feat: samba password provisioning + caddy reverse proxy; rename user to darman

- systemd oneshot sets SMB password after samba-smbd (activation ran too early)
- caddy vhost reverse_proxy to whoami so :80 actually serves
- vm.nix: throwaway SMB secret for testing; real host uses sops/agenix

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jupiter/services.nix

@@ -23,13 +23,13 @@
   i18n.defaultLocale = "en_US.UTF-8";
 
   # ---- Users ----
-  users.users.erik = {
+  users.users.darman = {
     isNormalUser = true;
-    description = "erik";
+    description = "darman";
     extraGroups = [ "wheel" "networkmanager" "docker" ];
     # Replace with your real public key. Password login for ssh is disabled below.
     openssh.authorizedKeys.keys = [
-      # "ssh-ed25519 AAAA... erik@laptop"
+      # "ssh-ed25519 AAAA... darman@laptop"
     ];
   };
 
@@ -59,10 +59,33 @@
         "browseable" = "yes";
         "read only" = "no";
         "guest ok" = "no";
-        "valid users" = "erik";
+        "valid users" = "darman";
       };
     };
   };
+
+  # Samba keeps its own NTLM password DB, separate from the system password.
+  # `services.samba` never sets it, so logins fail until provisioned.
+  # This runs AFTER samba-smbd so its state dir (/var/lib/samba/private) exists
+  # — an activation script runs too early and smbpasswd fails to init the passdb.
+  # The secret file must contain the password twice (new + confirm), one per line.
+  #   VM test:   vm.nix writes /etc/samba/smb-password with a throwaway value.
+  #   Real host: supply it via sops-nix/agenix — do NOT commit plaintext.
+  systemd.services.samba-smbpasswd = {
+    description = "Provision Samba password for darman";
+    after = [ "samba-smbd.service" ];
+    requires = [ "samba-smbd.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      if [ -f /etc/samba/smb-password ]; then
+        ${pkgs.samba}/bin/smbpasswd -a -s darman < /etc/samba/smb-password
+      fi
+    '';
+  };
   services.avahi = {
     enable = true;
     nssmdns4 = true;
@@ -91,8 +114,15 @@
   };
 
   # ---- Reverse proxy ----
+  # Caddy binds nothing unless it has a vhost. This proxies the whoami
+  # container so :80 actually serves. Add one block per service.
+  # Real host: swap `http://localhost` for your domain to get automatic HTTPS,
+  # e.g. `services.caddy.virtualHosts."jelly.example.com".extraConfig`.
   services.caddy = {
     enable = true;
+    virtualHosts."http://localhost".extraConfig = ''
+      reverse_proxy localhost:8080
+    '';
   };
 
   # ---- System packages ----

jupiter/vm.nix

@@ -13,10 +13,26 @@
   # Allow password login for testing (real host is key-only).
   services.openssh.settings.PasswordAuthentication = lib.mkForce true;
 
-  # Login: erik / test  (change or remove for anything but local testing).
-  users.users.erik.initialPassword = "test";
+  # Login: darman / test  (change or remove for anything but local testing).
+  users.users.darman.initialPassword = "test";
   users.users.root.initialPassword = "test";
 
+  # Throwaway SMB password for testing (samba-smbd login = darman / test).
+  # Two lines: smbpasswd wants the new password + confirmation.
+  # Real host must NOT do this — plaintext lands in the world-readable Nix
+  # store. Use sops-nix/agenix to place /etc/samba/smb-password instead.
+  environment.etc."samba/smb-password" = {
+    text = ''
+      test
+      test
+    '';
+    mode = "0600";
+  };
+
   # Guest additions for clipboard/resize (optional).
   virtualisation.virtualbox.guest.enable = true;
+
+  # Smaller virtual disk = faster image assembly + VMDK compression.
+  # Size in MiB (default is ~50G).
+  virtualisation.diskSize = 6144;      # 6 GiB total disk
 }