Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity,
dev, desktop) to make the growing services/ dir easier to navigate.
containers.nix stays at the top level since it's a shared backend,
not a single-category service.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/jupiter/configuration.nix

@@ -7,20 +7,20 @@
     ./disk-config.nix          # disko: OS-disk partitions + filesystems
     ./secrets.nix              # sops-nix: samba password, tailscale key, ...
     ../../common.nix              # shared base: user / ssh / nix / firewall
-    ../../services/samba.nix
-    ../../services/avahi.nix
-    ../../services/audiobookshelf.nix
+    ../../services/network/samba.nix
+    ../../services/network/avahi.nix
+    ../../services/media/audiobookshelf.nix
     ../../services/containers.nix
-    ../../services/caddy.nix
-    ../../services/tailscale.nix
-    ../../services/jellyfin.nix
-    ../../services/sabnzbd.nix
-    ../../services/prowlarr.nix
-    ../../services/sonarr.nix
-    ../../services/radarr.nix
-    ../../services/clonarr.nix
-    ../../services/seerr.nix
-    ../../services/gitea.nix
+    ../../services/network/caddy.nix
+    ../../services/vpn/tailscale.nix
+    ../../services/media/jellyfin.nix
+    ../../services/media/sabnzbd.nix
+    ../../services/media/prowlarr.nix
+    ../../services/media/sonarr.nix
+    ../../services/media/radarr.nix
+    ../../services/media/clonarr.nix
+    ../../services/media/seerr.nix
+    ../../services/dev/gitea.nix
   ];
 
   # sabnzbd's unrar dependency is unfree; scope the allowance to just that

hosts/jupiter/vm.nix

@@ -7,11 +7,11 @@
   imports = [
     (modulesPath + "/virtualisation/virtualbox-image.nix")
     ../../common.nix              # shared base: user / ssh / nix / firewall
-    ../../services/samba.nix
-    ../../services/avahi.nix
-    ../../services/audiobookshelf.nix
+    ../../services/network/samba.nix
+    ../../services/network/avahi.nix
+    ../../services/media/audiobookshelf.nix
     ../../services/containers.nix
-    ../../services/caddy.nix
+    ../../services/network/caddy.nix
   ];
 
   networking.hostName = "jupiter";

hosts/mercury/configuration.nix

@@ -7,8 +7,8 @@
   imports = [
     ../../common.nix           # shared base: user / ssh / nix / firewall
     ./secrets.nix              # sops-nix: darman password (age key on boot part.)
-    ../../services/unbound.nix      # local recursive resolver (127.0.0.1:5335)
-    ../../services/pihole.nix        # DNS adblock + DHCP (declarative static leases)
+    ../../services/network/unbound.nix      # local recursive resolver (127.0.0.1:5335)
+    ../../services/network/pihole.nix        # DNS adblock + DHCP (declarative static leases)
   ];
 
   networking.hostName = "mercury";

hosts/neptun/configuration.nix

@@ -7,11 +7,11 @@
     ./disk-config.nix          # disko: vda partitions + filesystems
     ./secrets.nix              # sops-nix: tailscale authkey
     ../../common.nix              # shared base: user / ssh / nix / firewall
-    ../../services/caddy.nix
-    ../../services/tailscale.nix
-    ../../services/zitadel.nix
-    ../../services/headscale.nix
-    ../../services/headplane.nix
+    ../../services/network/caddy.nix
+    ../../services/vpn/tailscale.nix
+    ../../services/identity/zitadel.nix
+    ../../services/vpn/headscale.nix
+    ../../services/vpn/headplane.nix
   ];
 
   # ---- Boot (UEFI) ----
@@ -52,7 +52,7 @@
   # TODO: port your other VPS services' vhosts here before deploying.
 
   # ---- Zitadel (identity/OIDC provider) ----
-  # Runs locally on neptun (see services/zitadel.nix); Caddy just terminates
+  # Runs locally on neptun (see services/identity/zitadel.nix); Caddy just terminates
   # TLS and proxies to it.
   services.zitadel.settings.ExternalDomain = "auth.mgaction.town";
   services.caddy.virtualHosts."auth.mgaction.town".extraConfig = ''
@@ -78,7 +78,7 @@
 
   # ---- Gitea SSH forward ----
   # Caddy only proxies HTTP; forward :2222 over the tailnet to gitea's own
-  # SSH server on jupiter (services/gitea.nix), so
+  # SSH server on jupiter (services/dev/gitea.nix), so
   # `ssh://git@git.mgaction.town:2222/...` works. Also needs a matching
   # inbound-2222 rule in netcup's edge firewall panel (not managed by Nix).
   systemd.services.gitea-ssh-forward = {

hosts/neptun/secrets.nix

@@ -18,7 +18,7 @@
   # bootstrap password is different — services.zitadel.steps would render it
   # into a world-readable store path, so render a FirstInstance steps file
   # from the secret instead and point extraStepsPaths at it (see
-  # services/zitadel.nix and the pihole.env template on mercury for the same
+  # services/identity/zitadel.nix and the pihole.env template on mercury for the same
   # pattern).
   sops.secrets.zitadel_master_key = { };
   sops.secrets.zitadel_admin_password = { };
@@ -39,7 +39,7 @@
 
   # Headplane: cookie_secret_path takes a path natively (no store leak).
   # oidc.client_secret + the headscale API key are still REPLACE_ME
-  # placeholders (see services/headplane.nix) until Zitadel/headscale are
+  # placeholders (see services/vpn/headplane.nix) until Zitadel/headscale are
   # actually deployed and those get created for real.
   sops.secrets.headplane_cookie_secret = { };
   sops.secrets.headplane_oidc_client_secret = { };