neptun: serve the vhosts that are actually in production

Probing the live Debian VPS turned up three mismatches between what it
serves and what this config declares:

- git.mgaction.town had no vhost at all. Gitea's web UI and HTTPS clones
  are public today; only its SSH side (the :2222 socat forward) had been
  ported, so a deploy would have taken the web side offline.
- Audiobookshelf is served as abs.mgaction.town, not the longer
  audiobookshelf.mgaction.town this config used. The mobile app is
  configured with the short name.
- The apex returns 200 from Caddy. Left unserved deliberately, so it now
  gets Caddy's default 404; noted in a comment so it doesn't look like an
  oversight next time.

Gitea's ROOT_URL was http:// while Caddy terminates TLS for that name.
Gitea builds absolute URLs from it, so clone buttons, redirects and
webhooks were handing out downgraded links.

Also record that defaultGateway6 is confirmed rather than assumed --
`ip -6 route show default` on the VPS gives "default via fe80::1 dev
eth0 metric 1024 onlink".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hosts/neptun/configuration.nix

@@ -38,8 +38,8 @@
     ipv6.addresses = [ { address = "2a0a:4cc0:c2:19e1:44b4:8dff:fe4d:c7d7"; prefixLength = 64; } ];
   };
   networking.defaultGateway = { address = "159.195.64.1"; interface = "eth0"; };
-  # netcup IPv6 gateway is conventionally fe80::1 — VERIFY with `ip -6 route`
-  # on the running VPS; wrong v6 gw won't break v4 reachability.
+  # Confirmed against `ip -6 route show default` on the VPS:
+  #   default via fe80::1 dev eth0 metric 1024 onlink
   networking.defaultGateway6 = { address = "fe80::1"; interface = "eth0"; };
   networking.nameservers = [ "9.9.9.9" "1.1.1.1" "2620:fe::fe" ];
 
@@ -69,13 +69,23 @@
   services.caddy.globalConfig = "email {$ACME_EMAIL}";
 
   # ---- Public reverse proxy vhosts ----
-  # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains.
-  # Proxies to jupiter's audiobookshelf over the tailnet (MagicDNS name).
-  # Needs a public A record -> this VPS IP (ports 80/443 opened by the module).
-  services.caddy.virtualHosts."audiobookshelf.mgaction.town".extraConfig = ''
+  # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains; the
+  # *.mgaction.town wildcard already points every name here (A + AAAA), and
+  # the module opens 80/443. Both of these live on jupiter and are reached
+  # over the tailnet — see the /etc/hosts pin above.
+  #
+  # `abs`, not `audiobookshelf`: that's the name this has always been served
+  # under, and the mobile app is configured with it.
+  services.caddy.virtualHosts."abs.mgaction.town".extraConfig = ''
     reverse_proxy http://jupiter.hosts.mgaction.town:8000
   '';
-  # TODO: port your other VPS services' vhosts here before deploying.
+  # Gitea's web UI and HTTPS clones (services/dev/gitea.nix, HTTP_PORT 3000).
+  # Its SSH side is the separate :2222 forward further down.
+  services.caddy.virtualHosts."git.mgaction.town".extraConfig = ''
+    reverse_proxy http://jupiter.hosts.mgaction.town:3000
+  '';
+  # The apex mgaction.town is deliberately not served — it returns Caddy's
+  # default 404.
 
   # ---- Authentik (identity/OIDC provider) ----
   # Runs locally on neptun (see services/identity/authentik.nix); Caddy just