Harden server and add Nix-native CI + self-hosted Gitea Actions

- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/
  X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail
  upstream copies via header_down on mail.severijnse.eu
- tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync
  _25/_465/_993, fail-safe placeholders; coredns zone updated
- pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint,
  ...); CI pre-commit job over x86_64 + aarch64 matrix
- gitea: enable Gitea Actions + self-hosted runner (native:host,
  aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook
- fix statix warnings (merge repeated systemd/database/configFile keys,
  inherit, bool-compare guards); add missing trailing newlines

.gitea/workflows/ci.yml

@@ -1,3 +1,17 @@
+# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
+#   https://github.com/cachix/install-nix-action
+#   (README: "Flakes CI workflow with nix build and flake check")
+# Every action used here (actions/checkout) is from an official GitHub repo.
+#
+# Adaptations for Gitea Actions:
+#   * runs-on: native  - Gitea's self-hosted native runner. cachix/install-nix-action
+#     explicitly supports self-hosted runners, and this runner's host already provides
+#     Nix, so the installer step is omitted and flakes are enabled via NIX_CONFIG
+#     (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
+#   * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
+#   * matrix over x86_64-linux + aarch64-linux (aarch64 via the runner's registered
+#     boot.binfmt.emulatedSystems).
+
 name: CI
 
 on:
@@ -5,6 +19,9 @@ on:
     branches: [main]
   pull_request:
 
+# Least-privilege by default; jobs opt into what they need.
+permissions: {}
+
 concurrency:
   group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
   cancel-in-progress: true
@@ -13,47 +30,42 @@ defaults:
   run:
     shell: bash
 
+env:
+  NIX_CONFIG: experimental-features = nix-command flakes
+
 jobs:
   flake-check:
+    name: Flake check (${{ matrix.system }})
     runs-on: native
     strategy:
       fail-fast: false
       matrix:
-        system: [x86_64-linux, aarch64-linux]
+        system:
+          - x86_64-linux
+          - aarch64-linux
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
-      - name: Install Nix
-        run: |
-          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
-          mkdir -p "$HOME/.config/nix"
-          echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
       - name: Flake check (${{ matrix.system }})
-        run: |
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
-          nix flake check --no-build --system ${{ matrix.system }}
+        run: nix flake check --no-build --system ${{ matrix.system }}
 
   pre-commit:
+    name: Pre-commit checks (${{ matrix.system }})
     runs-on: native
     strategy:
       fail-fast: false
       matrix:
-        system: [x86_64-linux, aarch64-linux]
+        system:
+          - x86_64-linux
+          - aarch64-linux
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - name: Install Nix
-        run: |
-          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
-          mkdir -p "$HOME/.config/nix"
-          echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
       - name: Pre-commit checks (${{ matrix.system }})
-        run: |
-          # shellcheck disable=SC1091
-          source "$HOME/.nix-profile/etc/profile.d/nix.sh"
-          nix build .#checks.${{ matrix.system }}.pre-commit
+        run: nix build .#checks.${{ matrix.system }}.pre-commit