mercury: join the tailnet

mercury was the only host with no tailscale at all -- no module import,
no secret, no key in its sops file. It had been enrolled before the NixOS
migration and silently dropped off the tailnet when it was reflashed with
a config that omitted it.

--accept-dns=false, as on neptun and for a sharper reason: headscale
pushes override_local_dns, so accepting MagicDNS would repoint the LAN's
own DNS server at 100.100.100.100 and make house-wide name resolution
depend on tailscaled being up. This host has already deadlocked once on
boot-time DNS (see CLAUDE.md).

darman_password is also rotated: the account had "!" in /etc/shadow,
because on mercury's first boot the secret wasn't readable yet and
update-users-groups.pl falls back to a locked account. mutableUsers is
true, so no later rebuild ever revisited it and the lock was permanent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hosts/mercury/configuration.nix

@@ -9,6 +9,7 @@
     ./secrets.nix              # sops-nix: darman password (age key on boot part.)
     ../../services/network/unbound.nix      # local recursive resolver (127.0.0.1:5335)
     ../../services/network/pihole.nix        # DNS adblock + DHCP (declarative static leases)
+    ../../services/vpn/tailscale.nix        # tailnet node (headscale on neptun)
   ];
 
   networking.hostName = "mercury";
@@ -33,6 +34,13 @@
   # host resolves during boot without depending on its own pihole/unbound.
   networking.nameservers = [ "1.1.1.1" "9.9.9.9" ];
 
+  # Never take MagicDNS on THIS host. headscale pushes override_local_dns, so
+  # accepting it would repoint mercury's resolv.conf at 100.100.100.100 and
+  # make the LAN's DNS server depend on tailscaled to resolve anything — the
+  # same boot-time DNS deadlock this host already hit once (see CLAUDE.md),
+  # except a failure here takes the whole network's DNS down with it.
+  services.tailscale.extraUpFlags = [ "--accept-dns=false" ];
+
   # ---- pihole web admin password (from sops) ----
   # The pihole container reads FTLCONF_* env vars. Render an env file from the
   # sops secret and feed it to the container — password stays out of repo/store.