feat: add audiobookshelf (native service + caddy vhost)

jupiter/services.nix

@@ -101,6 +101,18 @@
     };
   };
 
+  # ---- Audiobookshelf ----
+  # Native module. Listens on localhost only; reached through caddy.
+  # Library/media paths are set in the web UI — point them at /mnt/data/...
+  # The service runs as user `audiobookshelf`, which must be able to READ those
+  # dirs on the RAID (chown/chmod or add it to the owning group as needed).
+  services.audiobookshelf = {
+    enable = true;
+    host = "127.0.0.1";
+    port = 8000;
+    # openFirewall stays off — access is via the caddy reverse proxy.
+  };
+
   # ---- Containers ----
   virtualisation.podman = {
     enable = true;
@@ -129,6 +141,12 @@
     virtualHosts."http://localhost".extraConfig = ''
       reverse_proxy localhost:8080
     '';
+    # Reach at http://audiobookshelf.sol — add a pihole local-DNS record
+    # audiobookshelf.sol -> jupiter's IP. (Or browse jupiter.sol directly if you
+    # set services.audiobookshelf.host = "0.0.0.0" + openFirewall instead.)
+    virtualHosts."http://audiobookshelf.sol".extraConfig = ''
+      reverse_proxy localhost:8000
+    '';
   };
 
   # ---- System packages ----