres via Unix socket (peer auth).
   # No password needed — the socket is at /run/postgresql by default.
   # createDatabase = true ensures the DB + user are set up automatically.
-  services.gitea = {
-    enable = true;
-    package = unstablePkgs.gitea;
-    database.type = "postgres";
-    database.name = "gitea";
-    database.user = "gitea";
-    appName = "Jory's Git";
-    lfs.enable = true;
-    settings = {
-      server = {
-        DOMAIN = "git.severijnse.eu";
-        ROOT_URL = "https://git.severijnse.eu/";
-        HTTP_PORT = 3000;
-        SSH_PORT = 222;
-        SSH_LISTEN_PORT = 2222;
-        START_SSH_SERVER = true;
-        SSH_USER = "git";
-        BUILTIN_SSH_SERVER_USER = "git";
-        LANDING_PAGE = "explore";
-      };
-      service = {
-        DISABLE_REGISTRATION = true;
-        REQUIRE_SIGNIN_VIEW = false;
-      };
-      repository = {
-        DEFAULT_BRANCH = "main";
-      };
-    };
-  };
 
   # Gitea built-in SSH server: listens on high port 2222 (no privileged-cap needed),
   # while clone URLs advertise port 222. Firewall redirects 222 -> 2222.
@@ -61,4 +94,12 @@
     ${pkgs.nftables}/bin/nft add chain inet gitea-redirect prerouting '{ type nat hook prerouting priority dstnat; }' 2>/dev/null || true
     ${pkgs.nftables}/bin/nft add rule inet gitea-redirect prerouting tcp dport 222 redirect to :2222 2>/dev/null || true
   '';
+
+  # --- Gitea Actions self-hosted CI runner ---
+  # The native runner only exposes `hostPackages` on PATH (see the list above),
+  # which intentionally omits Nix. CI steps export the host's system Nix
+  # (/run/current-system/sw/bin, i.e. Lix) onto PATH rather than installing a
+  # second Nix client, so the running Lix daemon is used directly.
+  # aarch64 builds run under QEMU user-emulation via boot.binfmt below.
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
 }

servers/hetzner/modules/services/mailserver.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.mailserver = {
     image = "ghcr.io/docker-mailserver/docker-mailserver:latest";
     autoStart = true;

servers/hetzner/modules/services/rustdesk.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers = {
     hbbr = {
       image = "rustdesk/rustdesk-server:latest";

servers/hetzner/modules/services/shkeeper.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.shkeeper = {
     image = "vsyshost/shkeeper:2.5.29";
     autoStart = true;

servers/hetzner/modules/services/snappymail.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.snappymail = {
     image = "djmaze/snappymail:latest";
     autoStart = true;

servers/hetzner/modules/services/tlsa-updater.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   # Caddy's canonical certificate storage (XDG data dir). Renewals land here,
   # owned caddy:caddy 0600 — the mail server's non-root Postfix/Dovecot cannot
   # read it directly, so we copy it into a world-readable distribution dir.
@@ -58,42 +53,44 @@
     echo "tlsa-update: TLSA set to $HEX"
   '';
 in {
-  # Ensure the distribution dir exists (Caddy does not write here).
-  systemd.tmpfiles.rules = [
-    "d ${distCertDir} 0755 root root - -"
-  ];
+  systemd = {
+    # Ensure the distribution dir exists (Caddy does not write here).
+    tmpfiles.rules = [
+      "d ${distCertDir} 0755 root root - -"
+    ];
 
-  systemd.services.tlsa-update = {
-    description = "Sync Caddy TLS certificate to mail server and update DANE/TLSA records";
-    after = ["caddy.service" "coredns.service"];
-    partOf = ["coredns.service"];
-    wantedBy = ["multi-user.target"];
-    path = with pkgs; [openssl coreutils gnused podman systemd];
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = "${syncScript}";
-      User = "root";
-      Group = "root";
+    services.tlsa-update = {
+      description = "Sync Caddy TLS certificate to mail server and update DANE/TLSA records";
+      after = ["caddy.service" "coredns.service"];
+      partOf = ["coredns.service"];
+      wantedBy = ["multi-user.target"];
+      path = with pkgs; [openssl coreutils gnused podman systemd];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${syncScript}";
+        User = "root";
+        Group = "root";
+      };
     };
-  };
 
-  # Fire as soon as Caddy rewrites the certificate on renewal (the atomic rewrite
-  # changes the directory mtime), eliminating the up-to-24h DANE drift window.
-  systemd.paths.tlsa-update = {
-    description = "Watch Caddy certificate directory for renewal";
-    wantedBy = ["paths.target"];
-    pathConfig = {
-      PathModified = [caddyCertDir];
-      Unit = "tlsa-update.service";
+    # Fire as soon as Caddy rewrites the certificate on renewal (the atomic rewrite
+    # changes the directory mtime), eliminating the up-to-24h DANE drift window.
+    paths.tlsa-update = {
+      description = "Watch Caddy certificate directory for renewal";
+      wantedBy = ["paths.target"];
+      pathConfig = {
+        PathModified = [caddyCertDir];
+        Unit = "tlsa-update.service";
+      };
     };
-  };
 
-  # Fallback in case a renewal event is missed (e.g. inotify overflow).
-  systemd.timers.tlsa-update = {
-    wantedBy = ["timers.target"];
-    timerConfig = {
-      OnCalendar = "daily";
-      Persistent = true;
+    # Fallback in case a renewal event is missed (e.g. inotify overflow).
+    timers.tlsa-update = {
+      wantedBy = ["timers.target"];
+      timerConfig = {
+        OnCalendar = "daily";
+        Persistent = true;
+      };
     };
   };
 }

servers/hetzner/modules/services/vaultwarden.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.vaultwarden = {
     image = "vaultwarden/server:latest";
     autoStart = true;

servers/hetzner/modules/services/watchtower.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.watchtower = {
     image = "ghcr.io/nicholas-fedor/watchtower:latest";
     autoStart = true;

servers/hetzner/modules/services/wireguard.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.wg-easy = {
     image = "ghcr.io/wg-easy/wg-easy:latest";
     autoStart = true;

servers/hetzner/modules/services/wrxproxy.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.wrxproxy = {
     image = "localhost/wrxproxy:latest";
     autoStart = false;

servers/hetzner/modules/system/env.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{pkgs, ...}: {
   time.timeZone = "Europe/Amsterdam";
 
   i18n.defaultLocale = "en_US.UTF-8";

statix.toml

@@ -0,0 +1 @@
+disabled = ["empty_pattern"]

system/core/boot.nix

@@ -1,7 +1,6 @@
 {
   config,
   pkgs,
-  lib,
   ...
 }: {
   boot = {

system/services/default.nix

@@ -1,8 +1,4 @@
-{
-  lib,
-  pkgs,
-  ...
-}: {
+{pkgs, ...}: {
   services = {
     printing = {
       enable = true;

system/services/xdg-portal-fix.nix

@@ -1,4 +1,4 @@
-{...}: {
+_: {
   systemd.user.services.xdg-desktop-portal = {
     serviceConfig = {
       UnsetEnvironment = "NIX_XDG_DESKTOP_PORTAL_DIR";