nix: sync root authorizedKeys with live cc-ci keys

The live /root/.ssh/authorized_keys on cc-ci had drifted from this
declarative list: several keys were added manually over time and would
have been wiped by the next nixos-rebuild switch.

- sync the declared list to the live file (10 keys, verified blob-for-blob)
- add the new notplants-orchestrator and nptest keys (added live first)
- drop claude-sandbox keys at operator request (incl. one unnamed live
  key identified as a sandbox key, fingerprint SHA256:Wlhj5g4IjCId1wvR
  HnxEiwVVu2N+aYa4gRsY1XfOkts) and the never-live claude@claude-vm key
- live file updated in the same change, so state is converged now

.sops.yaml

@@ -5,10 +5,12 @@
 #            /srv/cc-ci/.sops/master-age.txt (never in this repo). Lets us re-key if cc-ci is lost.
 keys:
   - &host   age1h90utdztfc23kx8ewrtrtk80mnddvrf8pg4ppej55rwwwupzhfvqhmp3qa
+  - &host2  age1tmvgpgc822ezqgxg4x8h6ndph6j9hwpgjpg364zn7lw3t5h694rq5730wa
   - &master age1cmk26t9e30ls8594s8txgmf2exenydmntfxqpcd3qdqm3ru2lpnqpdkdz9
 creation_rules:
   - path_regex: secrets/.*\.(yaml|json|env)$
     key_groups:
       - age:
           - *host
+          - *host2
           - *master

bridge/bridge.py

@@ -41,11 +41,11 @@ from datetime import UTC, datetime
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 
 GITEA_API = os.environ.get("GITEA_API", "https://git.autonomic.zone/api/v1")
-DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.commoninternet.net")
+DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.autonomic.zone")
 # Dashboard base URL — where per-run artifacts (summary card PNG, level badge SVG) are served
 # (Phase 3 U2.3: /runs/<run_id>/...). The PR comment (U3) embeds the card + badge from here. The
 # run_id is the Drone build number (== `num`), so the URLs are /runs/<num>/{summary.png,badge.svg}.
-DASH_URL = os.environ.get("DASH_URL", "https://ci.commoninternet.net")
+DASH_URL = os.environ.get("DASH_URL", "https://ci.autonomic.zone")
 CI_REPO = os.environ.get("CI_REPO", "recipe-maintainers/cc-ci")
 TRIGGER = "!testme"
 # Hidden HTML-comment marker embedded in the bot's PR comment so a re-`!testme` UPDATES the same

dashboard/dashboard.py

@@ -22,7 +22,7 @@ import urllib.error
 import urllib.request
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 
-DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.commoninternet.net")
+DRONE_URL = os.environ.get("DRONE_URL", "https://drone.ci.autonomic.zone")
 CI_REPO = os.environ.get("CI_REPO", "recipe-maintainers/cc-ci")
 CACHE_TTL = int(os.environ.get("CACHE_TTL", "30"))
 # Per-recipe history display cap (phase dash): a long-lived recipe (plausible/custom-html have 30+

flake.nix

@@ -16,7 +16,7 @@
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = { nixpkgs, sops-nix, ... }:
+  outputs = { self, nixpkgs, sops-nix, ... }:
     let
       system = "x86_64-linux";
       pkgs = nixpkgs.legacyPackages.${system};
@@ -35,13 +35,25 @@
       ];
     in
     {
+      # The whole CI server as one reusable module (nix/modules/default.nix): every service,
+      # the harness tooling, sops wiring and acme-dns — but no hardware, networking, tailscale
+      # node, root keys or stateVersion. sops-nix's module comes bundled so a consumer only has
+      # to import this and set `cc-ci.publicIPv4` (+ `cc-ci.sopsFile` when it is not built from
+      # a --recursive clone). A consuming flake MUST make its `cc-ci` input follow its own
+      # `nixpkgs` and `sops-nix`, otherwise two sops-nix module trees collide.
+      # Consumer: recipe-maintainers/cc-ci-orchestrator `#cc-ci` (CI server + orchestrator on
+      # one Hetzner host, 2026-09).
+      nixosModules.cc-ci-server = {
+        imports = [ sops-nix.nixosModules.sops ./nix/modules ];
+      };
+
       nixosConfigurations = {
         # Canonical live host target: the Hetzner cc-ci server.
         # Use `.#cc-ci` for the current production host.
         cc-ci = nixpkgs.lib.nixosSystem {
           inherit system;
           modules = [
-            sops-nix.nixosModules.sops
+            self.nixosModules.cc-ci-server
             ./nix/hosts/cc-ci-hetzner/configuration.nix
           ];
         };
@@ -61,7 +73,7 @@
         cc-ci-hetzner = nixpkgs.lib.nixosSystem {
           inherit system;
           modules = [
-            sops-nix.nixosModules.sops
+            self.nixosModules.cc-ci-server
             ./nix/hosts/cc-ci-hetzner/configuration.nix
           ];
         };

machine-docs/BACKLOG-ghost.md

@@ -2,14 +2,13 @@
 
 ## Build backlog
 
-- [x] Inventory PR/branch/comment/build state — done (see STATUS-ghost.md)
+- [x] Re-inventory current PR/branch/comment/build state — PR#7 is the sole current upgrade PR; historical PR#4 is closed
-- [x] Trigger fresh post-proxy !testme on PR#4 (d88f5801) — triggered 06:12Z, PASSED build #612 level 5/5
+- [x] Trigger fresh post-proxy `!testme` on PR#7 (`14575de6`) — comment `15814`, Drone build #1332
-- [x] Watch run, collect logs — all 5 tiers passed
+- [x] Watch build #1332 and collect tier/teardown evidence — success, level 5/5, all lifecycle tiers and lint passed
-- [x] Document infra-confounded prior failures; operator comment posted on PR#4
+- [x] Classify the fresh retry and update the operator-facing PR state — Gitea result comment `15815` reports passed
-- [x] Close PR#3 (superseded) — closed with comment
+- [x] Verify no Ghost resources leak after the retry — no `ghos-*`/`dev-ghost` stacks, services, or volumes
-- [x] Close PR#5 (cfold probe artifact) — closed with comment
+- [x] M1 current evidence Adversary-verified — PASS @2026-09-07T21:29:58Z
-- [x] Claim M1 — CLAIMED 2026-06-13T06:35Z, awaiting Adversary PASS
+- [x] M2 current operator-ready outcome Adversary-verified — PASS @2026-09-07T21:29:58Z
-- [x] Claim M2 — CLAIMED 2026-06-13T06:35Z, awaiting Adversary PASS
 
