jupiter: GC on every boot, silence mdadm warning, migrate sabnzbd off reused ini

nix.gc (common.nix) is weekly, too slow to catch a switch pinning the old
generation's closure on a 29G eMMC — add a full nix-collect-garbage on every
boot instead. Also set boot.swraid.mdadmConf so eval stops warning that
mdmon will crash (dormant here: the RAID0 array uses native superblocks, so
mdmon never actually runs).

sabnzbd.configFile is deprecated by the module; move to services.sabnzbd.settings
with credentials (web login, api/nzb keys, eweka.nl server) sourced from sops via
secretValues instead of living in a plaintext ini. admin_dir/log_dir are pinned
absolute at their original /mnt/data location so the existing download
queue/history isn't reset by the ini moving to /var/lib/sabnzbd.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/jupiter/configuration.nix

@@ -41,6 +41,21 @@
   # but at ~5G free on a 29G eMMC even 5 is too many — override down to 2.
   boot.loader.systemd-boot.configurationLimit = lib.mkForce 2;
 
+  # A `switch` pins the old generation as a GC root until the box reboots onto
+  # the new one (booted-system vs current-system) — common.nix's nix.gc is
+  # weekly, far too slow to catch that on a 29G eMMC. 2026-08-19: one switch
+  # alone took 14G -> 19G used; only reboot (releases the old root) + this GC
+  # brought it back to 14G. Run a full collect right after every boot instead
+  # of waiting on the weekly timer.
+  systemd.services.gc-on-boot = {
+    description = "Full nix-collect-garbage on every boot";
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.nix}/bin/nix-collect-garbage -d";
+    };
+  };
+
   # Root lives on the ZimaBlade eMMC (mmcblk0). nixos-generate-config runs in
   # the RAM installer and does NOT detect these, so pin them here (merged with
   # hardware-configuration.nix) or stage-1 can't mount root and the box panics.
@@ -89,6 +104,10 @@
   # Mounted, NOT formatted; kept out of disko so it is never wiped.
   # ⚠️ RAID0 = no redundancy: either 16TB disk failing loses ALL data.
   boot.swraid.enable = true;  # assemble the mdadm array at boot
+  # Silences "mdmon service will crash" eval warning. RAID0 here uses native
+  # superblocks so mdmon (external-metadata arrays only) never actually runs,
+  # but the module warns unconditionally without SOME MAILADDR/PROGRAM set.
+  boot.swraid.mdadmConf = "MAILADDR root";
   fileSystems."/mnt/data" = {
     # fs UUID (stable) — the array may enumerate as /dev/md127, so avoid /dev/md0.
     device = "/dev/disk/by-uuid/dadbff6f-652e-49b2-bfed-eb1308ab8b78";

hosts/jupiter/secrets.nix

@@ -48,4 +48,20 @@
   # ci-bot access token to allow the ci-bot user to push to repos
   sops.secrets.gitea_ci_bot_token.owner = "gitea";
 
+  # SABnzbd credentials (web UI login, API keys, eweka.nl usenet server) —
+  # migrated off the reused ini in services/media/sabnzbd.nix into
+  # services.sabnzbd.settings + secretValues. sabnzbd_api_key predates this
+  # migration (provisioned for mediamanager's future use, services/experimental/
+  # mediamanager.nix — not currently imported by any host); reused here as the
+  # same single source of truth rather than duplicating it.
+  # owner = sabnzbd: the module's preStart (replace-secret) runs as the
+  # service's own User=/Group=, and sops secrets default to root:root 0400 —
+  # without this, replace-secret gets Permission denied reading /run/secrets.
+  sops.secrets.sabnzbd_web_username.owner = "sabnzbd";
+  sops.secrets.sabnzbd_web_password.owner = "sabnzbd";
+  sops.secrets.sabnzbd_api_key.owner = "sabnzbd";
+  sops.secrets.sabnzbd_nzb_key.owner = "sabnzbd";
+  sops.secrets.sabnzbd_eweka_username.owner = "sabnzbd";
+  sops.secrets.sabnzbd_eweka_password.owner = "sabnzbd";
+
 }