{ config, pkgs, inputs, ... }:

# Authentik — self-hosted identity/OIDC provider. Replaced Zitadel because
# nixpkgs is stuck on 2.71 (no login-v2 split) with a forward-only db
# migration; authentik-nix tracks upstream closely instead.
#
# The upstream module owns postgres and its unit ordering, and needs no redis
# (channels/cache run on postgres). TLS terminates at Caddy; every listener
# below is pinned to loopback since only tailscale0 is trusted.
#
# Needs an environmentFile from sops (host's secrets.nix) carrying
# AUTHENTIK_SECRET_KEY and AUTHENTIK_BOOTSTRAP_PASSWORD. Keep it root:root
# 0400 (systemd reads it as root before dropping to DynamicUser) — don't set
# `owner` the way headplane's secrets need.
{
  imports = [ inputs.authentik-nix.nixosModules.default ];

  # Pinned explicitly: the default tracks system.stateVersion, so editing that
  # would silently demand a pg_upgrade of the identity store.
  services.postgresql.package = pkgs.postgresql_17;

  services.authentik = {
    enable = true;
    environmentFile = config.sops.templates."authentik.env".path;

    settings = {
      # Default is 0.0.0.0 on all three; behind Caddy loopback is enough.
      listen = {
        listen_http = "127.0.0.1:9000";
        listen_https = "127.0.0.1:9443";
        listen_metrics = "127.0.0.1:9300";
      };

      disable_startup_analytics = true;
      error_reporting.enabled = false;
      avatars = "initials";
    };
  };
}