Added hetzner server configs

2026-07-11 20:28:51 +02:00
parent 0457d618e1
commit c5f771bd53
51 changed files with 1800 additions and 309 deletions
@@ -0,0 +1,71 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Least-privilege by default; jobs opt into what they need.
+permissions: {}
+
+# Cancel superseded runs on the same ref.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  check:
+    name: Flake check (${{ matrix.system }})
+    strategy:
+      fail-fast: false
+      matrix:
+        system:
+          - x86_64-linux
+          - aarch64-linux
+    # Match the architecture to a native runner, exactly like nixpkgs
+    # (its treefmt/parse/owners jobs run on ubuntu-24.04-arm).
+    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      # Evaluate the flake for this system (incl. nixosConfigurations) without
+      # building. Catches the class of break we hit with the duplicate module block.
+      - name: Flake check (${{ matrix.system }})
+        run: nix flake check --no-build --system ${{ matrix.system }}
+
+  format:
+    name: Formatting check (${{ matrix.system }})
+    strategy:
+      fail-fast: false
+      matrix:
+        system:
+          - x86_64-linux
+          - aarch64-linux
+    runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+
+      # alejandra is the configured formatter (flake.nix perSystem.formatter).
+      # Checked per-system so both architectures stay formatted.
+      - name: Formatting check (${{ matrix.system }})
+        run: nix run .#formatter.${{ matrix.system }} -- --check .