acme-dns.nix: one systemd attrset (statix W20) — lint gate green

statix flagged the repeated `systemd.` keys (tmpfiles marker, acme-dns
daemon, traefik handoff oneshot); they are now one nested attrset. Purely
structural: `#cc-ci` still evaluates. With #33 this makes the push
self-test's lint stage pass again.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

flake.nix

@@ -16,7 +16,7 @@
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = { nixpkgs, sops-nix, ... }:
+  outputs = { self, nixpkgs, sops-nix, ... }:
     let
       system = "x86_64-linux";
       pkgs = nixpkgs.legacyPackages.${system};
@@ -35,13 +35,25 @@
       ];
     in
     {
+      # The whole CI server as one reusable module (nix/modules/default.nix): every service,
+      # the harness tooling, sops wiring and acme-dns — but no hardware, networking, tailscale
+      # node, root keys or stateVersion. sops-nix's module comes bundled so a consumer only has
+      # to import this and set `cc-ci.publicIPv4` (+ `cc-ci.sopsFile` when it is not built from
+      # a --recursive clone). A consuming flake MUST make its `cc-ci` input follow its own
+      # `nixpkgs` and `sops-nix`, otherwise two sops-nix module trees collide.
+      # Consumer: recipe-maintainers/cc-ci-orchestrator `#cc-ci` (CI server + orchestrator on
+      # one Hetzner host, 2026-09).
+      nixosModules.cc-ci-server = {
+        imports = [ sops-nix.nixosModules.sops ./nix/modules ];
+      };
+
       nixosConfigurations = {
         # Canonical live host target: the Hetzner cc-ci server.
         # Use `.#cc-ci` for the current production host.
         cc-ci = nixpkgs.lib.nixosSystem {
           inherit system;
           modules = [
-            sops-nix.nixosModules.sops
+            self.nixosModules.cc-ci-server
             ./nix/hosts/cc-ci-hetzner/configuration.nix
           ];
         };
@@ -61,7 +73,7 @@
         cc-ci-hetzner = nixpkgs.lib.nixosSystem {
           inherit system;
           modules = [
-            sops-nix.nixosModules.sops
+            self.nixosModules.cc-ci-server
             ./nix/hosts/cc-ci-hetzner/configuration.nix
           ];
         };

nix/hosts/cc-ci-hetzner/configuration.nix

@@ -1,38 +1,23 @@
-# cc-ci on Hetzner Cloud — NixOS configuration.
+# cc-ci on Hetzner Cloud — the canonical STANDALONE CI-server host.
-# Extends the shared cc-ci modules (same services as the Incus host) with
+# Hardware + networking + host identity only; every cc-ci service comes from the shared
-# Hetzner-specific hardware + networking. Run in parallel with the Incus cc-ci
+# `nixosModules.cc-ci-server` module (nix/modules/default.nix), which flake.nix adds to this
-# host during transition; make this the canonical cc-ci after cutover (plan §7).
+# host. The same module builds the combined CI-server + orchestrator host declared in
+# recipe-maintainers/cc-ci-orchestrator (`#cc-ci`), which is where cc-ci is moving (2026-09).
 #
 # To apply after `terraform apply` + nixos-infect:
 #   git clone --recursive https://git.autonomic.zone/recipe-maintainers/cc-ci.git /etc/cc-ci
 #   install -m600 <age-private-key> /var/lib/sops-nix/key.txt
-#   nixos-rebuild switch --flake /etc/cc-ci#cc-ci-hetzner
+#   nixos-rebuild switch --flake 'git+file:///etc/cc-ci?submodules=1#cc-ci'
 { pkgs, ... }:
 {
   imports = [
     ./hardware.nix
     ./networking.nix
-    ../../modules/packages.nix
-    ../../modules/secrets.nix
-    ../../modules/acme-dns.nix
-    ../../modules/swarm.nix
-    ../../modules/docker-prune.nix
-    ../../modules/abra.nix
-    ../../modules/proxy.nix
-    ../../modules/drone.nix
-    ../../modules/drone-runner.nix
-    ../../modules/bridge.nix
-    ../../modules/dashboard.nix
-    ../../modules/reports.nix
-    ../../modules/backupbot.nix
-    ../../modules/harness.nix
-    ../../modules/warm-keycloak.nix
-    ../../modules/nightly-sweep.nix
   ];
 
-  # Timezone (same as Incus host — see configuration.nix there for rationale).
+  # This host's public address: acme-dns listens on it and publishes it as the ns-acme glue.
-  time.timeZone = "UTC";
+  cc-ci.publicIPv4 = "91.98.47.73";
-  environment.etc."timezone".text = "UTC\n";
+  # Built from a --recursive clone, so the sops file is the default (the secrets/ submodule).
 
