refactor: move host configs under hosts/{jupiter,vps}

- git-mv jupiter/ vps/ into hosts/; fix ../ -> ../../ for common/services/secrets
- flake.nix + deploy point at hosts/<config>/
- README structure updated
- verified: jupiter/vps/vbox all eval

README.md

@@ -5,16 +5,25 @@ Flake-based NixOS config. Host: `jupiter` (ZimaBlade, NAS + services).
 ## Structure
 
 ```
-flake.nix                           # inputs (nixpkgs, disko) + nixosConfigurations
-jupiter/configuration.nix           # real host: imports + bootloader + data mount
-jupiter/disk-config.nix             # disko: OS-disk partitions + filesystems
-jupiter/hardware-configuration.nix  # PLACEHOLDER — kernel modules, regenerate on target
-jupiter/services.nix                # shared: users, ssh, samba, containers, caddy
-jupiter/vm.nix                      # VirtualBox test image (jupiter-vbox)
+flake.nix                  # inputs + nixosConfigurations (jupiter, vps, kexec, ...)
+common.nix                 # shared base: user, ssh, nix, firewall, timezone
+services/                  # one reusable module per service
+  samba.nix  avahi.nix  audiobookshelf.nix  containers.nix  caddy.nix  tailscale.nix
+hosts/
+  jupiter/                 # ZimaBlade NAS
+    configuration.nix      #   host bits + imports common + the services it runs
+    disk-config.nix        #   disko: eMMC partitions
+    hardware-configuration.nix
+    secrets.nix            #   sops-nix wiring
+    vm.nix                 #   VirtualBox test image (jupiter-vbox)
+  vps/                     # netcup public reverse proxy + tailnet node
+    configuration.nix  disk-config.nix  hardware-configuration.nix  secrets.nix
+secrets/                   # age-encrypted sops files (jupiter.yaml, vps.yaml)
+scripts/                   # deploy, edit_secrets
 ```
 
-Two configs from one service definition: `jupiter` (real host, disko-partitioned)
-and `jupiter-vbox` (test OVA). Both import `services.nix`.
+Hosts compose by importing `common.nix` + whichever `services/*` modules they
+run. Each service module opens its own firewall ports.
 
 ## Test in VirtualBox (no hardware needed)
 
@@ -35,7 +44,7 @@ an installer, partitions via disko, installs.
 > ONLY (by-id). Back up / physically identify the NAS data disk first — it must
 > NOT appear in disko. `lsblk -o NAME,SERIAL,SIZE,MODEL` to identify.
 
-1. Set the real OS disk id in `jupiter/disk-config.nix`
+1. Set the real OS disk id in `hosts/jupiter/disk-config.nix`
    (`ls -l /dev/disk/by-id`), and the data-disk mount in `configuration.nix`.
 2. Add your login SSH pubkey to `users.users.darman.openssh.authorizedKeys.keys`.
 3. Set the real samba password:
@@ -56,7 +65,7 @@ an installer, partitions via disko, installs.
    nix run github:nix-community/nixos-anywhere -- \
      --flake .#jupiter \
      --extra-files /tmp/extra \
-     --generate-hardware-config nixos-generate-config ./jupiter/hardware-configuration.nix \
+     --generate-hardware-config nixos-generate-config ./hosts/jupiter/hardware-configuration.nix \
      --target-host root@<zimablade-ip>
    ```
    `--extra-files` plants the host key before first boot (its age identity is