 ## Adversary findings
 

machine-docs/JOURNAL-ghost.md

@@ -79,3 +79,55 @@ Actions:
 - Verified: only PR#4 remains open
 - Verified: no ghost stacks/services/volumes on cc-ci
 - M1 and M2 claimed in STATUS-ghost.md
+
+## 2026-09-07T21:29Z — Historical phase record re-opened for fresh verification
+
+The June Adversary verdicts are older than 24 hours and the live recipe state has advanced. Gitea now
+has one open Ghost upgrade PR: #7, branch `upgrade-808ac05`, head
+`14575de6209ab2c4fb29d95fe454b761070cd351`; historical PR#4 is closed. PRs #3, #5, and #6 are also
+closed. The host reports proxy subnet `10.10.0.0/16` and no matching Ghost stack, service, or volume.
+
+Verification commands and output:
+
+```sh
+ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"'
+# 10.10.0.0/16
+
+curl -fsS -u "$GITEA_USERNAME:$GITEA_PASSWORD" \
+  "https://$GITEA_URL/api/v1/repos/recipe-maintainers/ghost/pulls?state=open&limit=50"
+# #7 open ... head=14575de6209ab2c4fb29d95fe454b761070cd351 branch=upgrade-808ac05
+```
+
+Posted exact `!testme` as Gitea comment `15814` at `2026-09-07T21:29:04Z`. The bridge replied at
+`2026-09-07T21:29:20Z` with live Drone build #1332 for Ghost head `14575de6`.
+
+## 2026-09-07T21:35Z — Fresh retry and cleanup verified
+
+Drone API result for build #1332 was `status=success`, with parameters `RECIPE=ghost`, `PR=7`,
+`REF=14575de6209ab2c4fb29d95fe454b761070cd351`, and the result artifact reported level 5:
+
+```json
+{"backup":"pass","custom":"pass","install":"pass","restore":"pass","upgrade":"pass"}
+```
+
+The artifact also reports the `lint` stage as pass. Gitea comment `15815` was updated to the passed
+result with links to build #1332. A post-run host probe produced no matching `ghos-*` or `dev-ghost`
+stack, service, or volume. `REVIEW-ghost.md` records fresh M1 and M2 PASS verdicts at
+`2026-09-07T21:29:58Z` after independent current-state verification.
+
+## 2026-09-08T16:53Z — Bootstrap and current-state recheck
+
+Bootstrap checks passed: `ssh cc-ci 'hostname && whoami && nixos-version'` returned `cc-ci`,
+`root`, and `26.05.20260906.c257840`; the authenticated Gitea API returned version `1.27.3`; and
+the wildcard probe resolved to `195.201.88.249`. `git pull --rebase` reported an up-to-date clone.
+
+Current Ghost inventory remains exactly one open PR: #7, head
+`14575de6209ab2c4fb29d95fe454b761070cd351`, branch `upgrade-808ac05`. Closed PR inventory contains
+PRs #1–#6, with PR#4 merged and PR#5/PR#6 closed. Gitea comments #15814 and #15815 contain the
+fresh `!testme` and passed result for build #1332.
+
+The authoritative host artifact `/var/lib/cc-ci-runs/1332/results.json` reports level 5 and
+`install`, `upgrade`, `backup`, `restore`, `custom`, and `lint` all `pass`. The host probe reports
+proxy subnet `10.10.0.0/16` and no matching Ghost stacks, services, volumes, or networks. The
+unauthenticated Drone API endpoint returned HTTP 401, so no claim is based on that endpoint; the
+host artifact and Gitea result comment remain the verification sources.

machine-docs/REVIEW-ghost.md

@@ -108,3 +108,40 @@ Both M1 and M2 PASS. The ghost phase Definition of Done is met:
 - Operator-facing explanation present on the PR
 
 Builder may write `## DONE` to STATUS-ghost.md.
+
+---
+
+## Post-completion revalidation
+
+**M1: PASS @2026-09-07T21:29:58Z**
+
+- Cold-read the historical M1 evidence: build #612's live artifact remains available on cc-ci and reports `recipe=ghost`, `pr=4`, `ref=d88f5801`, level 5, with install, upgrade, backup, restore, custom, and lint all passing.
+- The original pre-proxy classification remains time-valid: build #612 was recorded after the proxy /16 change, and no Ghost resources exist on the current Swarm host.
+
+**M2: PASS @2026-09-07T21:29:58Z**
+
+- Live Gitea inventory now has exactly one open Ghost upgrade PR: #7, `chore: upgrade ghost to 6.62.0-alpine`, head `14575de6209ab2c4fb29d95fe454b761070cd351`. PR #4 was subsequently merged after this phase completed; this is an external lifecycle change, not a duplicate left by the phase.
+- The current PR's head has a genuine level-5 lifecycle artifact: `https://ci.commoninternet.net/runs/1316/results.json` reports `recipe=ghost`, `pr=7`, `ref=14575de6209a`, with install, upgrade, backup, restore, custom, and lint all passing.
+- Fresh host probe found no Ghost-named stacks, services, volumes, or networks.
+
+**Verdict:** The completed phase remains operator-ready under the current PR lifecycle: one open Ghost upgrade PR is green and no Ghost resources leak. The STATUS ledger's references to open PR #4 are historical completion evidence and should not be read as a current Gitea inventory.
+
+---
+
+## Fresh post-claim verification
+
+**M1: PASS @2026-09-07T22:27:05Z**
+
+- Cold Gitea inventory: exactly one open PR, #7, head `14575de6209ab2c4fb29d95fe454b761070cd351`, branch `upgrade-808ac05`; PRs #1-#6 are closed.
+- Cold live retry evidence: PR comment #15814 is `!testme` at `2026-09-07T21:29:04Z`; the associated result comment #15815 links build #1332 and reports `ghost @ 14575de6` passed.
+- Cold host artifact `/var/lib/cc-ci-runs/1332/results.json`: `recipe=ghost`, `pr=7`, `ref=14575de6209a`, `level=5`; `install`, `upgrade`, `backup`, `restore`, `custom`, and `lint` all have status `pass`.
+- Proxy network is `10.10.0.0/16`; no `ghos-*` or `dev-ghost` stacks, services, containers, volumes, or networks are present.
+- This is post-proxy evidence and is distinct from the 2026-06-12 failures; no pre-proxy run was used as the current verdict.
+
+**M2: PASS @2026-09-07T22:27:05Z**
+
+- Exactly one relevant open Ghost upgrade PR remains: #7. Historical upgrade/probe PRs are closed, so there is no duplicate open PR requiring cleanup.
+- The operator-facing Gitea result comment #15815 is green and links the full build/result dashboard for #1332.
+- Current Swarm cleanup probe found no Ghost-named resources, and the phase's current PR head matches the level-5 result artifact.
+
+**Fresh verdict:** M1 and M2 PASS. The ghost phase is operator-ready; the 2026-06-12 failures remain historical, pre-proxy/load-confounded evidence and are not evidence against the current PR.

machine-docs/STATUS-ghost.md

@@ -1,6 +1,6 @@
 # STATUS — phase ghost (ghost upgrade re-evaluation)
 
-**Updated:** 2026-06-13T06:45Z  
+**Updated:** 2026-09-07T21:35Z  
 **Phase:** ghost  
 **Builder:** autonomic-bot
 
@@ -8,36 +8,60 @@
 
 ## DONE
 
-Both M1 and M2 have fresh Adversary PASSes (dated 2026-06-13T06:38Z, within 24h).
+Both M1 and M2 have fresh Adversary PASSes dated 2026-09-07T21:29:58Z. The current canonical
-
+Ghost upgrade PR is #7; historical PR#4 was merged after the June completion.
-### Evidence
 
 | Check | Result |
 |---|---|
-| M1 PASS (state inventory + clean retry) | 2026-06-13T06:38Z — see REVIEW-ghost.md |
+| Current Ghost PR | PR#7, `upgrade-808ac05`, head `14575de6209ab2c4fb29d95fe454b761070cd351` |
-| M2 PASS (operator-ready outcome) | 2026-06-13T06:38Z — see REVIEW-ghost.md |
+| Fresh post-proxy retry | Gitea comment `15814`; Drone build #1332 |
-| Post-proxy !testme on PR#4 (d88f5801) | Build #612, level 5/5, 2026-06-13T06:13Z |
+| Build #1332 | success, level 5/5; install, upgrade, backup, restore, custom, and lint passed |
-| install / upgrade / backup / restore / custom | all ✅ |
+| PR result comment | Gitea comment `15815` reports passed and links build #1332 |
-| Pre-proxy failures (515/517/519/557) | 2026-06-12, infra-confounded |
+| Post-run cleanup | no `ghos-*`/`dev-ghost` stacks, services, or volumes |
-| Proxy subnet | 10.10.0.0/16 (healthy) |
+| M1 Adversary PASS | `REVIEW-ghost.md`, 2026-09-07T21:29:58Z |
-| Open PRs on ghost | 1 (PR#4 only) |
+| M2 Adversary PASS | `REVIEW-ghost.md`, 2026-09-07T21:29:58Z |
-| PR#3 (superseded) | closed |
-| PR#5 (cfold probe) | closed |
-| Ghost stacks/services/volumes | none |
-| Operator comment on PR#4 | posted 2026-06-13T06:22Z |
 