   # Tailscale — keeps the orchestrator→cc-ci access path unchanged (direct peer).
   # On the Hetzner host the auth key is also seeded via /etc/ts-auth-key.
@@ -64,15 +49,9 @@
     allowedTCPPorts = [ 22 80 443 ];
   };
 
-  # Phase `nixenv`: the Drone exec runner resolves recipe shell-outs from this host PATH
+  # The recipe-test tool set (ccciRuntimeTools) is installed by the cc-ci-server module; the ssh
-  # (PATH=/run/current-system/sw/bin). Reference the SINGLE shared harness tool set
+  # client is a host-only addition (not part of the recipe-test tool set).
-  # (pkgs.ccciRuntimeTools — includes git-lfs, openssl, etc.) instead of a hand-maintained list,
+  environment.systemPackages = [ pkgs.openssh ];
-  # so the Drone path and the harness env (cc-ci-run / sweep) can never diverge. `openssh` is a
-  # host-only addition (ssh client), not part of the recipe-test tool set. Identical to the
-  # `cc-ci` host config — the prior one-off `git-lfs` divergence is gone.
-  environment.systemPackages = pkgs.ccciRuntimeTools ++ [ pkgs.openssh ];
-
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
   system.stateVersion = "24.11";
 }

nix/modules/acme-dns.nix

@@ -3,18 +3,19 @@
 # This host is authoritative only for acme.commoninternet.net. Gandi continues
 # to own commoninternet.net; it delegates this narrow zone and one permanent
 # _acme-challenge CNAME manually. No Gandi credential is present here.
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 let
+  publicIPv4 = config.cc-ci.publicIPv4;
   acmeDnsConfig = pkgs.writeText "cc-ci-acme-dns.conf" ''
     [general]
-    listen = "91.98.47.73:53"
+    listen = "${publicIPv4}:53"
     protocol = "both4"
     domain = "acme.commoninternet.net"
     nsname = "ns-acme.commoninternet.net"
     nsadmin = "hostmaster.commoninternet.net"
     records = [
       "acme.commoninternet.net. NS ns-acme.commoninternet.net.",
-      "ns-acme.commoninternet.net. A 91.98.47.73",
+      "ns-acme.commoninternet.net. A ${publicIPv4}",
     ]
     debug = false
 
@@ -48,6 +49,8 @@ let
   '';
 in
 {
+  imports = [ ./options.nix ];
+
   users.groups.acme-dns = { };
   users.users.acme-dns = {
     isSystemUser = true;
@@ -57,18 +60,24 @@ in
 
   environment.etc."acme-dns/lego.env".source = legoEnvironment;
 
-  # The staging order has completed successfully. This marker permits the
-  # production ACME post-run hook to hand a renewed certificate to Traefik.
-  systemd.tmpfiles.rules = [
-    "f /var/lib/ci-certs/acme-production-enabled 0600 root root -"
-  ];
 
   networking.firewall = {
     allowedTCPPorts = [ 53 ];
     allowedUDPPorts = [ 53 ];
   };
 
-  systemd.services.acme-dns = {
+
+
+  # One `systemd` attrset (statix W20): the tmpfiles marker, the acme-dns daemon and the
+  # traefik handoff oneshot.
+  systemd = {
+    # The staging order has completed successfully. This marker permits the
+    # production ACME post-run hook to hand a renewed certificate to Traefik.
+    tmpfiles.rules = [
+      "f /var/lib/ci-certs/acme-production-enabled 0600 root root -"
+    ];
+
+    services.acme-dns = {
       description = "Restricted authoritative DNS for cc-ci ACME DNS-01";
       wantedBy = [ "multi-user.target" ];
       after = [ "network-online.target" ];
@@ -97,7 +106,7 @@ in
     # Traefik consumes its wildcard as immutable Swarm secrets, so a renewed
     # host certificate must be copied and reconciled rather than merely reloaded.
     # This service is started only by the production-mode ACME postRun hook.
-  systemd.services.cc-ci-acme-traefik-handoff = {
+    services.cc-ci-acme-traefik-handoff = {
       description = "Install renewed cc-ci wildcard into Traefik Swarm secrets";
       after = [ "docker.service" "deploy-proxy.service" ];
       requires = [ "docker.service" ];
@@ -131,6 +140,7 @@ in
           while IFS= read -r stale; do docker secret rm "$stale" || true; done
       '';
     };
+  };
 
   security.acme = {
     acceptTerms = true;

