nix: export the CI server as nixosModules.cc-ci-server

The whole server (every service module, the harness tooling, sops wiring,
acme-dns) becomes one reusable module, nix/modules/default.nix, so another
flake can run cc-ci on a host it defines. First consumer: the
cc-ci-orchestrator repo's `#cc-ci` host, which runs the CI server and the
orchestrator together on one Hetzner machine.

Two things the modules hard-coded become options (nix/modules/options.nix):
- cc-ci.publicIPv4 — acme-dns's listen address and ns-acme glue record.
- cc-ci.sopsFile — the secrets.yaml path; defaults to the secrets/ submodule,
  but a consumer that imports cc-ci as a plain input (no private submodule)
  points it at the deployed --recursive checkout and sops-nix reads it at
  activation (validateSopsFiles off for that case).

The standalone host (nix/hosts/cc-ci-hetzner) now only carries hardware,
networking and identity and imports the module via the flake. Verified: the
`#cc-ci` system derivation is byte-identical before and after
(/nix/store/ckp1244bz86fz3qbx81n5kx60c1lak3m-…531670d.drv on both).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

nix/modules/acme-dns.nix

@@ -3,18 +3,19 @@
 # This host is authoritative only for acme.commoninternet.net. Gandi continues
 # to own commoninternet.net; it delegates this narrow zone and one permanent
 # _acme-challenge CNAME manually. No Gandi credential is present here.
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 let
+  publicIPv4 = config.cc-ci.publicIPv4;
   acmeDnsConfig = pkgs.writeText "cc-ci-acme-dns.conf" ''
     [general]
-    listen = "91.98.47.73:53"
+    listen = "${publicIPv4}:53"
     protocol = "both4"
     domain = "acme.commoninternet.net"
     nsname = "ns-acme.commoninternet.net"
     nsadmin = "hostmaster.commoninternet.net"
     records = [
       "acme.commoninternet.net. NS ns-acme.commoninternet.net.",
-      "ns-acme.commoninternet.net. A 91.98.47.73",
+      "ns-acme.commoninternet.net. A ${publicIPv4}",
     ]
     debug = false
 
@@ -48,6 +49,8 @@ let
   '';
 in
 {
+  imports = [ ./options.nix ];
+
   users.groups.acme-dns = { };
   users.users.acme-dns = {
     isSystemUser = true;

nix/modules/default.nix

@@ -0,0 +1,44 @@
+# The cc-ci CI server as ONE reusable NixOS module — exported from flake.nix as
+# `nixosModules.cc-ci-server`. Everything a host needs to BE cc-ci, except what is physical or
+# identity and therefore belongs to the host that imports it: hardware, networking, the tailscale
+# node, root SSH keys, `system.stateVersion`. A host sets `cc-ci.publicIPv4` (and, when it is not
+# built from a --recursive clone, `cc-ci.sopsFile`) and imports this.
+#
+# Consumers: nix/hosts/cc-ci-hetzner (the canonical standalone host) and
+# recipe-maintainers/cc-ci-orchestrator's `#cc-ci` host, which runs the CI server and the
+# orchestrator together (2026-09).
+{ pkgs, ... }:
+{
+  imports = [
+    ./options.nix
+    ./packages.nix
+    ./secrets.nix
+    ./acme-dns.nix
+    ./swarm.nix
+    ./docker-prune.nix
+    ./abra.nix
+    ./proxy.nix
+    ./drone.nix
+    ./drone-runner.nix
+    ./bridge.nix
+    ./dashboard.nix
+    ./reports.nix
+    ./backupbot.nix
+    ./harness.nix
+    ./warm-keycloak.nix
+    ./nightly-sweep.nix
+  ];
+
+  # Recipes bind-mount /etc/localtime and /etc/timezone; the harness compares timestamps across
+  # host and containers, so the host is UTC like every container.
+  time.timeZone = "UTC";
+  environment.etc."timezone".text = "UTC\n";
+
+  # Phase `nixenv`: the Drone exec runner resolves recipe shell-outs from this host PATH
+  # (/run/current-system/sw/bin). Install the SINGLE shared harness tool set (pkgs.ccciRuntimeTools,
+  # defined in packages.nix) so the Drone path and the harness env (cc-ci-run / sweep) can never
+  # diverge.
+  environment.systemPackages = pkgs.ccciRuntimeTools;
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+}

nix/modules/options.nix

@@ -0,0 +1,33 @@
+# The few host-identity values the cc-ci modules need but must not hard-code, so that the same
+# modules can build the canonical Hetzner host, a throwaway rebuild VM, or a combined host that
+# also runs the cc-ci orchestrator (2026-09: recipe-maintainers/cc-ci-orchestrator imports
+# `nixosModules.cc-ci-server` from this repo and runs both on one box).
+{ lib, ... }:
+{
+  options.cc-ci = {
+    publicIPv4 = lib.mkOption {
+      type = lib.types.str;
+      example = "91.98.47.73";
+      description = ''
+        The host's public IPv4 address. acme-dns binds its authoritative listener to it and
+        publishes it as the `ns-acme` glue record. Must match the Gandi A record for
+        ns-acme.commoninternet.net and the address the cc-ci DNS names point at.
+      '';
+    };
+
+    sopsFile = lib.mkOption {
+      type = lib.types.path;
+      default = ../../secrets/secrets.yaml;
+      defaultText = lib.literalExpression "../../secrets/secrets.yaml";
+      example = "/etc/cc-ci/secrets/secrets.yaml";
+      description = ''
+        The sops-encrypted secrets.yaml (recipe-maintainers/cc-ci-secrets). The default is the
+        `secrets/` git submodule inside this repo, which only exists when this flake is built from
+        a `--recursive` clone (`git+file:///root/cc-ci?submodules=1`). A consumer that imports
+        cc-ci as a plain flake input (no submodule) sets this to an absolute path on the host
+        instead — e.g. the `/etc/cc-ci` deployed checkout's `secrets/secrets.yaml` — which
+        sops-nix then reads at activation time rather than copying into the store.
+      '';
+    };
+  };
+}

nix/modules/secrets.nix

@@ -6,8 +6,15 @@
 # off-box master recovery key).
 { config, ... }:
 {
+  imports = [ ./options.nix ];
+
   sops = {
-    defaultSopsFile = ../../secrets/secrets.yaml;
+    # See options.nix: the submodule path by default; an absolute host path on a combined host
+    # that imports cc-ci as a flake input without the private submodule.
+    defaultSopsFile = config.cc-ci.sopsFile;
+    # sops-nix validates store-path sops files at build time. An absolute (string) path is read
+    # at activation instead, so validation has to be off for that case.
+    validateSopsFiles = builtins.isPath config.cc-ci.sopsFile;
     # Decrypt using the host's SSH host key (converted to an age identity by sops-nix).
     age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     # Phase-1c: also accept a bootstrap age key at a fixed path — THE one out-of-band secret,