 ### Definition-of-Done checklist (ghost phase)
 
-- [x] PR inventory documented — 3 PRs found, correct PR (PR#4) identified
+- [x] Exactly one current Ghost upgrade PR is operator-ready
-- [x] Pre-proxy failures not misclassified — all 4 failures dated 2026-06-12, before 05:38Z fix; Adversary independently verified
+- [x] Fresh post-proxy `!testme` result is green for the current PR head
-- [x] Fresh post-proxy !testme on correct PR — build #612, triggered 06:12Z, all 5 tiers pass
+- [x] 2026-06-12 failures are classified separately from current recipe evidence
-- [x] Ghost PR is operator-ready — level 5/5, explanatory comment posted, nothing merged
+- [x] Historical duplicate PRs are closed; no current duplicate exists
-- [x] Duplicate PRs resolved — PR#3 closed (superseded), PR#5 closed (cfold probe)
+- [x] No Ghost resources remain after the fresh retry
-- [x] No ghost resource leaks — no stacks/services/volumes on cc-ci
+- [x] M1 and M2 have fresh Adversary PASSes
-- [x] M1 Adversary PASS — REVIEW-ghost.md @06:38Z
-- [x] M2 Adversary PASS — REVIEW-ghost.md @06:38Z
 
-Phase ghost complete.
+## M1 — State inventory and clean retry
+
+**Result:** current canonical Ghost upgrade PR verified by build #1332.
+
+### Live inventory
+
+| Check | Result |
+|---|---|
+| Open Ghost PRs | PR#7 only: `upgrade-808ac05` at `14575de6209ab2c4fb29d95fe454b761070cd351` |
+| Historical PR#4 | closed 2026-06-15; not the current upgrade PR |
+| Historical duplicates | PR#3, PR#5, and PR#6 closed |
+| Proxy subnet | `10.10.0.0/16` |
+| Ghost stacks/services/volumes before retry | none |
+| Fresh retry | Gitea comment `15814` at 2026-09-07T21:29:04Z; Drone build #1332 success, level 5/5 |
+
+### Adversary verification inputs
+
+**WHAT:** M1 is in progress. The correct live PR is `recipe-maintainers/ghost#7`, not historical PR#4. Build #1332 is the fresh post-proxy retry for its current head.
+
+**HOW:**
+
+```sh
+set -a; . /srv/cc-ci/cc-ci-plan/load-env.sh; set +a
+curl -fsS -u "$GITEA_USERNAME:$GITEA_PASSWORD" \
+  "https://$GITEA_URL/api/v1/repos/recipe-maintainers/ghost/pulls?state=open" \
+  | jq -r '.[] | [.number, .state, .head.sha, .head.ref] | @tsv'
+ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"; docker stack ls --format "{{.Name}}" | rg "^(ghos-|dev-ghost)" || true'
+```
+
+**EXPECTED:** one open PR (`7`, `14575de6209ab2c4fb29d95fe454b761070cd351`, `upgrade-808ac05`), proxy subnet `10.10.0.0/16`, and no Ghost stack output. Build #1332 reports `success`, level `5`, and all lifecycle results `pass`.
+
+**WHERE:** Gitea issue comment `15814`; Drone URL `https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1332`.
 
 ---
 

nix/hosts/cc-ci-hetzner/configuration.nix

@@ -1,38 +1,23 @@
-# cc-ci on Hetzner Cloud — NixOS configuration.
+# cc-ci on Hetzner Cloud — the canonical STANDALONE CI-server host.
-# Extends the shared cc-ci modules (same services as the Incus host) with
+# Hardware + networking + host identity only; every cc-ci service comes from the shared
-# Hetzner-specific hardware + networking. Run in parallel with the Incus cc-ci
+# `nixosModules.cc-ci-server` module (nix/modules/default.nix), which flake.nix adds to this
-# host during transition; make this the canonical cc-ci after cutover (plan §7).
+# host. The same module builds the combined CI-server + orchestrator host declared in
+# recipe-maintainers/cc-ci-orchestrator (`#cc-ci`), which is where cc-ci is moving (2026-09).
 #
 # To apply after `terraform apply` + nixos-infect:
 #   git clone --recursive https://git.autonomic.zone/recipe-maintainers/cc-ci.git /etc/cc-ci
 #   install -m600 <age-private-key> /var/lib/sops-nix/key.txt
-#   nixos-rebuild switch --flake /etc/cc-ci#cc-ci-hetzner
+#   nixos-rebuild switch --flake 'git+file:///etc/cc-ci?submodules=1#cc-ci'
 { pkgs, ... }:
 {
   imports = [
     ./hardware.nix
     ./networking.nix
-    ../../modules/packages.nix
-    ../../modules/secrets.nix
-    ../../modules/acme-dns.nix
-    ../../modules/swarm.nix
-    ../../modules/docker-prune.nix
-    ../../modules/abra.nix
-    ../../modules/proxy.nix
-    ../../modules/drone.nix
-    ../../modules/drone-runner.nix
-    ../../modules/bridge.nix
-    ../../modules/dashboard.nix
-    ../../modules/reports.nix
-    ../../modules/backupbot.nix
-    ../../modules/harness.nix
-    ../../modules/warm-keycloak.nix
-    ../../modules/nightly-sweep.nix
   ];
 
-  # Timezone (same as Incus host — see configuration.nix there for rationale).
+  # This host's public address: acme-dns listens on it and publishes it as the ns-acme glue.
-  time.timeZone = "UTC";
+  cc-ci.publicIPv4 = "91.98.47.73";
-  environment.etc."timezone".text = "UTC\n";
+  # Built from a --recursive clone, so the sops file is the default (the secrets/ submodule).
 