nix/modules/default.nix

@@ -0,0 +1,44 @@
+# The cc-ci CI server as ONE reusable NixOS module — exported from flake.nix as
+# `nixosModules.cc-ci-server`. Everything a host needs to BE cc-ci, except what is physical or
+# identity and therefore belongs to the host that imports it: hardware, networking, the tailscale
+# node, root SSH keys, `system.stateVersion`. A host sets `cc-ci.publicIPv4` (and, when it is not
+# built from a --recursive clone, `cc-ci.sopsFile`) and imports this.
+#
+# Consumers: nix/hosts/cc-ci-hetzner (the canonical standalone host) and
+# recipe-maintainers/cc-ci-orchestrator's `#cc-ci` host, which runs the CI server and the
+# orchestrator together (2026-09).
+{ pkgs, ... }:
+{
+  imports = [
+    ./options.nix
+    ./packages.nix
+    ./secrets.nix
+    ./acme-dns.nix
+    ./swarm.nix
+    ./docker-prune.nix
+    ./abra.nix
+    ./proxy.nix
+    ./drone.nix
+    ./drone-runner.nix
+    ./bridge.nix
+    ./dashboard.nix
+    ./reports.nix
+    ./backupbot.nix
+    ./harness.nix
+    ./warm-keycloak.nix
+    ./nightly-sweep.nix
+  ];
+
+  # Recipes bind-mount /etc/localtime and /etc/timezone; the harness compares timestamps across
+  # host and containers, so the host is UTC like every container.
+  time.timeZone = "UTC";
+  environment.etc."timezone".text = "UTC\n";
+
+  # Phase `nixenv`: the Drone exec runner resolves recipe shell-outs from this host PATH
+  # (/run/current-system/sw/bin). Install the SINGLE shared harness tool set (pkgs.ccciRuntimeTools,
+  # defined in packages.nix) so the Drone path and the harness env (cc-ci-run / sweep) can never
+  # diverge.
+  environment.systemPackages = pkgs.ccciRuntimeTools;
+
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+}

nix/modules/options.nix

@@ -0,0 +1,33 @@
+# The few host-identity values the cc-ci modules need but must not hard-code, so that the same
+# modules can build the canonical Hetzner host, a throwaway rebuild VM, or a combined host that
+# also runs the cc-ci orchestrator (2026-09: recipe-maintainers/cc-ci-orchestrator imports
+# `nixosModules.cc-ci-server` from this repo and runs both on one box).
+{ lib, ... }:
+{
+  options.cc-ci = {
+    publicIPv4 = lib.mkOption {
+      type = lib.types.str;
+      example = "91.98.47.73";
+      description = ''
+        The host's public IPv4 address. acme-dns binds its authoritative listener to it and
+        publishes it as the `ns-acme` glue record. Must match the Gandi A record for
+        ns-acme.commoninternet.net and the address the cc-ci DNS names point at.
+      '';
+    };
+
+    sopsFile = lib.mkOption {
+      type = lib.types.path;
+      default = ../../secrets/secrets.yaml;
+      defaultText = lib.literalExpression "../../secrets/secrets.yaml";
+      example = "/etc/cc-ci/secrets/secrets.yaml";
+      description = ''
+        The sops-encrypted secrets.yaml (recipe-maintainers/cc-ci-secrets). The default is the
+        `secrets/` git submodule inside this repo, which only exists when this flake is built from
+        a `--recursive` clone (`git+file:///root/cc-ci?submodules=1`). A consumer that imports
+        cc-ci as a plain flake input (no submodule) sets this to an absolute path on the host
+        instead — e.g. the `/etc/cc-ci` deployed checkout's `secrets/secrets.yaml` — which
+        sops-nix then reads at activation time rather than copying into the store.
+      '';
+    };
+  };
+}

nix/modules/secrets.nix

@@ -6,8 +6,15 @@
 # off-box master recovery key).
 { config, ... }:
 {
+  imports = [ ./options.nix ];
+
   sops = {
-    defaultSopsFile = ../../secrets/secrets.yaml;
+    # See options.nix: the submodule path by default; an absolute host path on a combined host
+    # that imports cc-ci as a flake input without the private submodule.
+    defaultSopsFile = config.cc-ci.sopsFile;
+    # sops-nix validates store-path sops files at build time. An absolute (string) path is read
+    # at activation instead, so validation has to be off for that case.
+    validateSopsFiles = builtins.isPath config.cc-ci.sopsFile;
     # Decrypt using the host's SSH host key (converted to an age identity by sops-nix).
     age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     # Phase-1c: also accept a bootstrap age key at a fixed path — THE one out-of-band secret,