From 062a631edf77dcddf3b531bcafa1476ab7b491f3 Mon Sep 17 00:00:00 2001 From: erik Date: Sat, 11 Jul 2026 19:01:34 +0200 Subject: [PATCH] feat: samba password provisioning + caddy reverse proxy; rename user to darman - systemd oneshot sets SMB password after samba-smbd (activation ran too early) - caddy vhost reverse_proxy to whoami so :80 actually serves - vm.nix: throwaway SMB secret for testing; real host uses sops/agenix Co-Authored-By: Claude Opus 4.8 --- .gitignore | 3 +++ build-ova.sh | 25 +++++++++++++++++++++++++ flake.lock | 27 +++++++++++++++++++++++++++ jupiter/services.nix | 38 ++++++++++++++++++++++++++++++++++---- jupiter/vm.nix | 20 ++++++++++++++++++-- 5 files changed, 107 insertions(+), 6 deletions(-) create mode 100755 build-ova.sh create mode 100644 flake.lock diff --git a/.gitignore b/.gitignore index ce7b4b1..753c953 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,6 @@ result result-* .direnv/ + +# built artifacts +*.ova diff --git a/build-ova.sh b/build-ova.sh new file mode 100755 index 0000000..048c71f --- /dev/null +++ b/build-ova.sh @@ -0,0 +1,25 @@ +#!/usr/bin/env bash +# Build the VirtualBox OVA inside a throwaway nixos/nix container. +# No nix needed on the host. Output: ./jupiter.ova +set -euo pipefail + +REPO="$(cd "$(dirname "$0")" && pwd)" + +docker run --rm \ + --device /dev/kvm \ + --group-add "$(getent group kvm | cut -d: -f3)" \ + -v "$REPO":/work -w /work \ + nixos/nix \ + bash -c ' + set -euo pipefail + git config --global --add safe.directory /work + nix build \ + --extra-experimental-features "nix-command flakes" \ + .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA \ + -o /tmp/result + cp -L /tmp/result/*.ova /work/jupiter.ova + chown '"$(id -u):$(id -g)"' /work/jupiter.ova + echo "BUILD_DONE" + ' + +echo "OVA: $REPO/jupiter.ova" diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..5e3254b --- /dev/null +++ b/flake.lock @@ -0,0 +1,27 @@ +{ + "nodes": { + "nixpkgs": { + "locked": { + "lastModified": 1783703440, + "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-26.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "nixpkgs": "nixpkgs" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/jupiter/services.nix b/jupiter/services.nix index 52a9c45..356e047 100644 --- a/jupiter/services.nix +++ b/jupiter/services.nix @@ -23,13 +23,13 @@ i18n.defaultLocale = "en_US.UTF-8"; # ---- Users ---- - users.users.erik = { + users.users.darman = { isNormalUser = true; - description = "erik"; + description = "darman"; extraGroups = [ "wheel" "networkmanager" "docker" ]; # Replace with your real public key. Password login for ssh is disabled below. openssh.authorizedKeys.keys = [ - # "ssh-ed25519 AAAA... erik@laptop" + # "ssh-ed25519 AAAA... darman@laptop" ]; }; @@ -59,10 +59,33 @@ "browseable" = "yes"; "read only" = "no"; "guest ok" = "no"; - "valid users" = "erik"; + "valid users" = "darman"; }; }; }; + + # Samba keeps its own NTLM password DB, separate from the system password. + # `services.samba` never sets it, so logins fail until provisioned. + # This runs AFTER samba-smbd so its state dir (/var/lib/samba/private) exists + # — an activation script runs too early and smbpasswd fails to init the passdb. + # The secret file must contain the password twice (new + confirm), one per line. + # VM test: vm.nix writes /etc/samba/smb-password with a throwaway value. + # Real host: supply it via sops-nix/agenix — do NOT commit plaintext. + systemd.services.samba-smbpasswd = { + description = "Provision Samba password for darman"; + after = [ "samba-smbd.service" ]; + requires = [ "samba-smbd.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + script = '' + if [ -f /etc/samba/smb-password ]; then + ${pkgs.samba}/bin/smbpasswd -a -s darman < /etc/samba/smb-password + fi + ''; + }; services.avahi = { enable = true; nssmdns4 = true; @@ -91,8 +114,15 @@ }; # ---- Reverse proxy ---- + # Caddy binds nothing unless it has a vhost. This proxies the whoami + # container so :80 actually serves. Add one block per service. + # Real host: swap `http://localhost` for your domain to get automatic HTTPS, + # e.g. `services.caddy.virtualHosts."jelly.example.com".extraConfig`. services.caddy = { enable = true; + virtualHosts."http://localhost".extraConfig = '' + reverse_proxy localhost:8080 + ''; }; # ---- System packages ---- diff --git a/jupiter/vm.nix b/jupiter/vm.nix index 581b673..c3f7844 100644 --- a/jupiter/vm.nix +++ b/jupiter/vm.nix @@ -13,10 +13,26 @@ # Allow password login for testing (real host is key-only). services.openssh.settings.PasswordAuthentication = lib.mkForce true; - # Login: erik / test (change or remove for anything but local testing). - users.users.erik.initialPassword = "test"; + # Login: darman / test (change or remove for anything but local testing). + users.users.darman.initialPassword = "test"; users.users.root.initialPassword = "test"; + # Throwaway SMB password for testing (samba-smbd login = darman / test). + # Two lines: smbpasswd wants the new password + confirmation. + # Real host must NOT do this — plaintext lands in the world-readable Nix + # store. Use sops-nix/agenix to place /etc/samba/smb-password instead. + environment.etc."samba/smb-password" = { + text = '' + test + test + ''; + mode = "0600"; + }; + # Guest additions for clipboard/resize (optional). virtualisation.virtualbox.guest.enable = true; + + # Smaller virtual disk = faster image assembly + VMDK compression. + # Size in MiB (default is ~50G). + virtualisation.diskSize = 6144; # 6 GiB total disk }