neptun: add Zitadel (identity/OIDC provider)

Local Postgres, peer-authed over the unix socket (the "zitadel" role is
granted createdb+createrole and doubles as both the runtime and bootstrap
DB user - no password anywhere). TLS terminates at Caddy; Zitadel listens
on localhost:8080 and is proxied at auth.mgaction.town.

Master key and admin bootstrap password come from sops - the admin
password specifically needs the sops.templates -> rendered-file route
(services.zitadel.steps would leak it into the world-readable Nix store),
same pattern as mercury's pihole.env.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/neptun/configuration.nix

@@ -9,6 +9,7 @@
     ../../common.nix              # shared base: user / ssh / nix / firewall
     ../../services/caddy.nix
     ../../services/tailscale.nix
+    ../../services/zitadel.nix
   ];
 
   # ---- Boot (UEFI) ----
@@ -48,6 +49,14 @@
   '';
   # TODO: port your other VPS services' vhosts here before deploying.
 
+  # ---- Zitadel (identity/OIDC provider) ----
+  # Runs locally on neptun (see services/zitadel.nix); Caddy just terminates
+  # TLS and proxies to it.
+  services.zitadel.settings.ExternalDomain = "auth.mgaction.town";
+  services.caddy.virtualHosts."auth.mgaction.town".extraConfig = ''
+    reverse_proxy http://localhost:8080
+  '';
+
   # ---- Gitea SSH forward ----
   # Caddy only proxies HTTP; git-over-ssh needs a raw TCP forward. Gitea's
   # own built-in SSH server runs on jupiter:2222 (see services/gitea.nix —

hosts/neptun/secrets.nix

@@ -13,4 +13,27 @@
   # darman's console password (own hash = distinct from jupiter/mercury).
   sops.secrets.darman_password.neededForUsers = true;
   users.users.darman.hashedPasswordFile = config.sops.secrets.darman_password.path;
+
+  # Zitadel: masterKeyFile takes a path natively (no store leak). The admin
+  # bootstrap password is different — services.zitadel.steps would render it
+  # into a world-readable store path, so render a FirstInstance steps file
+  # from the secret instead and point extraStepsPaths at it (see
+  # services/zitadel.nix and the pihole.env template on mercury for the same
+  # pattern).
+  sops.secrets.zitadel_master_key = { };
+  sops.secrets.zitadel_admin_password = { };
+  sops.templates."zitadel-first-instance.yaml".content = ''
+    FirstInstance:
+      Org:
+        Name: mgaction
+        Human:
+          UserName: admin
+          FirstName: Admin
+          LastName: Admin
+          Email:
+            Address: erik.simon.me@gmail.com
+            Verified: true
+          Password: ${config.sops.placeholder.zitadel_admin_password}
+          PasswordChangeRequired: false
+  '';
 }