nix: one Hetzner host for the CI server + the orchestrator (#cc-ci)

The orchestrator's flake now builds the machine it shares with the cc-ci CI
server: `nixosConfigurations.cc-ci` composes cc-ci's nixosModules.cc-ci-server
(new flake input, nixpkgs + sops-nix follow ours), this repo's orchestrator
module (nix/modules/cc-ci.nix, exported as cc-ci-orchestrator, `cc-ci` kept
as an alias for notplants-nix) and the new nix/modules/orchestrator-host.nix
— the host contract those units always assumed (loops user, claude/opencode
CLIs, opencode web server + tailnet-only UI on 8443 since traefik owns
80/443, nix-ld, tool set, `ssh cc-ci` → loopback).

nix/hosts/cc-ci/{hardware,networking}.nix are PROVISIONAL copies of the old
server's layout so the flake evaluates; they get replaced by the
nixos-infect output of 195.201.88.249.

README.md is the deploy guide (Hetzner Debian → nixos-infect → this flake →
staging → data restore → cutover). archive/ holds the retired Incus/Hetzner
orchestrator host configs, the old terraform and the migration plans;
references updated. cc-ci-plan/plan-cc-ci-combined-host.md is the working
plan for the move.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

flake.nix

@@ -1,37 +1,52 @@
 {
-  description = "cc-ci-orchestrator — NixOS host for the cc-ci loops runtime (Builder/Adversary/Watchdog)";
+  description = "cc-ci-orchestrator — the cc-ci orchestrator (loops, steering session, weekly upgrader) and the NixOS host it shares with the cc-ci CI server";
 
   inputs = {
-    # Follow the current stable release channel (operator 2026-08-01), was a hard rev pin at
-    # nixpkgs 24.11 (50ab7937, 2025-06-30) kept "the same as the cc-ci server". This host runs
-    # agents/tmux/nginx/docker, not recipe CI, so it does not need to match that server — and a
-    # frozen rev only accrues unpatched CVEs. `nix flake update` now actually moves.
+    # Stable release channel (operator 2026-08-01). `nix flake update` moves it; the cc-ci input
+    # below FOLLOWS it, so one nixpkgs builds the whole combined host and CVEs get patched once.
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
 
-    # sops-nix follows nixpkgs below, so it no longer needs its own matching pin.
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+
+    # The cc-ci CI server, as a NixOS module (`nixosModules.cc-ci-server`). HTTPS, anonymous read:
+    # nix evaluates every input for every output, so the input must be fetchable without
+    # credentials. The private secrets submodule is deliberately NOT fetched through this input —
+    # the host reads the deployed --recursive checkout's secrets.yaml at activation instead
+    # (`cc-ci.sopsFile`). Both `follows` are REQUIRED: without them cc-ci's own nixpkgs/sops-nix
+    # pins would produce a second sops-nix module tree and a second nixpkgs in one system.
+    cc-ci.url = "git+https://git.autonomic.zone/recipe-maintainers/cc-ci.git?ref=feat/nixos-module-export";
+    cc-ci.inputs.nixpkgs.follows = "nixpkgs";
+    cc-ci.inputs.sops-nix.follows = "sops-nix";
   };
 
-  outputs = { nixpkgs, sops-nix, ... }:
+  outputs = { self, nixpkgs, sops-nix, cc-ci, ... }:
     let
       system = "x86_64-linux";
     in
     {
-      # The cc-ci part of a host, on its own, so a host that runs cc-ci can import just this and
-      # keep its own (unrelated) configuration separate. Split out 2026-08-20; consumed by
-      # notplants-nix's `notplants-orchestrator` host.
-      nixosModules.cc-ci = ./nix/modules/cc-ci.nix;
+      nixosModules = {
+        # The orchestrator itself: loops supervisor, steering session, weekly/hourly timers.
+        cc-ci-orchestrator = ./nix/modules/cc-ci.nix;
+        # The host contract those units assume: loops user, claude/opencode CLIs, opencode web
+        # server + tailnet UI, nix-ld, tool set, `ssh cc-ci` config.
+        orchestrator-host = ./nix/modules/orchestrator-host.nix;
+        # Old name of cc-ci-orchestrator, kept while notplants-nix still imports it (2026-09).
+        cc-ci = ./nix/modules/cc-ci.nix;
+      };
 
-      # Hetzner cpx11 host (nixos-infect generated hardware.nix + orchestrator config).
-      # Provision with terraform/ then run Stage 2 per terraform/README.md.
-      nixosConfigurations.cc-ci-orchestrator-hetzner = nixpkgs.lib.nixosSystem {
-        inherit system;
-        modules = [
-          sops-nix.nixosModules.sops
-          ./nix/hosts/cc-ci-orchestrator-hetzner/hardware.nix
-          ./nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix
-        ];
+      nixosConfigurations = {
+        # THE live host: cc-ci CI server + cc-ci orchestrator on one Hetzner cpx32-class box
+        # (195.201.88.249, since 2026-09). README.md is the deploy guide.
+        cc-ci = nixpkgs.lib.nixosSystem {
+          inherit system;
+          modules = [
+            cc-ci.nixosModules.cc-ci-server
+            self.nixosModules.cc-ci-orchestrator
+            self.nixosModules.orchestrator-host
+            ./nix/hosts/cc-ci/configuration.nix
+          ];
+        };
       };
     };
 }