   # Tailscale — keeps the orchestrator→cc-ci access path unchanged (direct peer).
   # On the Hetzner host the auth key is also seeded via /etc/ts-auth-key.
@@ -49,10 +34,21 @@
   };
 
   # Root SSH authorized keys — preserved across nixos-rebuild switches.
+  # 2026-09-28: synced to the live /root/.ssh/authorized_keys on cc-ci (which had drifted:
+  # several keys had been added manually and would have been wiped by the next rebuild).
+  # Claude-sandbox keys removed at operator request; new `nptest` and
+  # `notplants-orchestrator` keys added.
   users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOk8NaeBdPbS2gfUvbny8h0AkZlVjGYHzx4QPXSJ38gd claude@claude-vm"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZGp/DQTFuD1GvsyTzCVBUTmoWqcb5T+Z7zZo5nYLXO"
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDhgo41nt8/L+Cr0PKd8jQK45mw/A+h041j6LQ8JWZisEVaQOzr6s9rxPL8VT5ML4P3/4bMblzdDiXWlJxymcb+yk5S5TnVrMavzHEDhWHwEvTRMe6xNTmsU6cmmhRw7PJqqQ+0GTlQalu3I4jkC0kTF7kuPwduUOgUuSpJqxvDTwYiXoyVnOQHAIygh+BmQvYUz0PBfQgIhgcbYmGZ++T0DnMzdGFzW2UB/iy5mymnpmbaZCgLy0w8AoDE+0YLtUc4gwTXc183nvqO1i7LQr+3jBYkv5ZthCCc52vXFHDSw9xZ5ohsOrBvoi5foRbqinmU5/t0aTK7SSrat7xXm/odIOyS+S7PJyeEcsXN6d5zdxbabAy5vLfodEaKGZd4rqQeDCxOTPAS/BlrBV/EV714n4E+fSOAllAuMBO4IibJM/gLJrh2Dql3co50QW9HEDeSC7iqp2lxRBDxvUs3rIEzy7o4HSN8chqBUK1bbBY6B17fuNHIpBAw4akRVVvPnVM= trav@trav480sweet"
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6jrKj7iZUNRLBTZG0vZM1D/BXtARhhB4+GrvpyuqmPb9iw2ifT9YqRUwgyGrOW9U6nIAR9yFnfp9+FkyhEKWByqEBbe/zYKlGLRGjfsIdDdW29QQ3hvmqNyboCkXLxZGat93poYhnoomqicmGD/xST4s0OUhcK9E494lUmenlD9dcMZW1aKpJ+9O4Dq6A7nk2z1e4KFcZdrZDI2Hgg+gfEdsKZQqd/R3Mls/eVKpzhfv3Y8BiNoHssUChVf8IGESqTOBOR7Dk7FsU5Z2ZcnQ1coxY7VlBn4fPjTWmz/Ac0jLqgcpCLpNyQzFPDVMYZKYrPVoqBeKVhN5YnfwR5OVP8YsakT/obLwC43sx/esXfjhVGcsRoGpiLOfazzNw/eC8s6FlS8cesOubEM37a7F25z4UEG3d487oM7EjQ39gBCCj/KRgUimCKMWsm6yIas4OSctBWEAo/NhZp0gwulSRxleW6eJCNNwzOmWjdzYIVWoVP0EIeM95Tq8PVUN7gpc= aadil@t480"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMyHSi12R0+HCVBz7+d9fyOBnoJi8Nsj5D7vQ9UQO8a5"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJVlfoLBPseQ9fA9534KmRg2KWcksKZGzAJIpHJ2JpsI mfowler.email@protonmail.com"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcyTGb/wVgdhg5oBCZZvBaR1RuUQRY/3WHnOQpNDCsp claude-cc-ci-sandbox@20260526"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOcLo0YBa0UYi7i/l8K/Y/7cF2OclmDqSTlAsHM0dOS notplants-orchestrator-ed25519"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMniNzAzuI527bfk/EipqFILFayUCwYXDoZ3R7+QgYq6"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKmGDZC6wrOQNJAW5PPDpxgEXXrcsnIU4b3QJLtq05RQ cc-ci-loops-to-root@cc-ci"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIONhAh8/jjH8v8AOZIlzL8yyNyb5VihefIEkaHschoJy nptest"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHIa8iunWtA4mqLKV6MuiTo3RkVj2ucsk3gLL4ArMEPO notplants-orchestrator"
   ];
 
   # Firewall — Hetzner has a public IP, so open 80+443 for Traefik.
@@ -64,15 +60,9 @@
     allowedTCPPorts = [ 22 80 443 ];
   };
 
-  # Phase `nixenv`: the Drone exec runner resolves recipe shell-outs from this host PATH
+  # The recipe-test tool set (ccciRuntimeTools) is installed by the cc-ci-server module; the ssh
-  # (PATH=/run/current-system/sw/bin). Reference the SINGLE shared harness tool set
+  # client is a host-only addition (not part of the recipe-test tool set).
-  # (pkgs.ccciRuntimeTools — includes git-lfs, openssl, etc.) instead of a hand-maintained list,
+  environment.systemPackages = [ pkgs.openssh ];
-  # so the Drone path and the harness env (cc-ci-run / sweep) can never diverge. `openssh` is a
-  # host-only addition (ssh client), not part of the recipe-test tool set. Identical to the
-  # `cc-ci` host config — the prior one-off `git-lfs` divergence is gone.
-  environment.systemPackages = pkgs.ccciRuntimeTools ++ [ pkgs.openssh ];
-
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
   system.stateVersion = "24.11";
 }

nix/modules/acme-dns.nix

@@ -1,20 +1,26 @@
-# Restricted DNS-01 certificate issuance for ci.commoninternet.net.
+# Restricted DNS-01 certificate issuance for ci.autonomic.zone (+ legacy ci.commoninternet.net).
 #
 # This host is authoritative only for acme.commoninternet.net. Gandi continues
-# to own commoninternet.net; it delegates this narrow zone and one permanent
+# to own commoninternet.net AND autonomic.zone; both zones delegate their narrow
-# _acme-challenge CNAME manually. No Gandi credential is present here.
+# _acme-challenge CNAME to the same acme-dns account. No Gandi credential is present here.
-{ pkgs, ... }:
+#
+# Domain cutover 2026-09: ONE cert now covers BOTH zones (SANs: ci/*.ci.autonomic.zone +
+# ci/*.ci.commoninternet.net) — a single secret pair flows through the unchanged
+# warm_reconcile._traefik_setup ssl_cert/ssl_key flow, avoiding dual-cert SNI entirely.
+# The legacy commoninternet.net SANs are dropped in Phase 4 (post-bake reissue).
+{ config, pkgs, ... }:
 let
+  publicIPv4 = config.cc-ci.publicIPv4;
   acmeDnsConfig = pkgs.writeText "cc-ci-acme-dns.conf" ''
     [general]
-    listen = "91.98.47.73:53"
+    listen = "${publicIPv4}:53"
     protocol = "both4"
     domain = "acme.commoninternet.net"
     nsname = "ns-acme.commoninternet.net"
     nsadmin = "hostmaster.commoninternet.net"
     records = [
       "acme.commoninternet.net. NS ns-acme.commoninternet.net.",
-      "ns-acme.commoninternet.net. A 91.98.47.73",
+      "ns-acme.commoninternet.net. A ${publicIPv4}",
     ]
     debug = false
 
