ci: replace legacy workflows with nix-build.yml

Switch from cargo-based build + SCP deploy to Nix build + Cachix +
infra flake.lock update pattern, matching imphnen-frontend-service.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/deploy-to-ancikri.yml

@@ -1,65 +0,0 @@
-name: Deploy to Ancikri
-
-on:
-  push:
-    branches:
-      - develop
-
-jobs:
-  build-and-deploy:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Set up Rust
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
-
-      - name: Build the project
-        run: cargo build --release
-
-      - name: Stop service on VPS before upload
-        uses: appleboy/ssh-action@v0.1.7
-        with:
-          host: ${{ secrets.VPS_ANCIKRI_IP }}
-          username: ${{ secrets.VPS_ANCIKRI_USER }}
-          key: ${{ secrets.VPS_ANCIKRI_SSH_KEY }}
-          port: ${{ secrets.VPS_ANCIKRI_PORT }}
-          script: |
-            set -e
-            echo "Stopping the service before uploading the binary"
-            sudo systemctl stop imphnen-backend-service
-
-      - name: Upload artifact to VPS
-        uses: appleboy/scp-action@v0.1.7
-        with:
-          host: ${{ secrets.VPS_ANCIKRI_IP }}
-          username: ${{ secrets.VPS_ANCIKRI_USER }}
-          key: ${{ secrets.VPS_ANCIKRI_SSH_KEY }}
-          port: ${{ secrets.VPS_ANCIKRI_PORT }}
-          source: ./target/release/*
-          target: /opt/imphnen-backend-service/imphnen-backend-service
-          rm: true
-          overwrite: true
-
-      - name: Deploy to server
-        uses: appleboy/ssh-action@v0.1.7
-        with:
-          host: ${{ secrets.VPS_ANCIKRI_IP }}
-          username: ${{ secrets.VPS_ANCIKRI_USER }}
-          key: ${{ secrets.VPS_ANCIKRI_SSH_KEY }}
-          port: ${{ secrets.VPS_ANCIKRI_PORT }}
-          script: |
-            set -e
-
-            echo "Restarting the service"
-
-            sudo systemctl daemon-reload
-
-            sudo systemctl restart imphnen-backend-service
-
-            echo "Deployment completed successfully"

.github/workflows/nix-build.yml

@@ -0,0 +1,73 @@
+name: Nix Build & Deploy
+
+on:
+  push:
+    branches: ['develop']
+  pull_request:
+    branches: ['develop']
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+
+      - name: Setup Cachix
+        uses: cachix/cachix-action@v15
+        with:
+          name: msdqn
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Build
+        run: nix build .#default -o result
+
+      - name: Push to Cachix
+        if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+        run: cachix push msdqn result
+
+  deploy:
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+
+      - name: Setup SSH
+        env:
+          INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "${INFRA_DEPLOY_KEY}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
+          ssh-keyscan 167.235.70.37 >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Update infra flake.lock
+        run: |
+          export GIT_SSH_COMMAND="ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes"
+          git clone git@github.com:IMPHNEN/imphnen-infrastructure.git /tmp/infra
+          cd /tmp/infra
+          nix flake update imphnen-backend
+          if git diff --quiet flake.lock; then
+            echo "flake.lock unchanged, skipping"
+          else
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git add flake.lock
+            git commit -m "chore: update imphnen-backend-service to ${GITHUB_SHA::7}"
+            git push
+          fi
+
+      - name: Deploy to server
+        continue-on-error: true
+        run: |
+          ssh -i ~/.ssh/deploy_key -o ConnectTimeout=15 -o StrictHostKeyChecking=accept-new root@167.235.70.37 \
+            'nixos-rebuild switch --flake github:IMPHNEN/imphnen-infrastructure#hetzner --refresh 2>&1 | tail -30'
+
+      - name: Cleanup
+        if: always()
+        run: rm -f ~/.ssh/deploy_key

.github/workflows/test-build.yml

@@ -1,19 +0,0 @@
-name: Rust
-
-on:
-  push:
-    branches: ["develop"]
-  pull_request:
-    branches: ["develop"]
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build
-        run: cargo build --verbose