ci: replace update-infra with clan deploy

- Update flake.lock in imphnen-infrastructure
- Deploy to Hetzner server using clan machines update
- Requires SERVER_SSH_KEY secret for server access

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/nix-build.yml

@@ -1,4 +1,4 @@
-name: Nix Build & Cache
+name: Nix Build & Deploy
 
 on:
   push:
@@ -64,35 +64,63 @@ jobs:
         if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
         run: cachix push msdqn result-${{ matrix.app }}
 
-  update-infra:
+  deploy:
     needs: build
     if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
 
-      - name: Update imphnen-infrastructure flake.lock
+      - name: Setup Cachix
+        uses: cachix/cachix-action@v15
+        with:
+          name: msdqn
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Setup SSH
         env:
           INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
+          SERVER_SSH_KEY: ${{ secrets.SERVER_SSH_KEY }}
         run: |
           mkdir -p ~/.ssh
           echo "${INFRA_DEPLOY_KEY}" > ~/.ssh/infra_deploy
           chmod 600 ~/.ssh/infra_deploy
+          if [ -n "${SERVER_SSH_KEY}" ]; then
+            echo "${SERVER_SSH_KEY}" > ~/.ssh/server_key
+            chmod 600 ~/.ssh/server_key
+          fi
           ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
+          ssh-keyscan 167.235.70.37 >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Clone infrastructure
+        run: |
           export GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy -o IdentitiesOnly=yes"
           git clone git@github.com:IMPHNEN/imphnen-infrastructure.git /tmp/infra
-          cd /tmp/infra
+
+      - name: Update flake.lock
+        working-directory: /tmp/infra
+        run: |
           nix flake update imphnen-frontend
           if git diff --quiet flake.lock; then
-            echo "flake.lock unchanged, skipping"
+            echo "flake.lock unchanged, skipping commit"
           else
             git config user.name "github-actions[bot]"
             git config user.email "github-actions[bot]@users.noreply.github.com"
+            export GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy -o IdentitiesOnly=yes"
             git add flake.lock
             git commit -m "chore: update imphnen-frontend-service to ${GITHUB_SHA::7}"
             git push
           fi
-          rm -f ~/.ssh/infra_deploy
+
+      - name: Deploy with clan
+        working-directory: /tmp/infra
+        run: |
+          if [ -f ~/.ssh/server_key ]; then
+            export NIX_SSHOPTS="-i $HOME/.ssh/server_key -o StrictHostKeyChecking=accept-new"
+          fi
+          nix develop .#default --command clan machines update hetzner
+
+      - name: Cleanup SSH keys
+        if: always()
+        run: rm -f ~/.ssh/infra_deploy ~/.ssh/server_key

CLAUDE.md

@@ -71,9 +71,11 @@ All Nix config is in a single `flake.nix`:
 
 1. **detect**: Uses `nx affected` to find changed apps
 2. **build**: Matrix strategy builds only affected apps with Nix, pushes to Cachix
-3. **update-infra**: Clones `imphnen-infrastructure`, runs `nix flake update`, pushes new `flake.lock`
+3. **deploy**: Clones `imphnen-infrastructure`, updates `flake.lock`, pushes, then runs `clan machines update hetzner` to deploy to the Hetzner server
 
-Required GitHub secrets: `CACHIX_AUTH_TOKEN`, `INFRA_DEPLOY_KEY`
+Required GitHub secrets: `CACHIX_AUTH_TOKEN`, `INFRA_DEPLOY_KEY`, `SERVER_SSH_KEY`
+
+Deployment uses [clan](https://clan.lol) via `imphnen-infrastructure` repo. The server (167.235.70.37) pulls pre-built packages from Cachix.
 
 ## Environment Variables
 

README.md

@@ -98,7 +98,7 @@ GitHub Actions pipeline (`.github/workflows/nix-build.yml`):
 
 1. **detect** — uses `nx affected` to find changed apps
 2. **build** — matrix strategy builds only affected apps with Nix, pushes to [Cachix](https://app.cachix.org/cache/msdqn)
-3. **update-infra** — updates `flake.lock` in [imphnen-infrastructure](https://github.com/IMPHNEN/imphnen-infrastructure)
+3. **deploy** — updates `flake.lock` in [imphnen-infrastructure](https://github.com/IMPHNEN/imphnen-infrastructure) and deploys to the server using [clan](https://clan.lol)
 
 ## Tech Stack