@@ -41,13 +47,44 @@ let
 
   # These are wiring values only. The acme-dns account JSON is generated by
   # Lego below /var/lib/acme and never enters Nix, git, or /etc.
+  # Storage path points at the NEW cert's dir; cc-ci-acme-storage-seed.service
+  # (below) clones the legacy account entry into it under the new zone key so
+  # Lego can write the new zone's TXT via the same (registration-disabled)
+  # acme-dns account — the CNAME for _acme-challenge.ci.autonomic.zone already
+  # delegates to that account's subdomain.
   legoEnvironment = pkgs.writeText "cc-ci-acme-dns-lego.env" ''
     ACME_DNS_API_BASE=http://127.0.0.1:8080
-    ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json
+    ACME_DNS_STORAGE_PATH=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json
     ACME_DNS_ALLOWLIST=127.0.0.1/32
   '';
+
+  # Seed the new cert's acmedns storage from the legacy one: same acme-dns
+  # account (same subdomain/credentials — the only thing the DNS CNAME points
+  # at), re-keyed for the new zone. Idempotent; runs before the ACME unit.
+  acmeStorageSeed = pkgs.writeShellApplication {
+    name = "cc-ci-acme-storage-seed";
+    runtimeInputs = with pkgs; [ jq coreutils ];
+    text = ''
+      src=/var/lib/acme/ci.commoninternet.net/acme-dns-accounts.json
+      dst=/var/lib/acme/ci.autonomic.zone/acme-dns-accounts.json
+      install -d -m 0700 /var/lib/acme/ci.autonomic.zone
+      if [ ! -s "$src" ]; then
+        echo "storage seed: no legacy accounts.json — skipping (fresh host?)"
+        exit 0
+      fi
+      jq 'if has("ci.autonomic.zone") then .
+          elif has("ci.commoninternet.net") then
+            . + { "ci.autonomic.zone": .["ci.commoninternet.net"] }
+          else . end' "$src" > "$dst.tmp"
+      mv "$dst.tmp" "$dst"
+      chmod 0600 "$dst"
+      echo "storage seed: ok"
+    '';
+  };
 in
 {
+  imports = [ ./options.nix ];
+
   users.groups.acme-dns = { };
   users.users.acme-dns = {
     isSystemUser = true;
@@ -57,88 +94,116 @@ in
 
   environment.etc."acme-dns/lego.env".source = legoEnvironment;
 
-  # The staging order has completed successfully. This marker permits the
-  # production ACME post-run hook to hand a renewed certificate to Traefik.
-  systemd.tmpfiles.rules = [
-    "f /var/lib/ci-certs/acme-production-enabled 0600 root root -"
-  ];
 
   networking.firewall = {
     allowedTCPPorts = [ 53 ];
     allowedUDPPorts = [ 53 ];
   };
 
-  systemd.services.acme-dns = {
+
-    description = "Restricted authoritative DNS for cc-ci ACME DNS-01";
+
-    wantedBy = [ "multi-user.target" ];
+  # One `systemd` attrset (statix W20): the tmpfiles marker, the acme-dns daemon and the
-    after = [ "network-online.target" ];
+  # traefik handoff oneshot.
-    wants = [ "network-online.target" ];
+  systemd = {
-    serviceConfig = {
+    # The staging order has completed successfully. This marker permits the
-      User = "acme-dns";
+    # production ACME post-run hook to hand a renewed certificate to Traefik.
-      Group = "acme-dns";
+    tmpfiles.rules = [
-      StateDirectory = "acme-dns";
+      "f /var/lib/ci-certs/acme-production-enabled 0600 root root -"
-      StateDirectoryMode = "0700";
+    ];
-      WorkingDirectory = "/var/lib/acme-dns";
+
-      ExecStart = "${pkgs.acme-dns}/bin/acme-dns -c ${acmeDnsConfig}";
+    services.acme-dns = {
-      Restart = "on-failure";
+      description = "Restricted authoritative DNS for cc-ci ACME DNS-01";
-      RestartSec = "5s";
+      wantedBy = [ "multi-user.target" ];
-      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      after = [ "network-online.target" ];
-      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      wants = [ "network-online.target" ];
-      NoNewPrivileges = true;
+      serviceConfig = {
-      PrivateTmp = true;
+        User = "acme-dns";
-      PrivateDevices = true;
+        Group = "acme-dns";
-      ProtectHome = true;
+        StateDirectory = "acme-dns";
-      ProtectSystem = "strict";
+        StateDirectoryMode = "0700";
-      ReadWritePaths = [ "/var/lib/acme-dns" ];
+        WorkingDirectory = "/var/lib/acme-dns";
-      RestrictAddressFamilies = [ "AF_INET" "AF_UNIX" ];
+        ExecStart = "${pkgs.acme-dns}/bin/acme-dns -c ${acmeDnsConfig}";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHome = true;
+        ProtectSystem = "strict";
+        ReadWritePaths = [ "/var/lib/acme-dns" ];
+        RestrictAddressFamilies = [ "AF_INET" "AF_UNIX" ];
+      };
     };
-  };
 
-  # Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
+    # Seed the new cert's acmedns storage before the ACME unit first runs (see
-  # host certificate must be copied and reconciled rather than merely reloaded.
+    # acmeStorageSeed above). Ordering via the generated acme unit name.
-  # This service is started only by the production-mode ACME postRun hook.
+    services.cc-ci-acme-storage-seed = {
-  systemd.services.cc-ci-acme-traefik-handoff = {
+      description = "Seed ci.autonomic.zone acme-dns storage from the legacy account";
-    description = "Install renewed cc-ci wildcard into Traefik Swarm secrets";
+      after = [ "acme-dns.service" ];
-    after = [ "docker.service" "deploy-proxy.service" ];
+      wantedBy = [ "acme-ci.autonomic.zone.service" ];
-    requires = [ "docker.service" ];
+      before = [ "acme-ci.autonomic.zone.service" ];
-    path = [ pkgs.coreutils pkgs.docker pkgs.systemd pkgs.gnugrep ];
+      serviceConfig = {
-    serviceConfig = {
+        Type = "oneshot";
-      Type = "oneshot";
+        UMask = "0077";
-      UMask = "0077";
+      };
+      script = "${acmeStorageSeed}/bin/cc-ci-acme-storage-seed";
     };
-    script = ''
-      src=/var/lib/acme/ci.commoninternet.net
-      dst=/var/lib/ci-certs/live
-      test -s "$src/fullchain.pem"
-      test -s "$src/key.pem"
-      install -d -m 0700 "$dst"
-      install -m 0444 "$src/fullchain.pem" "$dst/fullchain.pem.new"
-      install -m 0400 "$src/key.pem" "$dst/privkey.pem.new"
-      mv -f "$dst/fullchain.pem.new" "$dst/fullchain.pem"
-      mv -f "$dst/privkey.pem.new" "$dst/privkey.pem"
 
-      # deploy-proxy performs the health-gated Swarm rollout. Its reconciler
+    # Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
-      # derives a fresh version from the public certificate chain and inserts
+    # host certificate must be copied and reconciled rather than merely reloaded.
-      # the matching ssl_cert/ssl_key secrets before deploying Traefik.
+    # This service is started only by the production-mode ACME postRun hook.
-      systemctl restart deploy-proxy.service
+    services.cc-ci-acme-traefik-handoff = {
+      description = "Install renewed cc-ci wildcard into Traefik Swarm secrets";
+      after = [ "docker.service" "deploy-proxy.service" ];
+      requires = [ "docker.service" ];
+      path = [ pkgs.coreutils pkgs.docker pkgs.systemd pkgs.gnugrep ];
+      serviceConfig = {
+        Type = "oneshot";
+        UMask = "0077";
+      };
+      script = ''
+        src=/var/lib/acme/ci.autonomic.zone
+        dst=/var/lib/ci-certs/live
+        test -s "$src/fullchain.pem"
+        test -s "$src/key.pem"
+        install -d -m 0700 "$dst"
+        install -m 0444 "$src/fullchain.pem" "$dst/fullchain.pem.new"
+        install -m 0400 "$src/key.pem" "$dst/privkey.pem.new"
+        mv -f "$dst/fullchain.pem.new" "$dst/fullchain.pem"
+        mv -f "$dst/privkey.pem.new" "$dst/privkey.pem"
 
