neptun: replace Zitadel with Authentik as the OIDC provider

nixpkgs only carries Zitadel 2.71, which predates the login-v2 split and
cannot take a v3/v4 database (its migrations are forward-only), so the
instance running on the old Debian VPS could never have moved onto it.
authentik-nix ships 2026.5.4 and tracks upstream closely.

The authentik-nix input deliberately does not follow our nixpkgs, per
upstream's warning that overriding it breaks their pinned python
dependency set. That costs a second nixpkgs in the lock, so add
nix-community's Cachix to common.nix -- without it the closure is ~400
local derivations (npm, rust, python). The laptop that runs
scripts/deploy needs the same two lines in /etc/nix/nix.custom.conf.

Authentik's own module creates the database and orders its units against
postgresql.target, and recent versions need no redis, so the wiring is
just the module plus a secret. Pin postgresql explicitly so that editing
system.stateVersion can never silently demand a pg_upgrade of the
identity store.

Secret ownership is not uniform and the difference matters: authentik
and caddy take a systemd EnvironmentFile, which PID 1 reads as root
before dropping privileges, so root:root 0400 is correct. Headplane
opens its secret paths itself while already running as the headscale
user, so those three need an explicit owner or they fail to start.

Also on neptun:

- Pass Caddy's ACME account email through the same EnvironmentFile
  mechanism and reference it with the Caddyfile {$VAR} placeholder.
  services.caddy.email would render the address into the world-readable
  store.
- Stop accepting MagicDNS from our own control server. headscale pushes
  override_local_dns, so joining the tailnet would point neptun's
  resolv.conf at a MagicDNS served by the tailscaled neptun itself hosts
  -- a tailscaled failure would then also take out DNS, ACME renewal and
  finally the certs for the control server every other node needs in
  order to recover.
- Give headplane a writable DNS extra-records file. Its view of
  headscale's config stays read-only, which is the right outcome for a
  declarative box; records are data rather than config.
- Require a password for sudo. Deploys become interactive, but darman's
  key is otherwise the only thing between the public internet and root.
- Enable zram (8 GB, and disko leaves no room for a swap device), and let
  tailscaled-autoconnect retry instead of failing permanently when the
  control server isn't up yet on a first boot.

networking.hosts still carries a PLACEHOLDER address for jupiter --
replace it from `headscale nodes list` once jupiter first enrols.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hosts/neptun/configuration.nix

@@ -9,7 +9,7 @@
     ../../common.nix              # shared base: user / ssh / nix / firewall
     ../../services/network/caddy.nix
     ../../services/vpn/tailscale.nix
-    ../../services/identity/zitadel.nix
+    ../../services/identity/authentik.nix
     ../../services/vpn/headscale.nix
     ../../services/vpn/headplane.nix
   ];
@@ -23,6 +23,11 @@
 
   networking.hostName = "neptun";
 
+  # 8 GB and no swap device (netcup gives one disk, disko takes all of it for
+  # root). authentik's server + worker + postgres are the memory-hungry part;
+  # zram is enough headroom at this size and costs no disk.
+  zramSwap.enable = true;
+
   # ---- Static networking (netcup) ----
   # No LAN fallback: get this right or the box is unreachable (use netcup's
   # VNC console / rescue system to fix). Values captured from the running VPS.
@@ -36,12 +41,33 @@
   # netcup IPv6 gateway is conventionally fe80::1 — VERIFY with `ip -6 route`
   # on the running VPS; wrong v6 gw won't break v4 reachability.
   networking.defaultGateway6 = { address = "fe80::1"; interface = "eth0"; };
-  # Public resolvers for early boot; tailscale MagicDNS overrides once up.
   networking.nameservers = [ "9.9.9.9" "1.1.1.1" "2620:fe::fe" ];
 
+  # ---- Don't take MagicDNS from our own control server ----
+  # headscale pushes override_local_dns, so joining the tailnet would point
+  # neptun's resolv.conf at a MagicDNS served by the tailscaled neptun itself
+  # hosts. A tailscaled failure would then also kill DNS, and with it ACME
+  # renewal — expiring the certs for the very control server every other node
+  # needs to recover. Keep the public resolvers above and resolve the one
+  # tailnet name we proxy to from /etc/hosts instead.
+  services.tailscale.extraUpFlags = [ "--accept-dns=false" ];
+
+  # ⚠️  PLACEHOLDER IP — replace once jupiter first enrols, with its address
+  #     from `headscale nodes list` on this box. Until then the audiobookshelf
+  #     vhost and the gitea SSH forward below both fail to connect.
+  networking.hosts."100.64.0.2" = [ "jupiter.hosts.mgaction.town" ];
+
   # firewall (enable + 22), caddy (80/443), tailscale (trust tailscale0 + join
   # headscale) come from ../../common.nix and ../../services/{caddy,tailscale}.nix.
 
+  # ---- ACME account email ----
+  # services.caddy.email would render the address into the world-readable
+  # store, so pass it via EnvironmentFile and reference it with the Caddyfile
+  # {$VAR} parse-time placeholder (see hosts/neptun/secrets.nix). globalConfig
+  # is types.lines, so this appends to the module's own global block.
+  services.caddy.environmentFile = config.sops.templates."caddy.env".path;
+  services.caddy.globalConfig = "email {$ACME_EMAIL}";
+
   # ---- Public reverse proxy vhosts ----
   # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains.
   # Proxies to jupiter's audiobookshelf over the tailnet (MagicDNS name).
@@ -51,12 +77,13 @@
   '';
   # TODO: port your other VPS services' vhosts here before deploying.
 
-  # ---- Zitadel (identity/OIDC provider) ----
-  # Runs locally on neptun (see services/identity/zitadel.nix); Caddy just terminates
-  # TLS and proxies to it.
-  services.zitadel.settings.ExternalDomain = "auth.mgaction.town";
+  # ---- Authentik (identity/OIDC provider) ----
+  # Runs locally on neptun (see services/identity/authentik.nix); Caddy just
+  # terminates TLS and proxies to its loopback HTTP listener. Authentik serves
+  # its UI and its OIDC endpoints from one port — no second frontend upstream,
+  # and no h2c (it's plain HTTP/1.1, unlike Zitadel's gRPC).
   services.caddy.virtualHosts."auth.mgaction.town".extraConfig = ''
-    reverse_proxy http://localhost:8080
+    reverse_proxy http://127.0.0.1:9000
   '';
 
   # ---- Headscale + Headplane (tailnet control server + its web UI) ----