System tweaks, gitea CI, boot limit

- nix: keep-outputs + keep-derivations (preserve devshells across GC)
- zramSwap + fstrim
- systemd-boot configurationLimit = 20
- expand .gitignore (editor/AI/stray dotfiles); track statix.toml
- gitea Actions CI: blocking flake-check eval + informational statix/deadnix/nixfmt

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,42 @@
+# Gitea Actions CI for the nix config.
+#
+# Requirements on the act_runner:
+#   - a runner with the `ubuntu-latest` label (or change `runs-on` below)
+#   - the runner must be allowed to fetch actions from github.com
+#     (act_runner default: DEFAULT_ACTIONS_URL = https://github.com)
+#
+# Design: `eval` is blocking (it's the real safety net — the whole module
+# system must evaluate). `lint` is informational (continue-on-error) because
+# the existing statix/deadnix/format findings are intentionally tolerated.
+# Flip `continue-on-error` to false once the config is clean to make it gating.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  eval:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - name: Evaluate all flake outputs (no build)
+        run: nix flake check --no-build
+
+  lint:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - name: nixfmt (format check)
+        run: |
+          fd_nix=$(find . -name '*.nix')
+          nix run nixpkgs#nixfmt -- --check $fd_nix
+      - name: statix
+        run: nix run nixpkgs#statix -- check
+      - name: deadnix
+        run: nix run nixpkgs#deadnix -- --fail

.gitignore

@@ -1 +1,23 @@
+# nix build artifacts
 result
+result-*
+
+# editor / IDE
+.idea/
+.vscode/
+
+# AI tooling working dirs (not config)
+.claude/agents/
+.claude/commands/
+.claude/hooks/
+.mcp.json
+
+# stray shell/git dotfiles that land in the repo root
+.bash_profile
+.bashrc
+.profile
+.zprofile
+.zshrc
+.gitconfig
+.gitmodules
+.ripgreprc

hosts/common/features/user.nix

@@ -28,6 +28,9 @@
 
   boot.loader = {
     systemd-boot.enable = true;
+    # Cap boot menu entries so old generations don't accumulate forever
+    # (GC prunes the store; this prunes the boot entries).
+    systemd-boot.configurationLimit = 20;
     efi.canTouchEfiVariables = true;
   };
 

hosts/common/global/default.nix

@@ -32,4 +32,10 @@
   };
 
   services.dbus.packages = with pkgs; [ gcr ];
+
+  # Compressed RAM swap — better behaviour under memory pressure.
+  zramSwap.enable = true;
+
+  # Periodic SSD TRIM.
+  services.fstrim.enable = true;
 }

hosts/common/global/nix.nix

@@ -15,6 +15,10 @@
         "flakes"
       ];
       warn-dirty = false;
+      # Keep devshell build inputs alive across GC/`nh clean` so direnv/devenv
+      # projects don't re-download/rebuild their shells after a cleanup.
+      keep-outputs = true;
+      keep-derivations = true;
     };
     # GC is handled by `nh clean` below (keep-N / keep-since semantics).
     # The two are mutually exclusive — nh asserts if nix.gc.automatic is on.

statix.toml

@@ -0,0 +1,2 @@
+# Generated by nixos-generate-config and overwritten on regeneration — not ours to lint.
+ignore = ["hardware-configuration.nix"]