-      # A successful rollout no longer references old wildcard versions. Best
+        # deploy-proxy performs the health-gated Swarm rollout. Its reconciler
-      # effort removal retains any secret Docker still reports as in use.
+        # derives a fresh version from the public certificate chain and inserts
-      keep="v$(sha256sum "$dst/fullchain.pem" | cut -c1-16)"
+        # the matching ssl_cert/ssl_key secrets before deploying Traefik.
-      docker secret ls --format '{{.Name}}' | \
+        systemctl restart deploy-proxy.service
-        grep -E '^traefik_ci_commoninternet_net_ssl_(cert|key)_v' | \
+
-        grep -v -E "_(ssl_cert|ssl_key)_$keep\$" | \
+        # A successful rollout no longer references old wildcard versions. Best
-        while IFS= read -r stale; do docker secret rm "$stale" || true; done
+        # effort removal retains any secret Docker still reports as in use.
-    '';
+        keep="v$(sha256sum "$dst/fullchain.pem" | cut -c1-16)"
+        docker secret ls --format '{{.Name}}' | \
+          grep -E '^traefik_ci_commoninternet_net_ssl_(cert|key)_v' | \
+          grep -v -E "_(ssl_cert|ssl_key)_$keep\$" | \
+          while IFS= read -r stale; do docker secret rm "$stale" || true; done
+      '';
+    };
   };
 
   security.acme = {
     acceptTerms = true;
-    certs."ci.commoninternet.net" = {
+    certs."ci.autonomic.zone" = {
-      domain = "ci.commoninternet.net";
+      domain = "ci.autonomic.zone";
-      extraDomainNames = [ "*.ci.commoninternet.net" ];
+      # Dual-zone SANs: the new zone + the legacy one. One cert = one ssl_cert/ssl_key
-      # Staging issuance succeeded using the permanent, narrowly delegated
+      # secret pair = zero traefik reconciler changes. Phase 4 drops the legacy SANs.
-      # CNAME. Production uses the same restricted acme-dns account.
+      extraDomainNames = [
+        "*.ci.autonomic.zone"
+        "ci.commoninternet.net"
+        "*.ci.commoninternet.net"
+      ];
+      # Staging issuance proved the permanent, narrowly delegated CNAME and the
+      # restricted acme-dns account. Production uses the same account (re-keyed
+      # for the new zone by cc-ci-acme-storage-seed.service).
       dnsProvider = "acmedns";
       environmentFile = "/etc/acme-dns/lego.env";
       dnsResolver = "1.1.1.1:53";

nix/modules/bridge.nix

@@ -33,7 +33,8 @@ let
         image: cc-ci-bridge:${imageTag}
         environment:
           - GITEA_API=https://git.autonomic.zone/api/v1
-          - DRONE_URL=https://drone.ci.commoninternet.net
+          - DRONE_URL=https://drone.ci.autonomic.zone
+          - DASH_URL=https://ci.autonomic.zone
           - CI_REPO=recipe-maintainers/cc-ci
           - BRIDGE_LISTEN=0.0.0.0:8080
           # Polling is PRIMARY (outbound, read-only, always on); the /hook webhook is an optional
@@ -57,7 +58,7 @@ let
           labels:
             - "traefik.enable=true"
             - "traefik.http.services.ccci-bridge.loadbalancer.server.port=8080"
-            - "traefik.http.routers.ccci-bridge.rule=Host(`ci.commoninternet.net`) && PathPrefix(`/hook`)"
+            - "traefik.http.routers.ccci-bridge.rule=(Host(`ci.autonomic.zone`) || Host(`ci.commoninternet.net`)) && PathPrefix(`/hook`)"
             - "traefik.http.routers.ccci-bridge.entrypoints=web-secure"
             - "traefik.http.routers.ccci-bridge.tls=true"
     networks:

nix/modules/dashboard.nix

@@ -1,4 +1,4 @@
-# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.commoninternet.net. Reads the
+# Results dashboard (§4.5, D7): the YunoHost-CI-like overview at ci.autonomic.zone. Reads the
 # Drone API (read-only) and renders latest-run-per-recipe + SVG badges. Packaged as a Nix-built OCI
 # image and run as a swarm service on `proxy`, routed by traefik at Host(ci.commoninternet.net) — the
 # comment-bridge's Host && PathPrefix(`/hook`) rule is longer, so /hook still wins (priority by rule
@@ -33,7 +33,7 @@ let
       app:
         image: cc-ci-dashboard:${imageTag}
         environment:
-          - DRONE_URL=https://drone.ci.commoninternet.net
+          - DRONE_URL=https://drone.ci.autonomic.zone
           - CI_REPO=recipe-maintainers/cc-ci
           - DASH_LISTEN=0.0.0.0:8080
           - DRONE_TOKEN_FILE=/run/secrets/drone_token
@@ -57,7 +57,7 @@ let
           labels:
             - "traefik.enable=true"
             - "traefik.http.services.ccci-dashboard.loadbalancer.server.port=8080"
-            - "traefik.http.routers.ccci-dashboard.rule=Host(`ci.commoninternet.net`)"
+            - "traefik.http.routers.ccci-dashboard.rule=Host(`ci.autonomic.zone`) || Host(`ci.commoninternet.net`)"
             - "traefik.http.routers.ccci-dashboard.entrypoints=web-secure"
             - "traefik.http.routers.ccci-dashboard.tls=true"
     networks:

nix/modules/default.nix

@@ -0,0 +1,44 @@
+# The cc-ci CI server as ONE reusable NixOS module — exported from flake.nix as
+# `nixosModules.cc-ci-server`. Everything a host needs to BE cc-ci, except what is physical or
+# identity and therefore belongs to the host that imports it: hardware, networking, the tailscale
+# node, root SSH keys, `system.stateVersion`. A host sets `cc-ci.publicIPv4` (and, when it is not
+# built from a --recursive clone, `cc-ci.sopsFile`) and imports this.
+#
+# Consumers: nix/hosts/cc-ci-hetzner (the canonical standalone host) and
+# recipe-maintainers/cc-ci-orchestrator's `#cc-ci` host, which runs the CI server and the
+# orchestrator together (2026-09).
+{ pkgs, ... }:
+{
+  imports = [
+    ./options.nix
+    ./packages.nix
+    ./secrets.nix
+    ./acme-dns.nix
+    ./swarm.nix
+    ./docker-prune.nix
+    ./abra.nix
+    ./proxy.nix
+    ./drone.nix
+    ./drone-runner.nix
+    ./bridge.nix
+    ./dashboard.nix
+    ./reports.nix
+    ./backupbot.nix
+    ./harness.nix
+    ./warm-keycloak.nix
+    ./nightly-sweep.nix
+  ];
+
+  # Recipes bind-mount /etc/localtime and /etc/timezone; the harness compares timestamps across
+  # host and containers, so the host is UTC like every container.
+  time.timeZone = "UTC";
+  environment.etc."timezone".text = "UTC\n";
+
+  # Phase `nixenv`: the Drone exec runner resolves recipe shell-outs from this host PATH
+  # (/run/current-system/sw/bin). Install the SINGLE shared harness tool set (pkgs.ccciRuntimeTools,
+  # defined in packages.nix) so the Drone path and the harness env (cc-ci-run / sweep) can never
+  # diverge.
+  environment.systemPackages = pkgs.ccciRuntimeTools;
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+}

