feat: tailscale via headscale (vpn.mgaction.town) + fix audiobookshelf extraGroups syntax

- services.tailscale auto-registers with headscale using a sops pre-auth key
- trust tailscale0 so LAN services are reachable over the tailnet
- fix missing semicolon on audiobookshelf extraGroups

jupiter/configuration.nix

@@ -39,4 +39,19 @@
     fsType = "ext4";
     options = [ "nofail" ];  # don't block boot if the array is degraded/absent
   };
+
+  # ---- Tailscale (via self-hosted headscale) ----
+  # Auto-registers on boot using a headscale pre-auth key from sops.
+  # Generate the key on the headscale server, e.g.:
+  #   headscale preauthkeys create --user <user> --expiration 1h
+  # then put it in secrets/jupiter.yaml (./edit_secrets, key: tailscale_authkey).
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;                       # UDP 41641 for direct connections
+    authKeyFile = config.sops.secrets.tailscale_authkey.path;
+    extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
+  };
+  # Reach jupiter's services (ssh, samba, audiobookshelf) over the tailnet
+  # without opening those ports on the LAN.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
 }

jupiter/secrets.nix

@@ -22,4 +22,7 @@
   sops.secrets.darman_password.neededForUsers = true;
   users.users.darman.hashedPasswordFile =
     config.sops.secrets.darman_password.path;
+
+  # Headscale pre-auth key for tailscale auto-registration (see configuration.nix).
+  sops.secrets.tailscale_authkey = { };
 }

jupiter/services.nix

@@ -113,6 +113,8 @@
     # openFirewall stays off — access is via the caddy reverse proxy.
   };
 
+  users.users.audiobookshelf.extraGroups = [ "users" ];
+
   # ---- Containers ----
   virtualisation.podman = {
     enable = true;
@@ -144,7 +146,7 @@
     # Reach at http://audiobookshelf.sol — add a pihole local-DNS record
     # audiobookshelf.sol -> jupiter's IP. (Or browse jupiter.sol directly if you
     # set services.audiobookshelf.host = "0.0.0.0" + openFirewall instead.)
-    virtualHosts."http://audiobookshelf.sol".extraConfig = ''
+    virtualHosts."http://audiobookshelf.jupiter.sol".extraConfig = ''
       reverse_proxy localhost:8000
     '';
   };