feat: tailscale via headscale (vpn.mgaction.town) + fix audiobookshelf extraGroups syntax

- services.tailscale auto-registers with headscale using a sops pre-auth key
- trust tailscale0 so LAN services are reachable over the tailnet
- fix missing semicolon on audiobookshelf extraGroups

jupiter/configuration.nix

@@ -39,4 +39,19 @@
     fsType = "ext4";
     options = [ "nofail" ];  # don't block boot if the array is degraded/absent
   };
+
+  # ---- Tailscale (via self-hosted headscale) ----
+  # Auto-registers on boot using a headscale pre-auth key from sops.
+  # Generate the key on the headscale server, e.g.:
+  #   headscale preauthkeys create --user <user> --expiration 1h
+  # then put it in secrets/jupiter.yaml (./edit_secrets, key: tailscale_authkey).
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;                       # UDP 41641 for direct connections
+    authKeyFile = config.sops.secrets.tailscale_authkey.path;
+    extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
+  };
+  # Reach jupiter's services (ssh, samba, audiobookshelf) over the tailnet
+  # without opening those ports on the LAN.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
 }

jupiter/secrets.nix

@@ -22,4 +22,7 @@
   sops.secrets.darman_password.neededForUsers = true;
   users.users.darman.hashedPasswordFile =
     config.sops.secrets.darman_password.path;
+
+  # Headscale pre-auth key for tailscale auto-registration (see configuration.nix).
+  sops.secrets.tailscale_authkey = { };
 }

jupiter/services.nix

@@ -113,6 +113,8 @@
     # openFirewall stays off — access is via the caddy reverse proxy.
   };
 
+  users.users.audiobookshelf.extraGroups = [ "users" ];
+
   # ---- Containers ----
   virtualisation.podman = {
     enable = true;
@@ -144,7 +146,7 @@
     # Reach at http://audiobookshelf.sol — add a pihole local-DNS record
     # audiobookshelf.sol -> jupiter's IP. (Or browse jupiter.sol directly if you
     # set services.audiobookshelf.host = "0.0.0.0" + openFirewall instead.)
-    virtualHosts."http://audiobookshelf.sol".extraConfig = ''
+    virtualHosts."http://audiobookshelf.jupiter.sol".extraConfig = ''
       reverse_proxy localhost:8000
     '';
   };

