Harden server and add Nix-native CI + self-hosted Gitea Actions

- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/ X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail upstream copies via header_down on mail.severijnse.eu - tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync _25/_465/_993, fail-safe placeholders; coredns zone updated - pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint, ...); CI pre-commit job over x86_64 + aarch64 matrix - gitea: enable Gitea Actions + self-hosted runner (native:host, aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook - fix statix warnings (merge repeated systemd/database/configFile keys, inherit, bool-compare guards); add missing trailing newlines
2026-07-12 00:05:13 +02:00
parent c5f771bd53
commit 7ed54e51a2
23 changed files with 336 additions and 147 deletions
@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  flake-check:
+    runs-on: native
+    strategy:
+      fail-fast: false
+      matrix:
+        system: [x86_64-linux, aarch64-linux]
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Nix
+        run: |
+          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
+          mkdir -p "$HOME/.config/nix"
+          echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
+          # shellcheck disable=SC1091
+          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+      - name: Flake check (${{ matrix.system }})
+        run: |
+          # shellcheck disable=SC1091
+          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+          nix flake check --no-build --system ${{ matrix.system }}
+
+  pre-commit:
+    runs-on: native
+    strategy:
+      fail-fast: false
+      matrix:
+        system: [x86_64-linux, aarch64-linux]
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Nix
+        run: |
+          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
+          mkdir -p "$HOME/.config/nix"
+          echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
+          # shellcheck disable=SC1091
+          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+      - name: Pre-commit checks (${{ matrix.system }})
+        run: |
+          # shellcheck disable=SC1091
+          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+          nix build .#checks.${{ matrix.system }}.pre-commit