ci: evaluate NixOS in the job, build on the server

The first run failed with "home directory /homeless-shelter exists":
job containers are unprivileged, Nix cannot sandbox builds in them, and
unsandboxed builds trip over each other's leftovers.

Evaluate the system in the job instead, which still catches broken
options before main, and let nixos-rebuild build on the target host,
where the Nix daemon has a proper sandbox.

Assisted-by: Claude:fable-5-2

.forgejo/workflows/nixos.yaml

@@ -1,7 +1,7 @@
 name: nixos
 
-# every push: build the system, so a broken config never reaches main
-# main:       then switch asxpio-services to it
+# every push: evaluate the system, so a broken config never reaches main
+# main:       then build it on asxpio-services and switch to it
 #
 # Secret: SSH_DEPLOY_KEY (user deploy). Service secrets are decrypted on
 # the server by sops-nix, so CI holds none of them.
@@ -29,9 +29,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build
+      # Job containers are unprivileged, so Nix cannot sandbox builds in
+      # them. Evaluating the system catches config errors; the build
+      # itself happens on the server during the deploy.
+      - name: Evaluate
         working-directory: nixos
-        run: nix build .#nixosConfigurations.asxpio-services.config.system.build.toplevel --no-link --print-out-paths
+        run: nix eval --raw .#nixosConfigurations.asxpio-services.config.system.build.toplevel.drvPath
 
       - name: Set up SSH
         if: github.ref == 'refs/heads/main'
@@ -58,7 +61,7 @@ jobs:
         run: >
           nix shell "$NIXPKGS#nixos-rebuild" "$NIXPKGS#openssh" -c
           nixos-rebuild switch --flake .#asxpio-services
-          --target-host asxpio-services --sudo
+          --target-host asxpio-services --build-host asxpio-services --sudo
 
       - name: Remove credentials
         if: always()

README.md

@@ -39,7 +39,7 @@ blog, czsk, vhpbot, storage). Each deploys from its own repository into
 
 Edit, push a branch, merge to `main`.
 
-- A branch push builds the NixOS system and dry-runs Ansible against
+- A branch push evaluates the NixOS system and dry-runs Ansible against
   asxpio-ops.
 - `main` then switches asxpio-services to the new system and applies
   Ansible to asxpio-ops.

nixos/README.md

@@ -20,8 +20,8 @@ Docker-compatible socket, which the CI runner uses to start jobs.
 
 ## Changing something
 
-Edit, push a branch (CI builds the system), merge to `main` (CI
-deploys). By hand, over WireGuard:
+Edit, push a branch (CI evaluates the system), merge to `main` (CI
+builds it on the server and switches to it). By hand, over WireGuard:
 
 ```sh
 nixos-rebuild switch --flake .#asxpio-services --target-host root@10.20.0.20