refactor: split services into reusable services/ modules

- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent

vps/configuration.nix

@@ -6,7 +6,9 @@
     ./hardware-configuration.nix
     ./disk-config.nix          # disko: vda partitions + filesystems
     ./secrets.nix              # sops-nix: tailscale authkey
-    ../common.nix              # shared user / ssh / nix settings
+    ../common.nix              # shared base: user / ssh / nix / firewall
+    ../services/caddy.nix
+    ../services/tailscale.nix
   ];
 
   # ---- Boot (UEFI) ----
@@ -34,31 +36,17 @@
   # Public resolvers for early boot; tailscale MagicDNS overrides once up.
   networking.nameservers = [ "9.9.9.9" "1.1.1.1" "2620:fe::fe" ];
 
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [ 22 80 443 ];
-    trustedInterfaces = [ "tailscale0" ];   # reach admin services over the tailnet
-  };
+  # firewall (enable + 22), caddy (80/443), tailscale (trust tailscale0 + join
+  # headscale) come from ../common.nix and ../services/{caddy,tailscale}.nix.
 
-  # ---- Tailscale (via headscale) ----
-  services.tailscale = {
-    enable = true;
-    authKeyFile = config.sops.secrets.tailscale_authkey.path;
-    extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
-  };
-
-  # ---- Public reverse proxy ----
+  # ---- Public reverse proxy vhosts ----
   # Caddy gets automatic public HTTPS (Let's Encrypt) for real domains.
   # Proxies to jupiter's audiobookshelf over the tailnet (MagicDNS name).
-  # Add one block per public service. Needs a public A record -> this VPS IP
-  # and ports 80/443 open (they are, above).
-  services.caddy = {
-    enable = true;
-    virtualHosts."audiobookshelf.mgaction.town".extraConfig = ''
-      reverse_proxy http://jupiter.hosts.mgaction.town:8000
-    '';
-    # TODO: port your other VPS services' vhosts here before deploying.
-  };
+  # Needs a public A record -> this VPS IP (ports 80/443 opened by the module).
+  services.caddy.virtualHosts."audiobookshelf.mgaction.town".extraConfig = ''
+    reverse_proxy http://jupiter.hosts.mgaction.town:8000
+  '';
+  # TODO: port your other VPS services' vhosts here before deploying.
 
   system.stateVersion = "26.05";   # set at install time; do NOT bump on upgrades
 }