Harden server and add Nix-native CI + self-hosted Gitea Actions

- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/
  X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail
  upstream copies via header_down on mail.severijnse.eu
- tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync
  _25/_465/_993, fail-safe placeholders; coredns zone updated
- pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint,
  ...); CI pre-commit job over x86_64 + aarch64 matrix
- gitea: enable Gitea Actions + self-hosted runner (native:host,
  aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook
- fix statix warnings (merge repeated systemd/database/configFile keys,
  inherit, bool-compare guards); add missing trailing newlines

.gitea/workflows/ci.yml

@@ -1,3 +1,4 @@
+<<<<<<< HEAD
 name: CI
 
 on:
@@ -57,3 +58,77 @@ jobs:
           # shellcheck disable=SC1091
           source "$HOME/.nix-profile/etc/profile.d/nix.sh"
           nix build .#checks.${{ matrix.system }}.pre-commit
+||||||| parent of 8e5dada (Harden server and add Nix-native CI + self-hosted Gitea Actions)
+=======
+# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
+#   https://github.com/cachix/install-nix-action
+#   (README: "Flakes CI workflow with nix build and flake check")
+# Every action used here (actions/checkout) is from an official GitHub repo.
+#
+# Adaptations for Gitea Actions:
+#   * runs-on: native  - Gitea's self-hosted native runner. cachix/install-nix-action
+#     explicitly supports self-hosted runners, and this runner's host already provides
+#     Nix, so the installer step is omitted and flakes are enabled via NIX_CONFIG
+#     (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
+#   * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
+#   * matrix over x86_64-linux + aarch64-linux (aarch64 via the runner's registered
+#     boot.binfmt.emulatedSystems).
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Least-privilege by default; jobs opt into what they need.
+permissions: {}
+
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  NIX_CONFIG: experimental-features = nix-command flakes
+
+jobs:
+  flake-check:
+    name: Flake check (${{ matrix.system }})
+    runs-on: native
+    strategy:
+      fail-fast: false
+      matrix:
+        system:
+          - x86_64-linux
+          - aarch64-linux
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Flake check (${{ matrix.system }})
+        run: nix flake check --no-build --system ${{ matrix.system }}
+
+  pre-commit:
+    name: Pre-commit checks (${{ matrix.system }})
+    runs-on: native
+    strategy:
+      fail-fast: false
+      matrix:
+        system:
+          - x86_64-linux
+          - aarch64-linux
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Pre-commit checks (${{ matrix.system }})
+        run: nix build .#checks.${{ matrix.system }}.pre-commit
+>>>>>>> 8e5dada (Harden server and add Nix-native CI + self-hosted Gitea Actions)