feat: samba password provisioning + caddy reverse proxy; rename user to darman

- systemd oneshot sets SMB password after samba-smbd (activation ran too early)
- caddy vhost reverse_proxy to whoami so :80 actually serves
- vm.nix: throwaway SMB secret for testing; real host uses sops/agenix

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -1,3 +1,6 @@
 result
 result-*
 .direnv/
+
+# built artifacts
+*.ova

build-ova.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Build the VirtualBox OVA inside a throwaway nixos/nix container.
+# No nix needed on the host. Output: ./jupiter.ova
+set -euo pipefail
+
+REPO="$(cd "$(dirname "$0")" && pwd)"
+
+docker run --rm \
+  --device /dev/kvm \
+  --group-add "$(getent group kvm | cut -d: -f3)" \
+  -v "$REPO":/work -w /work \
+  nixos/nix \
+  bash -c '
+    set -euo pipefail
+    git config --global --add safe.directory /work
+    nix build \
+      --extra-experimental-features "nix-command flakes" \
+      .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA \
+      -o /tmp/result
+    cp -L /tmp/result/*.ova /work/jupiter.ova
+    chown '"$(id -u):$(id -g)"' /work/jupiter.ova
+    echo "BUILD_DONE"
+  '
+
+echo "OVA: $REPO/jupiter.ova"

flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1783703440,
+        "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

jupiter/services.nix

@@ -23,13 +23,13 @@
   i18n.defaultLocale = "en_US.UTF-8";
 
   # ---- Users ----
-  users.users.erik = {
+  users.users.darman = {
     isNormalUser = true;
-    description = "erik";
+    description = "darman";
     extraGroups = [ "wheel" "networkmanager" "docker" ];
     # Replace with your real public key. Password login for ssh is disabled below.
     openssh.authorizedKeys.keys = [
-      # "ssh-ed25519 AAAA... erik@laptop"
+      # "ssh-ed25519 AAAA... darman@laptop"
     ];
   };
 
@@ -59,10 +59,33 @@
         "browseable" = "yes";
         "read only" = "no";
         "guest ok" = "no";
-        "valid users" = "erik";
+        "valid users" = "darman";
       };
     };
   };
+
+  # Samba keeps its own NTLM password DB, separate from the system password.
+  # `services.samba` never sets it, so logins fail until provisioned.
+  # This runs AFTER samba-smbd so its state dir (/var/lib/samba/private) exists
+  # — an activation script runs too early and smbpasswd fails to init the passdb.
+  # The secret file must contain the password twice (new + confirm), one per line.
+  #   VM test:   vm.nix writes /etc/samba/smb-password with a throwaway value.
+  #   Real host: supply it via sops-nix/agenix — do NOT commit plaintext.
+  systemd.services.samba-smbpasswd = {
+    description = "Provision Samba password for darman";
+    after = [ "samba-smbd.service" ];
+    requires = [ "samba-smbd.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      if [ -f /etc/samba/smb-password ]; then
+        ${pkgs.samba}/bin/smbpasswd -a -s darman < /etc/samba/smb-password
+      fi
+    '';
+  };
   services.avahi = {
     enable = true;
     nssmdns4 = true;
@@ -91,8 +114,15 @@
   };
 
   # ---- Reverse proxy ----
+  # Caddy binds nothing unless it has a vhost. This proxies the whoami
+  # container so :80 actually serves. Add one block per service.
+  # Real host: swap `http://localhost` for your domain to get automatic HTTPS,
+  # e.g. `services.caddy.virtualHosts."jelly.example.com".extraConfig`.
   services.caddy = {
     enable = true;
+    virtualHosts."http://localhost".extraConfig = ''
+      reverse_proxy localhost:8080
+    '';
   };
 
   # ---- System packages ----

jupiter/vm.nix

@@ -13,10 +13,26 @@
   # Allow password login for testing (real host is key-only).
   services.openssh.settings.PasswordAuthentication = lib.mkForce true;
 
-  # Login: erik / test  (change or remove for anything but local testing).
+  # Login: darman / test  (change or remove for anything but local testing).
-  users.users.erik.initialPassword = "test";
+  users.users.darman.initialPassword = "test";
   users.users.root.initialPassword = "test";
 
+  # Throwaway SMB password for testing (samba-smbd login = darman / test).
+  # Two lines: smbpasswd wants the new password + confirmation.
+  # Real host must NOT do this — plaintext lands in the world-readable Nix
+  # store. Use sops-nix/agenix to place /etc/samba/smb-password instead.
+  environment.etc."samba/smb-password" = {
+    text = ''
+      test
+      test
+    '';
+    mode = "0600";
+  };
+
   # Guest additions for clipboard/resize (optional).
   virtualisation.virtualbox.guest.enable = true;
+
+  # Smaller virtual disk = faster image assembly + VMDK compression.
+  # Size in MiB (default is ~50G).
+  virtualisation.diskSize = 6144;      # 6 GiB total disk
 }