Zitadel project hass on neoprism with a public app (PKCE, no secret) and access = "managed": users get access via a user grant an admin gives in the id.lassul.us console. On acheron the auth_oidc custom component from nixpkgs is mounted into the Home Assistant container and configured via /config/packages, next to the username/password login.

modules.zitadel gets authMethod = "none" for public clients: reconcile generates no secret for them and writes only the client id to the env file, so nothing secret has to reach acheron.

Zitadel generates the client id, so it cannot be known at eval time on acheron. It is not secret; after neoprism is deployed it is copied from /var/lib/zitadel-apps/hass-web.env into the prompted hass-oidc var and passed to the container as HASS_OIDC_CLIENT_ID (!env_var in the yaml).

automatic_user_linking reuses the existing HA user whose username equals the preferred_username claim instead of creating a new one; it stays on because only users granted the project can log in. The groups scope is not requested since Zitadel has no groups claim.

Keeps Login V1 (also for a new instance) and turns off the service ping
that v4 sends to zitadel.com by default.

Based on nixpkgs PR 561044 (zitadel 4.17.3), built from source with
the console and protoc-gen-js 4.0.2; without the Login V2 app.

Each machine gets a backup.nix with its storage box sub-account
(coaxmetal sub2, styx sub3, acheron sub4, the yellow container sub5);
what is backed up is declared next to the services:

- coaxmetal: the hermes home without caches, toolchains, git clones,
node_modules and target dirs. Every *.db under .hermes (except cache/),
also in subdirs such as cron/ and the matrix crypto store, is dumped
with sqlite3 .backup into /var/backup/hermes, recreated each run so
removed databases don't linger; the live files are excluded.
- styx: n8n's DynamicUser state (/var/lib/private/n8n), its default
SQLite database dumped.
- acheron: zigbee2mqtt (devices, coordinator backup; database.db is JSON)
and mosquitto's retained messages as plain copies.
- yellow: jellyfin, sonarr, radarr, prowlarr, jellyseerr and sabnzbd
configs with their SQLite databases dumped. Excluded: jellyfin metadata,
logs and transcodes, servarr MediaCover and logs (also logs.db),
jellyseerr cache and logs, sabnzbd's incomplete Downloads and logs.
Media and downloads live in /var/download and are not backed up. A
missing database fails the hook instead of sqlite3 creating an empty one.

Grafana (coaxmetal, styx) is not backed up: datasources and dashboards
are provisioned from the repo, admin password and secret key come from
vars, anonymous users are viewers; both instances only have the four
provisioned dashboards.

Every machine now backs up into its own Hetzner storage box sub-account
(isolation: one machine's ssh key can't read or delete another's
archives), into ./borg in the sub-account's home. lass.backup.user replaces
lass.backup.repo and enables the job; host, port 23 and the box's host key
are module defaults, so a machine's backup.nix is only the sub-account.

Repos are always encrypted (repokey-blake2). The passphrase comes from a
per-machine clan vars generator borgbackup-repokey; it lives in the
password store, so passphrase + repo are enough to restore. The borgbackup
ssh key generator is unchanged.

neoprism moves to a new repo on u550643-sub1 (doInit creates it); the old
unencrypted repo u550643@...:/./neoprism is no longer referenced and is
removed by hand. Its paths, excludes and hooks are unchanged. The job stays
`hetzner`: with fresh repos nothing gains from a rename, and the unit name
is used for the postBackup hooks.

The timers get a fixed random delay of up to 1h after 03:00, so the
machines sharing the box don't all start at once.