Tunnel authentik.rubenhensen.nl through Hetzner

Same pattern as rss — needed so the OIDC redirect from freshrss (and
other relying parties) works for clients outside the home LAN.

nix-infra-machine/nodes/node001.nix

@@ -53,8 +53,9 @@ in
     #   - tunneled hosts → home cluster ingress on 443
     streamConfig = ''
       map $ssl_preread_server_name $tunnel_upstream {
-        rss.rubenhensen.nl  ${homeIP}:443;
-        default             127.0.0.1:8443;
+        rss.rubenhensen.nl        ${homeIP}:443;
+        authentik.rubenhensen.nl  ${homeIP}:443;
+        default                   127.0.0.1:8443;
       }
 
       server {
@@ -78,6 +79,16 @@ in
       };
     };
 
+    virtualHosts."authentik.rubenhensen.nl" = {
+      listen = [
+        { addr = "0.0.0.0"; port = 80; }
+        { addr = "[::]"; port = 80; }
+      ];
+      locations."/" = {
+        proxyPass = "http://${homeIP}";
+      };
+    };
+
     virtualHosts."mail.rubenhensen.nl" = {
       listen = [
         { addr = "0.0.0.0"; port = 80; }