Harden server and add Nix-native CI + self-hosted Gitea Actions

- Add self-hosted Gitea Actions runner module (servers/hetzner/modules/services/gitea.nix)
- Add CI workflow (.gitea/workflows/ci.yml):
  - Flake check (x86_64-linux + aarch64-linux, eval-only)
  - Pre-commit checks (x86_64-linux only)
  - Gitea-native runner (no Docker); Nix from host PATH
  - NIX_CONFIG enables flakes + extra-platforms
- Remove redundant .github/workflows/ci.yml (shadows .gitea)
- Enable deadnix in pre-commit hooks (flake.nix), fix 38 files
- Add statix.toml disabling empty_pattern lint (nixpkgs standard)
- Format whole repo with alejandra (27 files)
- Fix CI nix-not-found: export /run/current-system/sw/bin in PATH
- Remove aarch64 from pre-commit matrix (no QEMU binfmt deployed yet)

servers/hetzner/modules/services/backup.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   backupScript = pkgs.writeShellScript "weekly-backup" ''
     BACKUP_DIR="/home/admin/backups"
     SRC="/home/admin"

servers/hetzner/modules/services/caddy.nix

@@ -1,10 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  domain = "severijnse.eu";
+{...}: let
   antiScrape = ''
     @bad_bot {
       header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*"

servers/hetzner/modules/services/coredns.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   zoneFile = pkgs.writeText "severijnse.eu.db" ''
     $ORIGIN severijnse.eu.
     $TTL 3600

servers/hetzner/modules/services/fail2ban.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   # Keep fail2ban as OCI container to preserve the web UI
   virtualisation.oci-containers.containers.fail2ban = {
     image = "crazymax/fail2ban:latest";

servers/hetzner/modules/services/gitea.nix

@@ -1,7 +1,5 @@
 {
-  config,
   pkgs,
-  lib,
   unstablePkgs,
   ...
 }: {
@@ -98,8 +96,10 @@
   '';
 
   # --- Gitea Actions self-hosted CI runner ---
-  # Jobs install their own Nix inside the runner (official installer,
-  # --no-daemon) so no system Nix daemon / nix-users group is needed.
+  # The native runner only exposes `hostPackages` on PATH (see the list above),
+  # which intentionally omits Nix. CI steps export the host's system Nix
+  # (/run/current-system/sw/bin, i.e. Lix) onto PATH rather than installing a
+  # second Nix client, so the running Lix daemon is used directly.
   # aarch64 builds run under QEMU user-emulation via boot.binfmt below.
   boot.binfmt.emulatedSystems = ["aarch64-linux"];
 }

servers/hetzner/modules/services/mailserver.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.mailserver = {
     image = "ghcr.io/docker-mailserver/docker-mailserver:latest";
     autoStart = true;

servers/hetzner/modules/services/rustdesk.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers = {
     hbbr = {
       image = "rustdesk/rustdesk-server:latest";

servers/hetzner/modules/services/shkeeper.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.shkeeper = {
     image = "vsyshost/shkeeper:2.5.29";
     autoStart = true;

servers/hetzner/modules/services/snappymail.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.snappymail = {
     image = "djmaze/snappymail:latest";
     autoStart = true;

servers/hetzner/modules/services/tlsa-updater.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
+{pkgs, ...}: let
   # Caddy's canonical certificate storage (XDG data dir). Renewals land here,
   # owned caddy:caddy 0600 — the mail server's non-root Postfix/Dovecot cannot
   # read it directly, so we copy it into a world-readable distribution dir.

servers/hetzner/modules/services/vaultwarden.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.vaultwarden = {
     image = "vaultwarden/server:latest";
     autoStart = true;

servers/hetzner/modules/services/watchtower.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.watchtower = {
     image = "ghcr.io/nicholas-fedor/watchtower:latest";
     autoStart = true;

servers/hetzner/modules/services/wireguard.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.wg-easy = {
     image = "ghcr.io/wg-easy/wg-easy:latest";
     autoStart = true;

servers/hetzner/modules/services/wrxproxy.nix

@@ -1,9 +1,4 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
+{...}: {
   virtualisation.oci-containers.containers.wrxproxy = {
     image = "localhost/wrxproxy:latest";
     autoStart = false;