ci: replace update-infra with clan deploy

- Update flake.lock in imphnen-infrastructure
- Deploy to Hetzner server using clan machines update
- Requires SERVER_SSH_KEY secret for server access

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/nix-build.yml

@@ -1,4 +1,4 @@
-name: Nix Build & Cache
+name: Nix Build & Deploy
 
 on:
   push:
@@ -64,35 +64,63 @@ jobs:
         if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
         run: cachix push msdqn result-${{ matrix.app }}
 
-  update-infra:
+  deploy:
     needs: build
     if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Update imphnen-infrastructure flake.lock
+      - name: Setup Cachix
+        uses: cachix/cachix-action@v15
+        with:
+          name: msdqn
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Setup SSH
         env:
           INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
+          SERVER_SSH_KEY: ${{ secrets.SERVER_SSH_KEY }}
         run: |
           mkdir -p ~/.ssh
           echo "${INFRA_DEPLOY_KEY}" > ~/.ssh/infra_deploy
           chmod 600 ~/.ssh/infra_deploy
+          if [ -n "${SERVER_SSH_KEY}" ]; then
+            echo "${SERVER_SSH_KEY}" > ~/.ssh/server_key
+            chmod 600 ~/.ssh/server_key
+          fi
           ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
+          ssh-keyscan 167.235.70.37 >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Clone infrastructure
+        run: |
           export GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy -o IdentitiesOnly=yes"
           git clone git@github.com:IMPHNEN/imphnen-infrastructure.git /tmp/infra
-          cd /tmp/infra
+
+      - name: Update flake.lock
+        working-directory: /tmp/infra
+        run: |
           nix flake update imphnen-frontend
           if git diff --quiet flake.lock; then
-            echo "flake.lock unchanged, skipping"
+            echo "flake.lock unchanged, skipping commit"
           else
             git config user.name "github-actions[bot]"
             git config user.email "github-actions[bot]@users.noreply.github.com"
+            export GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy -o IdentitiesOnly=yes"
             git add flake.lock
             git commit -m "chore: update imphnen-frontend-service to ${GITHUB_SHA::7}"
             git push
           fi
-          rm -f ~/.ssh/infra_deploy
+
+      - name: Deploy with clan
+        working-directory: /tmp/infra
+        run: |
+          if [ -f ~/.ssh/server_key ]; then
+            export NIX_SSHOPTS="-i $HOME/.ssh/server_key -o StrictHostKeyChecking=accept-new"
+          fi
+          nix develop .#default --command clan machines update hetzner
+
+      - name: Cleanup SSH keys
+        if: always()
+        run: rm -f ~/.ssh/infra_deploy ~/.ssh/server_key