# The cc-ci CI server as ONE reusable NixOS module — exported from flake.nix as
# `nixosModules.cc-ci-server`. Everything a host needs to BE cc-ci, except what is physical or
# identity and therefore belongs to the host that imports it: hardware, networking, the tailscale
# node, root SSH keys, `system.stateVersion`. A host sets `cc-ci.publicIPv4` (and, when it is not
# built from a --recursive clone, `cc-ci.sopsFile`) and imports this.
#
# Consumers: nix/hosts/cc-ci-hetzner (the canonical standalone host) and
# recipe-maintainers/cc-ci-orchestrator's `#cc-ci` host, which runs the CI server and the
# orchestrator together (2026-09).
{ pkgs, ... }:
{
  imports = [
    ./options.nix
    ./packages.nix
    ./secrets.nix
    ./acme-dns.nix
    ./swarm.nix
    ./docker-prune.nix
    ./abra.nix
    ./proxy.nix
    ./drone.nix
    ./drone-runner.nix
    ./bridge.nix
    ./dashboard.nix
    ./reports.nix
    ./backupbot.nix
    ./harness.nix
    ./warm-keycloak.nix
    ./nightly-sweep.nix
  ];

  # Recipes bind-mount /etc/localtime and /etc/timezone; the harness compares timestamps across
  # host and containers, so the host is UTC like every container.
  time.timeZone = "UTC";
  environment.etc."timezone".text = "UTC\n";

  # Phase `nixenv`: the Drone exec runner resolves recipe shell-outs from this host PATH
  # (/run/current-system/sw/bin). Install the SINGLE shared harness tool set (pkgs.ccciRuntimeTools,
  # defined in packages.nix) so the Drone path and the harness env (cc-ci-run / sweep) can never
  # diverge.
  environment.systemPackages = pkgs.ccciRuntimeTools;

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
}