Refactor tailscale nginx-auth module

[Dan-Theriault]

Description of changes

Tailscale's nginx-auth proxy, despite the name, actually works just fine with caddy and traefik (see tailscale/tailscale#4680). However, the current nixos module is closely coupled with nginx. This change breaks that coupling.

All options of the existing module except virtualHosts (which is nginx-specific) have been moved to a new module without any nginx coupling. The options remain exposed on the nginx-specific module as aliases.

closes #290353

@phaer

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/3618

[phaer]

Good news! Thanks for bringing this to attention.

Do you think it would make sense to wait for results of the upstream issue you linked? I.e. merging this before a rename means, that the program is confusingly still called tailscale-nginx-auth and that it's missing the '/auth-forward' endpoint, suggested in tailscale/tailscale#4680.

[Dan-Theriault]

Thank you both for reviewing.

Good news! Thanks for bringing this to attention.

Do you think it would make sense to wait for results of the upstream issue you linked? I.e. merging this before a rename means, that the program is confusingly still called tailscale-nginx-auth and that it's missing the '/auth-forward' endpoint, suggested in tailscale/tailscale#4680.

Caddy officially documents support for the feature. Their suggested workaround for lacking /auth-forward is just three lines of caddy config. I don't think that should prevent this from going ahead. The confusing program name is really the worst bit.

The current upstream situation isn't ideal, but I think it's good enough. There have not been many signs of life on the upstream ticket in the past year, and it is unclear to me if/when improvements are coming.

[Dan-Theriault]

I think I've addressed all feedback now.

[Dan-Theriault]

Got my maintainers entry added in another PR, so I've just rebased this.

[Dan-Theriault]

I've rebased again to resolve conflicts with #303841. I also removed a remaining mkPackageOptionMD while I was at it. Does anyone have further feedback? Not sure what's needed now to get this merged.