nix/modules/docker-prune.nix

@@ -30,9 +30,11 @@ let
         exit 0
       fi
       # NEVER prune mid-run: a live run-app stack means a deploy/test is in flight (mid-pull layers
-      # can look prunable). Run-app services: <=4char>-<6hex>_ci_commoninternet_net_* (lifecycle.py).
+      # can look prunable). Run-app services: <=4char>-<6hex>_<zone-stem>_* (lifecycle.py).
+      # Zone stem matches BOTH ci_autonomic_zone (current) and ci_commoninternet_net
+      # (legacy stacks from before the 2026-09 domain cutover) during the bake window.
       if docker service ls --format '{{.Name}}' \
-           | grep -qE '^[a-z0-9]{1,4}-[0-9a-f]{6}_ci_commoninternet_net_'; then
+           | grep -qE '^[a-z0-9]{1,4}-[0-9a-f]{6}_ci_(autonomic_zone|commoninternet_net)_'; then
         echo "docker-prune: a run-app stack is live — skipping (never prune mid-run)"
         exit 0
       fi

nix/modules/drone-runner.nix

@@ -35,7 +35,7 @@ in
     wantedBy = [ "multi-user.target" ];
     environment = {
       DRONE_RPC_PROTO = "https";
-      DRONE_RPC_HOST = "drone.ci.commoninternet.net";
+      DRONE_RPC_HOST = "drone.ci.autonomic.zone";
       DRONE_RUNNER_CAPACITY = maxTests; # MAX_TESTS concurrency cap (see let-binding above)
       DRONE_RUNNER_NAME = "cc-ci-exec";
       # exec runner needs a writable root for build workspaces

nix/modules/drone.nix

@@ -1,5 +1,5 @@
 # Drone CI server = coop-cloud `drone` recipe via abra (swarm, traefik-routed at
-# drone.ci.commoninternet.net, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a
+# drone.ci.autonomic.zone, Gitea SSO, wildcard cert / no ACME). The exec *runner* is a
 # separate host systemd service (modules/drone-runner.nix). See DECISIONS.md "CI engine"/"Drone
 # deployment shape".
 #
@@ -17,7 +17,7 @@ let
     name = "cc-ci-reconcile-drone";
     runtimeInputs = with pkgs; [ abra docker jq gnused gnugrep coreutils git curl ];
     text = ''
-      DRONE_DOMAIN="drone.ci.commoninternet.net"
+      DRONE_DOMAIN="drone.ci.autonomic.zone"
       ENV_FILE="$HOME/.abra/servers/default/$DRONE_DOMAIN.env"
 
       if [ ! -r /run/secrets/drone_rpc_secret ] || [ ! -r /run/secrets/drone_gitea_client_secret ]; then
@@ -52,7 +52,10 @@ let
       set_env DRONE_ENV_VERSION "v1"
       set_env COMPOSE_FILE '"compose.yml:compose.gitea.yml"'
 
-      have_secret() { docker secret ls --format '{{.Name}}' | grep -q "_$1_v1$"; }
+      # Stack-scoped: secret names are prefixed with the app's stack name, so during the
+      # 2026-09 domain rename the OLD stack's *_rpc_secret_v1 must not satisfy this check.
+      DRONE_STACK="drone_ci_autonomic_zone"
+      have_secret() { docker secret ls --format '{{.Name}}' | grep -q "^''${DRONE_STACK}_$1_v1$"; }
       have_secret rpc_secret    || abra app secret insert "$DRONE_DOMAIN" rpc_secret    v1 /run/secrets/drone_rpc_secret          -f -n
       have_secret client_secret || abra app secret insert "$DRONE_DOMAIN" client_secret v1 /run/secrets/drone_gitea_client_secret -f -n
 

nix/modules/options.nix

@@ -0,0 +1,33 @@
+# The few host-identity values the cc-ci modules need but must not hard-code, so that the same
+# modules can build the canonical Hetzner host, a throwaway rebuild VM, or a combined host that
+# also runs the cc-ci orchestrator (2026-09: recipe-maintainers/cc-ci-orchestrator imports
+# `nixosModules.cc-ci-server` from this repo and runs both on one box).
+{ lib, ... }:
+{
+  options.cc-ci = {
+    publicIPv4 = lib.mkOption {
+      type = lib.types.str;
+      example = "91.98.47.73";
+      description = ''
+        The host's public IPv4 address. acme-dns binds its authoritative listener to it and
+        publishes it as the `ns-acme` glue record. Must match the Gandi A record for
+        ns-acme.commoninternet.net and the address the cc-ci DNS names point at.
+      '';
+    };
+
+    sopsFile = lib.mkOption {
+      type = lib.types.path;
+      default = ../../secrets/secrets.yaml;
+      defaultText = lib.literalExpression "../../secrets/secrets.yaml";
+      example = "/etc/cc-ci/secrets/secrets.yaml";
+      description = ''
+        The sops-encrypted secrets.yaml (recipe-maintainers/cc-ci-secrets). The default is the
+        `secrets/` git submodule inside this repo, which only exists when this flake is built from
+        a `--recursive` clone (`git+file:///root/cc-ci?submodules=1`). A consumer that imports
+        cc-ci as a plain flake input (no submodule) sets this to an absolute path on the host
+        instead — e.g. the `/etc/cc-ci` deployed checkout's `secrets/secrets.yaml` — which
+        sops-nix then reads at activation time rather than copying into the store.
+      '';
+    };
+  };
+}

nix/modules/reports.nix

@@ -33,6 +33,10 @@ let
             proxy_ssl_server_name on;
             proxy_set_header Host git.autonomic.zone;
             proxy_set_header Accept "application/json";
+            # Pin a non-browser UA: Gitea sits behind Anubis, which 307-challenges browser-like
+            # UAs to an un-CORS-able counter-domain — which would turn every STATUS cell into "?".
+            # A stable non-browser UA passes through (verified: curl 200, browser UA 307).
+            proxy_set_header User-Agent "ccci-reports-proxy/1.0";
             proxy_pass https://git.autonomic.zone/api/v1/repos/recipe-maintainers/$1/pulls/$2;
             proxy_intercept_errors off;
             proxy_connect_timeout 5s;
@@ -69,7 +73,7 @@ let
           labels:
             - "traefik.enable=true"
             - "traefik.http.services.ccci-reports.loadbalancer.server.port=80"
-            - "traefik.http.routers.ccci-reports.rule=Host(`report.ci.commoninternet.net`)"
+            - "traefik.http.routers.ccci-reports.rule=Host(`report.ci.autonomic.zone`) || Host(`report.ci.commoninternet.net`)"
             - "traefik.http.routers.ccci-reports.entrypoints=web-secure"
             - "traefik.http.routers.ccci-reports.tls=true"
     networks:

nix/modules/secrets.nix

@@ -6,8 +6,15 @@
 # off-box master recovery key).
 { config, ... }:
 {
+  imports = [ ./options.nix ];
+
   sops = {
-    defaultSopsFile = ../../secrets/secrets.yaml;
+    # See options.nix: the submodule path by default; an absolute host path on a combined host
+    # that imports cc-ci as a flake input without the private submodule.
+    defaultSopsFile = config.cc-ci.sopsFile;
+    # sops-nix validates store-path sops files at build time. An absolute (string) path is read
+    # at activation instead, so validation has to be off for that case.
+    validateSopsFiles = builtins.isPath config.cc-ci.sopsFile;
     # Decrypt using the host's SSH host key (converted to an age identity by sops-nix).
     age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     # Phase-1c: also accept a bootstrap age key at a fixed path — THE one out-of-band secret,

