Working NixOS port: all core services operational

- Fix Caddy cfProxy helper for cloudflared http:// vhosts (X-Forwarded-Proto)
- Fix Authelia LDAP bind (readonly user ACL + password sync)
- Add gitea-admin-setup oneshot service to survive rebuilds
- Update Authelia forward_auth with header_up X-Forwarded-Proto https
- Update TODO.org with completed tasks and LDAP config details
- Remove old Helm/k8s artifacts (Chart.yaml, templates/, values/, scripts)
- Add result to .gitignore

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

AGENTS.md

@@ -40,16 +40,16 @@ PORTING.md                    # Step-by-step migration guide from the old Helm s
 
 ## Services and URLs
 
-All services live under `home.zakobar.com`.
+All services live under `zakobar.com`.
 
 | Service | URL | Auth |
 |---------|-----|------|
-| Authelia | `auth.home.zakobar.com` | Public (it is the auth portal) |
-| Gitea | `git.home.zakobar.com` | Authelia one_factor |
-| Nextcloud | `nextcloud.home.zakobar.com` | Nextcloud-native |
-| phpLDAPadmin | `ldapadmin.home.zakobar.com` | Authelia two_factor, admins only |
-| Jellyfin | `jellyfin.home.zakobar.com` | Authelia one_factor |
-| Transmission | `torrent.home.zakobar.com` | Authelia two_factor, admins only |
+| Authelia | `auth.zakobar.com` | Public (it is the auth portal) |
+| Gitea | `git.zakobar.com` | Gitea-native (LDAP) |
+| Nextcloud | `nextcloud.zakobar.com` | Nextcloud-native |
+| phpLDAPadmin | `ldapadmin.zakobar.com` | Authelia two_factor, admins only |
+| Jellyfin | `jellyfin.zakobar.com` | Jellyfin-native |
+| Transmission | `torrent.zakobar.com` | Authelia two_factor, admins only |
 
 Internal ports (all bound to `127.0.0.1`):
 
@@ -279,8 +279,8 @@ These items require the Pi to be built, flashed, and booted at least once.
   The old Helm chart had this commented out; it must be done manually once.
   Relevant settings:
   - Host: `127.0.0.1`, Port: `389`, Security: Unencrypted
-  - Bind DN: `cn=readonly,dc=home,dc=zakobar,dc=com`
-  - User search base: `ou=users,dc=home,dc=zakobar,dc=com`
+  - Bind DN: `cn=readonly,dc=zakobar,dc=com`
+  - User search base: `ou=users,dc=zakobar,dc=com`
 
 - [ ] **Nextcloud LDAP app**: After restoring the Nextcloud volume, verify
   the LDAP Users and Contacts app is still configured correctly