diff --git a/hosts/neptun/configuration.nix b/hosts/neptun/configuration.nix
index d89b349..d24434e 100644
--- a/hosts/neptun/configuration.nix
+++ b/hosts/neptun/configuration.nix
@@ -38,8 +38,8 @@
     ipv6.addresses = [ { address = "2a0a:4cc0:c2:19e1:44b4:8dff:fe4d:c7d7"; prefixLength = 64; } ];
   };
   networking.defaultGateway = { address = "159.195.64.1"; interface = "eth0"; };
-  # netcup IPv6 gateway is conventionally fe80::1 — VERIFY with `ip -6 route`
-  # on the running VPS; wrong v6 gw won't break v4 reachability.
+  # Confirmed against `ip -6 route show default` on the VPS:
+  #   default via fe80::1 dev eth0 metric 1024 onlink
   networking.defaultGateway6 = { address = "fe80::1"; interface = "eth0"; };
   networking.nameservers = [ "9.9.9.9" "1.1.1.1" "2620:fe::fe" ];
 
@@ -69,13 +69,23 @@
   services.caddy.globalConfig = "email {$ACME_EMAIL}";
 
   # ---- Public reverse proxy vhosts ----
-  # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains.
-  # Proxies to jupiter's audiobookshelf over the tailnet (MagicDNS name).
-  # Needs a public A record -> this VPS IP (ports 80/443 opened by the module).
-  services.caddy.virtualHosts."audiobookshelf.mgaction.town".extraConfig = ''
+  # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains; the
+  # *.mgaction.town wildcard already points every name here (A + AAAA), and
+  # the module opens 80/443. Both of these live on jupiter and are reached
+  # over the tailnet — see the /etc/hosts pin above.
+  #
+  # `abs`, not `audiobookshelf`: that's the name this has always been served
+  # under, and the mobile app is configured with it.
+  services.caddy.virtualHosts."abs.mgaction.town".extraConfig = ''
     reverse_proxy http://jupiter.hosts.mgaction.town:8000
   '';
-  # TODO: port your other VPS services' vhosts here before deploying.
+  # Gitea's web UI and HTTPS clones (services/dev/gitea.nix, HTTP_PORT 3000).
+  # Its SSH side is the separate :2222 forward further down.
+  services.caddy.virtualHosts."git.mgaction.town".extraConfig = ''
+    reverse_proxy http://jupiter.hosts.mgaction.town:3000
+  '';
+  # The apex mgaction.town is deliberately not served — it returns Caddy's
+  # default 404.
 
   # ---- Authentik (identity/OIDC provider) ----
   # Runs locally on neptun (see services/identity/authentik.nix); Caddy just
diff --git a/services/dev/gitea.nix b/services/dev/gitea.nix
index 4423c45..510fe95 100644
--- a/services/dev/gitea.nix
+++ b/services/dev/gitea.nix
@@ -22,7 +22,10 @@
       server = {
         DOMAIN = "git.mgaction.town";
         SSH_DOMAIN = "git.mgaction.town";
-        ROOT_URL = "http://git.mgaction.town/";
+        # https, not http: neptun's Caddy terminates TLS for this name. Gitea
+        # builds its absolute URLs (clone buttons, redirects, webhooks) from
+        # ROOT_URL, so an http:// value hands out downgraded links.
+        ROOT_URL = "https://git.mgaction.town/";
         HTTP_PORT = 3000;
         START_SSH_SERVER = true;
         SSH_PORT = 2222;