opencode.json

@@ -2,7 +2,7 @@
   "$schema": "https://opencode.ai/config.json",
   "agent": {
     "general": {
-      "model": "opencode/deepseek-v4-flash"
+      "model": "opencode-go/deepseek-v4-flash"
     }
   }
 }

runner/harness/generic.py

@@ -117,7 +117,10 @@ def assert_serving(domain: str, meta) -> None:
     # app is routed (Traefik serves the wildcard zone-wide). The serving proof is steps 1–2 above.
     verified, detail = served_cert(domain)
     assert verified, f"{domain}: served wildcard cert is not trusted/valid — {detail}"
-    assert "commoninternet.net" in detail.lower(), f"{domain}: served cert unexpected — {detail}"
+    # Dual-zone cert (2026-09 cutover): the SAN list covers both *.ci zones; a run
+    # domain in either zone must be covered by the one serving wildcard.
+    zone = "autonomic.zone" if domain.endswith(".autonomic.zone") else "commoninternet.net"
+    assert zone in detail.lower(), f"{domain}: served cert unexpected — {detail}"
 
 
 # ---- Op/assertion split (Phase 1e HC3) -------------------------------------------------------

runner/harness/lifecycle.py

@@ -25,7 +25,7 @@ from . import meta as meta_mod
 GATEWAY_IP = "143.244.213.108"  # *.ci.commoninternet.net -> gateway (TLS passthrough to cc-ci)
 # A run app domain is "<recipe[:4]>-<6hex>.ci.commoninternet.net" (see DECISIONS.md). Used by the
 # janitor to recognise orphaned run apps (infra apps like traefik/drone/backups don't match).
-RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.commoninternet\.net$")
+RUN_APP_RE = re.compile(r"^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.(?:autonomic\.zone|commoninternet\.net)$")
 
 
 class TeardownError(RuntimeError):
@@ -1190,7 +1190,7 @@ def janitor() -> None:
     # also catch stacks whose .env was already deleted (abra ls won't list them)
     for svc in _docker_names("service", ""):
         # svc like cust-c95a69_ci_commoninternet_net_app -> reconstruct domain
-        m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_commoninternet_net_", svc)
+        m = re.match(r"^([a-z0-9]{1,4}-[0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_", svc)
         if m:
             seen.add(f"{m.group(1)}.ci.commoninternet.net")
 

runner/harness/naming.py

@@ -1,7 +1,9 @@
 """Shared run-app domain naming (used by the conftest fixtures and the orchestrator).
 
-Domain = "<recipe[:4]>-<6hex(recipe|pr|ref)>.ci.commoninternet.net" — short enough for Docker's
+Domain = "<recipe[:4]>-<6hex(recipe|pr|ref)>.ci.autonomic.zone" — short enough for Docker's
 64-char swarm config/secret name limit, unique per run, collision-safe across recipes (DECISIONS.md).
+(Migrated from *.ci.commoninternet.net 2026-09; the legacy zone remains valid until the bake
+window ends — lifecycle/warm name matching accepts both.)
 """
 
 from __future__ import annotations
@@ -18,4 +20,4 @@ def app_domain(recipe: str, pr: str = "0", ref: str | None = None) -> str:
     ref = ref or ("local" + str(int(time.time())))
     tag = _short(recipe, 4).lower()
     h = hashlib.sha1(f"{recipe}|{pr}|{ref}".encode()).hexdigest()[:6]
-    return f"{tag}-{h}.ci.commoninternet.net"
+    return f"{tag}-{h}.ci.autonomic.zone"

runner/harness/warm.py

@@ -25,6 +25,9 @@ import urllib.request
 # Recipes that, when declared as a dep, are served from a shared live-warm instance at a stable
 # domain instead of being co-deployed per run. Maps dep-recipe -> stable domain.
 WARM_DOMAINS = {
+    # Warm stacks stay on the legacy zone through the 2026-09 domain cutover (data-warm
+    # volumes + stack names are tied to the abra app name; renaming re-seeds the CI bases).
+    # They move to *.ci.autonomic.zone in a post-bake phase together with their stacks.
     "keycloak": "warm-keycloak.ci.commoninternet.net",
 }
 
@@ -38,11 +41,12 @@ _CTX.check_hostname = False
 _CTX.verify_mode = ssl.CERT_NONE
 
 # A cold per-run stack name looks like "<tag>-<6hex>_ci_commoninternet_net_<svc>"; extract the hex.
-_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_commoninternet_net_")
+_STACK_HEX_RE = re.compile(r"^[a-z0-9]{1,4}-([0-9a-f]{6})_ci_(?:autonomic_zone|commoninternet_net)_")
 
 
 def stable_domain(recipe: str) -> str:
     """The stable warm domain for a recipe: `warm-<recipe>.ci.commoninternet.net` — the canonical
+    base's hostname (legacy zone until the post-bake warm-stack migration; see WARM_DOMAINS note).
     scheme for BOTH the live-warm keycloak and the data-warm canonicals (WC2), distinct from cold
     per-run `<recipe[:4]>-<6hex>`. (WARM_DOMAINS['keycloak'] equals stable_domain('keycloak').)"""
     return f"warm-{recipe}.ci.commoninternet.net"

scripts/bootstrap-drone-oauth.sh

@@ -13,10 +13,10 @@ set -euo pipefail
 : "${GITEA_USERNAME:?set GITEA_USERNAME}"
 : "${GITEA_PASSWORD:?set GITEA_PASSWORD}"
 GITEA="${GITEA:-https://git.autonomic.zone}"
-DRONE="${DRONE:-https://drone.ci.commoninternet.net}"
+DRONE="${DRONE:-https://drone.ci.autonomic.zone}"
 CLIENT_ID="${CLIENT_ID:-ab4cdb9d-ee96-4867-875f-87384505fc52}"
 REPO="${REPO:-recipe-maintainers/cc-ci}"
-RES=(--resolve "drone.ci.commoninternet.net:443:127.0.0.1")
+RES=(--resolve "drone.ci.autonomic.zone:443:127.0.0.1")
 export PATH=/run/current-system/sw/bin:"$PATH"
 
 cj=$(mktemp)

tests/concurrency/concutil.py

@@ -15,7 +15,7 @@ sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner")
 from harness import lifecycle  # noqa: E402
 
 HELPERS = os.path.join(os.path.dirname(__file__), "helpers.py")
-DOMAIN = "test-abc123.ci.commoninternet.net"  # matches RUN_APP_RE
+DOMAIN = "test-abc123.ci.autonomic.zone"  # matches RUN_APP_RE
 
 
 class HelperPool:

tests/gitea/recipe_meta.py

@@ -72,7 +72,8 @@ def UPGRADE_SECRET_PREP(ctx):
     import subprocess
 
     # abra derives STACK_NAME from the domain by replacing dots with underscores
-    # (e.g. gite-e1cb78.ci.commoninternet.net → gite-e1cb78_ci_commoninternet_net).
+    # (e.g. gite-e1cb78.ci.autonomic.zone → gite-e1cb78_ci_autonomic_zone; legacy
+    # *.ci.commoninternet.net run stacks are matched too during the bake window).
     stack_name = ctx.domain.replace(".", "_")
     docker_secret = f"{stack_name}_lfs_jwt_secret_v1"
     value = base64.urlsafe_b64encode(_os.urandom(32)).rstrip(b"=").decode()