refactor: split services into reusable services/ modules

- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent

services/audiobookshelf.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+# Audiobookshelf audiobook/podcast server.
+# Listens on all interfaces: :8000 stays closed on the LAN (no openFirewall),
+# but reachable over the trusted tailscale0 interface and via localhost (caddy).
+# Library/media paths are set in the web UI — point them at /mnt/data/...
+# Runs as user `audiobookshelf`; added to `users` so it can read group-owned
+# library dirs on the RAID.
+{
+  services.audiobookshelf = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 8000;
+  };
+  users.users.audiobookshelf.extraGroups = [ "users" ];
+}

services/avahi.nix

@@ -0,0 +1,13 @@
+{ ... }:
+
+# mDNS/DNS-SD (advertise the host + shares on the LAN).
+{
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    publish = {
+      enable = true;
+      userServices = true;
+    };
+  };
+}

services/caddy.nix

@@ -0,0 +1,9 @@
+{ ... }:
+
+# Caddy reverse proxy — base enable + open the web ports.
+# Each host adds its own `services.caddy.virtualHosts.<name>` (LAN names on
+# jupiter, public domains with automatic HTTPS on the vps).
+{
+  services.caddy.enable = true;
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}

services/containers.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+# Podman (Docker-compatible) + declarative OCI containers.
+# Copy the whoami block per app; publish ports and mount /mnt/data volumes.
+{
+  virtualisation.podman = {
+    enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings.dns_enabled = true;
+  };
+
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers = {
+      whoami = {
+        image = "traefik/whoami:latest";
+        ports = [ "8080:80" ];
+        autoStart = true;
+      };
+    };
+  };
+}

services/samba.nix

@@ -0,0 +1,53 @@
+{ pkgs, ... }:
+
+# Samba file server for the /mnt/data share + password provisioning.
+# Import on any host that should serve the NAS.
+{
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        "workgroup" = "WORKGROUP";
+        "server string" = "jupiter";
+        "security" = "user";
+      };
+      data = {
+        "path" = "/mnt/data";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "valid users" = "darman";
+      };
+    };
+  };
+
+  # Samba keeps its own NTLM password DB, separate from the system password.
+  # `services.samba` never sets it, so logins fail until provisioned.
+  # This runs AFTER samba-smbd so its state dir (/var/lib/samba/private) exists
+  # — an activation script runs too early and smbpasswd fails to init the passdb.
+  # Reads a single-line password from the first file that exists:
+  #   Real host: /run/secrets/samba_password  (sops-nix, see secrets.nix)
+  #   VM test:   /etc/samba/smb-password       (plaintext, see vm.nix)
+  # smbpasswd prompts new + confirm, so the value is fed twice.
+  systemd.services.samba-smbpasswd = {
+    description = "Provision Samba password for darman";
+    after = [ "samba-smbd.service" ];
+    requires = [ "samba-smbd.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      for f in /run/secrets/samba_password /etc/samba/smb-password; do
+        if [ -f "$f" ]; then
+          pw=$(head -n1 "$f")
+          printf '%s\n%s\n' "$pw" "$pw" | ${pkgs.samba}/bin/smbpasswd -a -s darman
+          exit 0
+        fi
+      done
+      echo "no samba password source found" >&2
+    '';
+  };
+}

services/tailscale.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+
+# Tailscale node joined to the self-hosted headscale control server.
+# Auto-registers on boot from a sops pre-auth key. Requires the importing host
+# to declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
+# Not for the VM (no sops).
+{
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;                       # UDP 41641 for direct connections
+    authKeyFile = config.sops.secrets.tailscale_authkey.path;
+    extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
+  };
+  # Reach the host's services over the tailnet without opening LAN ports.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+}