feat(audiobookshelf): bind 0.0.0.0 so it's reachable over tailscale (VPS proxy)

jupiter/services.nix

@@ -108,9 +108,11 @@
   # dirs on the RAID (chown/chmod or add it to the owning group as needed).
   services.audiobookshelf = {
     enable = true;
-    host = "127.0.0.1";
+    host = "0.0.0.0";   # reachable over tailscale0 (trusted) + localhost
     port = 8000;
-    # openFirewall stays off — access is via the caddy reverse proxy.
+    # openFirewall stays OFF: :8000 is blocked on the LAN, but tailscale0 is a
+    # trusted interface, so the VPS reaches it via jupiter.hosts.mgaction.town:8000.
+    # Local caddy (below) still serves LAN clients via localhost:8000.
   };
 
   users.users.audiobookshelf.extraGroups = [ "users" ];

secrets/jupiter.yaml

@@ -1,6 +1,6 @@
 samba_password: ENC[AES256_GCM,data:K3FtKC0CrOLMyfQokmxxlyUnDPo=,iv:9bTE/S/i05LJYldOHuBuz3+g8JdTuq0ysFFgXOmfti8=,tag:77NIxy7qpHRqCmbOR83AfA==,type:str]
 darman_password: ENC[AES256_GCM,data:DOHHlM4Qdw4WgkN+/M51n2LMjJqq5MS0FeGEH8Pz3297yUZ8jBDOKRS/Tek9stC05JKEQRtn/vVVbAY0nXs20MwrsDMo+IEFXx7Ms90vVyYIYe5O5/0aQkPq84vcwGN0RW1Rj5Y3s38vWA==,iv:DAqHbvOBq7FT7ALbmBXJ0HadEGEsL8V2e7R99H5ZH0s=,tag:9XpiRFIbaZjMn59uHCOA1g==,type:str]
-tailscale_authkey: ENC[AES256_GCM,data:HY/clkraY7q5+w8gqK4LXGaWYnrZYeEqu1s8Pxq+8is=,iv:IA5PWYMAJCKTWIaYvU2cw1N51+Qhm2VFa2J+JpXZH9Y=,tag:Hgi91/tRiPasEpvfnupaIQ==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:GJjN9zdU3zNBxA8cEBdsmjDrj8G/m04r8JRCEDZkdd7jYplEHyLfhbMcIyZIBe3Sh4d3PM/PcKb191LZoMg/b1G4hiVwciaCoMY0O9kAhRg/aYHXluSIBQ==,iv:R3OsZ+3to0tBhF4IaaSHm0afkw5o0KfXkcTdT9HFucg=,tag:QQNXC9ya88lO087iGIc1sw==,type:str]
 sops:
     age:
         - enc: |
@@ -21,7 +21,7 @@ sops:
             CzjSDQZTcseEXZNwuzZcfB5Mvq0BQvjOj7lGuxzuE4qwWkdJWGfVLQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
-    lastmodified: "2026-07-12T22:16:53Z"
-    mac: ENC[AES256_GCM,data:SfevvvHXHEiJi/9MDVgPZQOtYMCShRZw274j77C9jRZY/3HyY9ZsFBmrdNZpMbycD09F1rd1CQV3q/ZGpeViVQ/9c1wi4mYiaDzISr9Rp9os+zsA+wFuNxNIiTf88m1dolejgRhpPBJ3Obg2q9cWgKy0accSe63MnbF5JRrczJA=,iv:35cb8j5w80ctl+BzyCYCp+8i5RO9rROgGuZ/J1WYJK4=,tag:lczFd+2kVECelY/BwqfpAA==,type:str]
+    lastmodified: "2026-07-12T22:19:04Z"
+    mac: ENC[AES256_GCM,data:iDcCp2dE657x9xDGM4Ki76gycaOM/7Z8v7qdl3Bcf0HcbH0oKWE2nShBO8/YK67p+Dkhghp/83G8vXCmEo0MA83C+gHha6JAyX2UJtvtVhBgF0ul8LMnXt4l+l7Ps8Bjne+LLtUK3U/2LGvADANPjNbpbCwe6x9OUPHmPXWYDxo=,iv:Cnrxb3xPCvq52DoktC1Osv1WbF/I7wfIYbAVRi2eNg4=,tag:Yodqbtl1+DnDvrtgT1lawQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1