refactor: split services into reusable services/ modules

- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent

jupiter/configuration.nix

@@ -1,14 +1,25 @@
 { config, pkgs, lib, ... }:
 
-# Real-host config: hardware + disk layout + bootloader + shared services.
+# ZimaBlade NAS host: hardware + disk + the services it runs.
 {
   imports = [
     ./hardware-configuration.nix
     ./disk-config.nix          # disko: OS-disk partitions + filesystems
-    ./secrets.nix              # sops-nix: samba password etc.
-    ./services.nix
+    ./secrets.nix              # sops-nix: samba password, tailscale key, ...
+    ../common.nix              # shared base: user / ssh / nix / firewall
+    ../services/samba.nix
+    ../services/avahi.nix
+    ../services/audiobookshelf.nix
+    ../services/containers.nix
+    ../services/caddy.nix
+    ../services/tailscale.nix
   ];
 
+  # ---- Host identity ----
+  networking.hostName = "jupiter";
+  networking.networkmanager.enable = true;
+  users.users.darman.extraGroups = [ "docker" ];   # merges with common.nix
+
   # ---- Boot ----
   # systemd-boot for UEFI. If ZimaBlade boots legacy/BIOS, switch to grub.
   boot.loader.systemd-boot.enable = true;
@@ -19,10 +30,6 @@
   # hardware-configuration.nix) or stage-1 can't mount root and the box panics.
   boot.initrd.availableKernelModules = [ "mmc_block" "sdhci_pci" "sdhci_acpi" ];
 
-  # Trust wheel users so `nixos-rebuild --target-host darman@…` can push a
-  # laptop-built (unsigned) closure without a signature error.
-  nix.settings.trusted-users = [ "root" "@wheel" ];
-
   # Warm reboot hangs at firmware reset on this board (cold power-cycle works).
   # Force the PCI-chipset reset method. If a warm `reboot` still hangs, try the
   # next value: acpi -> bios -> cold -> efi.
@@ -40,18 +47,12 @@
     options = [ "nofail" ];  # don't block boot if the array is degraded/absent
   };
 
-  # ---- Tailscale (via self-hosted headscale) ----
-  # Auto-registers on boot using a headscale pre-auth key from sops.
-  # Generate the key on the headscale server, e.g.:
-  #   headscale preauthkeys create --user <user> --expiration 1h
-  # then put it in secrets/jupiter.yaml (./edit_secrets, key: tailscale_authkey).
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;                       # UDP 41641 for direct connections
-    authKeyFile = config.sops.secrets.tailscale_authkey.path;
-    extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
+  # ---- Caddy vhosts (LAN) ----
+  # whoami on :80, audiobookshelf via a pihole local-DNS name -> jupiter IP.
+  services.caddy.virtualHosts = {
+    "http://localhost".extraConfig = "reverse_proxy localhost:8080";
+    "http://audiobookshelf.jupiter.sol".extraConfig = "reverse_proxy localhost:8000";
   };
-  # Reach jupiter's services (ssh, samba, audiobookshelf) over the tailnet
-  # without opening those ports on the LAN.
-  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+
+  system.stateVersion = "26.05";
 }