Enable golink OAuth authentication on spore (#344)

* feat(spore): use apoxy-dev golink fork with OAuth key support

Switch golink input from tailscale/golink to the apoxy-dev fork
(dilyevsky/tsnet-1.90-upgrade branch) to enable OAuth key
authentication, which is not yet available upstream.

See: tailscale/golink#210

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(spore): update tailscale auth key to OAuth client secret

Replace expiring Tailscale auth key with a non-expiring OAuth client
secret for golink authentication.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(spore): override golink vendorHash for apoxy-dev fork

The apoxy-dev fork has a stale vendorHash in its flake.nix. Add a
local overlay to fix it, and reorder NixOS modules so the golink
overlay is applied before ours.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(spore): override golink goModules hash instead of vendorHash

vendorHash is consumed by buildGoModule to create a separate
fixed-output derivation, so overrideAttrs doesn't reach it. Override
goModules.outputHash directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(spore): rebuild golink package with correct vendorHash

overrideAttrs can't reach vendorHash since it's consumed by
buildGoModule before derivation creation. Rebuild the package
from scratch using the same source and ldflags.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(spore): set golink package directly to fix vendorHash

The golink flake's overlay always overwrites pkgs.golink with its
own pre-built package, making overlay-based overrides ineffective.
Set services.golink.package directly with the correct vendorHash.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: stackptr

flake.lock

@@ -39,7 +39,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     golink = {
-      url = "github:tailscale/golink";
+      url = "github:apoxy-dev/golink/dilyevsky/tsnet-1.90-upgrade";
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.systems.follows = "systems";
     };

flake.nix

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 2AxgaQ Bml5zq38B3BTWMtQ8jDplWdAb/KRYeHInY+ON6Vr80I
-P+uTPP3Xul0eMo5tMu4A6nwhFAhBmoVwoN0k/QnoUxw
--> ssh-ed25519 3EWhnQ qKFgwRZ0Aj8UBm4Ti2qtQqdZku6y4gd29Lqfg9aoLnM
-wQ/rJ5aTJBbM+DMHR8eWiLrLXxYRMxMnQVs+yk4UvTI
---- VMe18Za/KOH7wECyAiwcYfvpsyjAE/oo1nCsW7umrvw
-g��C��,��I��S�ø���c6�P�ϻ�(�� F<�P���Ň����h��٫n���hFm]>���u�*m�+����TL�W�.�r�����YP
+-> ssh-ed25519 2AxgaQ nZxoKnnhBN/Vu5ChV+cvH/+/QtoACBB5EdMeRHfTExY
+0//vPZFL/tECbRHROmZ4rLK6ZGKwfmFFBPIpIZdLcOk
+-> ssh-ed25519 3EWhnQ 6y7+yYJFVby7SLWf/1ngX7LxIyhASKzqLlo75vVkylc
+wcX9MumA4EF9W0dHE/KnHIbDU2b5C4HsdWe9q2sO8+Q
+--- r/2H19LwRcmRGfyIVrLDDxGKN2rKFLmkD1BTRyNL3uU
+BWL�E$�0og�ƿ��+�j8�FȤ�"�AS�2�IC�I�ƅ�0��p\���
��)j��9�@e���ks[�X����H�쬋�ӽ*O��x��

hosts/spore/secrets/tailscale-auth-key.age

@@ -31,6 +31,11 @@
   services.golink = {
     enable = true;
     tailscaleAuthKeyFile = config.age.secrets.tailscale-auth-key.path;
+    package = pkgs.buildGo125Module {
+      pname = "golink";
+      inherit (pkgs.golink) version src ldflags;
+      vendorHash = "sha256-M3Qm25KF6gWtp3K1SigLucgrIJ+5KokMq+Bp7XXaE+o=";
+    };
   };
 
   services.openssh.enable = true;