m3-cloud

NixOS configuration and services for M3's Hetzner VPS (m3-cloud-00, CPX21, Ashburn).

This is a flake-based NixOS deployment. Nixpkgs is pinned in flake.lock; upgrades happen by running nix flake update to advance the pin, committing, and deploying. There is no channel-based auto-upgrade.

Deploying

From the repo directory on m3-cloud-00 (always in tmux):

nix flake update                          # advance nixpkgs pin (when upgrading)
nixos-rebuild switch --flake .#m3-cloud-00

Layout

flake.nix                  # entry point — pins nixpkgs, defines nixosConfigurations
configuration.nix          # top-level imports and global settings
hardware-configuration.nix # Hetzner CPX21 hardware (QEMU guest)
modules/
  networking.nix            # Tailscale, firewall
  forgejo.nix               # Forgejo server, Actions runner, runner secrets, tofu dirs
  caddy.nix                 # reverse proxy behind Cloudflare
  setec.nix                 # Setec secrets server (tsnet, AWS KMS)
pkgs/
  setec.nix                 # setec package derivation

Services

• Forgejo — forgejo.midwitmoneymgmt.com, the single forge for all M3 code. HTTP on :3000, SSH on :2222, behind Caddy + Cloudflare. Tracks the stable channel's forgejo-lts.
• Setec — Tailscale's secrets server, run as a tsnet node (setec.taild30b6f.ts.net) backed by AWS KMS. Authoritative store for all M3 secrets, namespaced under ci/*.
• Caddy — reverse proxy fronting Forgejo.
• Forgejo Actions runner (gitea-runner-m3) — native:host runner. Its registration token is pulled from Setec at startup by the forgejo-runner-secrets oneshot, which waits for Setec to be reachable on the tailnet before writing the token file.

CI/CD

CI is Forgejo Actions with a native:host runner. The previous Woodpecker server, agent, and the setec-woodpecker-bridge were removed in May 2026; do not reintroduce them.