neptun: add Headscale + Headplane

Headscale is the tailnet control server every host's services/tailscale.nix
already points at (--login-server=https://vpn.mgaction.town). MagicDNS
base_domain "hosts.mgaction.town" matches the "jupiter.hosts.mgaction.town"
names already used in this repo's Caddy vhosts.

Headplane is its web UI, running as headscale's own user (native process
integration, no container). No OIDC wired up - log in with a headscale API
key generated on the box. Both proxied through Caddy; headscale's vhost
needs flush_interval -1 since its node-update endpoint is a long-poll.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/neptun/configuration.nix

@@ -10,6 +10,8 @@
     ../../services/caddy.nix
     ../../services/tailscale.nix
     ../../services/zitadel.nix
+    ../../services/headscale.nix
+    ../../services/headplane.nix
   ];
 
   # ---- Boot (UEFI) ----
@@ -57,6 +59,19 @@
     reverse_proxy http://localhost:8080
   '';
 
+  # ---- Headscale + Headplane (tailnet control server + its web UI) ----
+  # Both run locally on neptun (see services/{headscale,headplane}.nix).
+  # headscale's node-update endpoint is a long-poll, hence `flush_interval
+  # -1` — without it Caddy buffers the response and clients see stale state.
+  services.caddy.virtualHosts."vpn.mgaction.town".extraConfig = ''
+    reverse_proxy http://localhost:8082 {
+      flush_interval -1
+    }
+  '';
+  services.caddy.virtualHosts."headplane.mgaction.town".extraConfig = ''
+    reverse_proxy http://localhost:3000
+  '';
+
   # ---- Gitea SSH forward ----
   # Caddy only proxies HTTP; git-over-ssh needs a raw TCP forward. Gitea's
   # own built-in SSH server runs on jupiter:2222 (see services/gitea.nix —

hosts/neptun/secrets.nix

@@ -36,4 +36,7 @@
           Password: ${config.sops.placeholder.zitadel_admin_password}
           PasswordChangeRequired: false
   '';
+
+  # Headplane: cookie_secret_path takes a path natively (no store leak).
+  sops.secrets.headplane_cookie_secret = { };
 }