{ config, pkgs, inputs, ... }:

# Authentik — self-hosted identity/OIDC provider.
#
# Replaced Zitadel: nixpkgs only carries Zitadel 2.71 (no login-v2 split, and
# a v3/v4 database migrates forward only, so an existing instance can't be
# moved onto it). authentik-nix tracks upstream closely instead.
#
# The upstream module owns postgres (createDatabase) AND orders the units
# against postgresql.target, so no manual After= is needed here. No redis —
# recent authentik runs channels/cache on postgres.
#
# TLS terminates at Caddy; every listener is pinned to loopback below so
# nothing is reachable from the tailnet (hosts trust tailscale0).
#
# Needs, wired via sops in the host's secrets.nix: an environmentFile carrying
#   - AUTHENTIK_SECRET_KEY          (`openssl rand -base64 60`) — signs sessions
#   - AUTHENTIK_BOOTSTRAP_PASSWORD  first-run akadmin password
# systemd reads EnvironmentFile as root before dropping to the service's
# DynamicUser, so the sops default root:root 0400 is correct — do NOT set
# `owner` on it the way the headplane secrets need.
{
  imports = [ inputs.authentik-nix.nixosModules.default ];

  # Pinned explicitly: the default tracks system.stateVersion, so editing that
  # line would silently demand a pg_upgrade of the identity store. Bump this
  # deliberately, with a dump in hand.
  services.postgresql.package = pkgs.postgresql_17;

  services.authentik = {
    enable = true;
    environmentFile = config.sops.templates."authentik.env".path;

    settings = {
      # Default is 0.0.0.0 on all three; behind Caddy loopback is enough.
      listen = {
        listen_http = "127.0.0.1:9000";
        listen_https = "127.0.0.1:9443";
        listen_metrics = "127.0.0.1:9300";
      };

      disable_startup_analytics = true;
      error_reporting.enabled = false;
      avatars = "initials";
    };
  };
}