secrets/jupiter.yaml

@@ -1,26 +1,27 @@
-samba_password: ENC[AES256_GCM,data:q1+8x+vAWdvLMklsee3CVqbByhc=,iv:CsHTBcHXAFJX0updHAlVXuTAjKNUfB+ZsMKChetjgwA=,tag:CnDlR0JmJdDcVXOXBPj/RQ==,type:str]
-darman_password: ENC[AES256_GCM,data:PRFYKMivFqAKukUshXMd7hyE7/cNMpvzCElfo3spbLiTjR2Z3XOyHd7SCHOZz9E/WL0Imjg6bMUAQEAuMD+k7tsW2WYgNIKY8pSXwOHg3joSOMXdS0qIjm0ScpJdYkQm9F2CGqX+1893HA==,iv:t/DI4gkjlYx3NGUoLrbnYnpeAudbedlU2gMw3zf6l/4=,tag:z+YInmhPXf/6HCmauS4oEg==,type:str]
+samba_password: ENC[AES256_GCM,data:K3FtKC0CrOLMyfQokmxxlyUnDPo=,iv:9bTE/S/i05LJYldOHuBuz3+g8JdTuq0ysFFgXOmfti8=,tag:77NIxy7qpHRqCmbOR83AfA==,type:str]
+darman_password: ENC[AES256_GCM,data:DOHHlM4Qdw4WgkN+/M51n2LMjJqq5MS0FeGEH8Pz3297yUZ8jBDOKRS/Tek9stC05JKEQRtn/vVVbAY0nXs20MwrsDMo+IEFXx7Ms90vVyYIYe5O5/0aQkPq84vcwGN0RW1Rj5Y3s38vWA==,iv:DAqHbvOBq7FT7ALbmBXJ0HadEGEsL8V2e7R99H5ZH0s=,tag:9XpiRFIbaZjMn59uHCOA1g==,type:str]
+tailscale_authkey: ENC[AES256_GCM,data:HY/clkraY7q5+w8gqK4LXGaWYnrZYeEqu1s8Pxq+8is=,iv:IA5PWYMAJCKTWIaYvU2cw1N51+Qhm2VFa2J+JpXZH9Y=,tag:Hgi91/tRiPasEpvfnupaIQ==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTTDlIMSt0MU1oalJveFQ5
-            QVhhS2cxeFBRTEdLbXpsbGkvY3dkR3FCN1c4ClR6dklYemtlTDcwbkZEYU5CS2ty
-            UHJ6SXlyUDVVb2dnLzZrQjVYdVhleEUKLS0tIFJFckt0ZDJsOG14TUhadURBaDd1
-            bEkwUWlnSlVhVXpScFNybzhWQkVMMEEKvEggmrMSBY/Rf1b9pKqYiY+EXxUV10pE
-            71UqOrc1o9p5XaCoyJSMjQAyEeUjzDYCbAdCV6F4uhhvhjrDye/7HQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2K0xFQmNXUGhHRW9FdEJB
+            c1BHQnJCODRGSUlMWkV1SEZlR1JpWTVpdzNBClprWmtIMEJlY3k1TE9CY3pCSlZ2
+            VDNlRFI4TUZPK2w2OU16VmlUck5IQmcKLS0tIEJJdkVzRERXTDNmWW81ZHRaeVBZ
+            SFAxTHNRdFFkTjRQK3RjemI5MW0vYTQKEMp7vk0QnhMGsn+Dfo50YNZ2jHFrbv0i
+            wU033yhkuHj3U7YHfhXYLEe8+Mq7BTVHe/dB97DYBDWmxHaL3Q/q5Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNUp6d1l0ZXp6aGgzRDZw
-            MXdwKzNoU09ZWUxzOHVHZmxSOEYrQ0NsclVJCitXaXUrUlc1cHduU3dKMzFhLzdO
-            Q2ZXcDRBcUh5M3EyT2tDTjNjR0N6bVEKLS0tIC9Ybis4SkNvcXNiQ0Q0MEt3V1F4
-            aFNldCtPejFrUUc1bmxtSnJVSVorWjAKL6qjr8r27TTC3jGm14qxkXZ4dG/O5yNz
-            Bl0sZdxnncvjOaVb+q/9XNofRGkaYiAQUsuo7jJBI/MpfxHyPyz36A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSRjhjWGZDMUZlWVBBc3hp
+            RWg4U2J0UWtReUJjUFpaQ2x2MzVURmhIZ1IwCld1aGRXZ0Fvcmpmd0tZTVdoVGxh
+            QnFvMWFaK1hWbVI4R1dOckpnMW5iSzAKLS0tICtod0FTODBMTXlTUFN6Vmx1dnV5
+            c241eUJUYUY0Sm41bzRZY1Z6VnVMcjgKzsSm8DWK1cga5VKAGSu7vYuCV1/2qmzk
+            CzjSDQZTcseEXZNwuzZcfB5Mvq0BQvjOj7lGuxzuE4qwWkdJWGfVLQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
-    lastmodified: "2026-07-12T19:34:32Z"
-    mac: ENC[AES256_GCM,data:bOOQ4yan8xAUG86TEql/Oh3kGEV02VMYeM9Acu4rCm52ytlmmF7nrbFqxQZ+oveNG3NyGri6BBuI5es7kddyzheMjexyCV4agFwQUSEsBnBf4FY+xmkvzHwsHkozJkdXZUfOfI06zIxQI2eRo4w4bNowicCHVwTTfAKFwOkDji4=,iv:DYLfyOzNRJ1ymMJRri2KVtvKWmZhX6rGkYqWh0/U77w=,tag:BfMJhetN4h4kd9fp0DDw9g==,type:str]
+    lastmodified: "2026-07-12T22:16:53Z"
+    mac: ENC[AES256_GCM,data:SfevvvHXHEiJi/9MDVgPZQOtYMCShRZw274j77C9jRZY/3HyY9ZsFBmrdNZpMbycD09F1rd1CQV3q/ZGpeViVQ/9c1wi4mYiaDzISr9Rp9os+zsA+wFuNxNIiTf88m1dolejgRhpPBJ3Obg2q9cWgKy0accSe63MnbF5JRrczJA=,iv:35cb8j5w80ctl+BzyCYCp+8i5RO9rROgGuZ/J1WYJK4=,tag:lczFd+2kVECelY/BwqfpAA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1