feat: sops-nix for samba password secret

- add sops-nix input + module (jupiter only, not the VM)
- secrets/jupiter.yaml: age-encrypted samba_password (safe to commit)
- .sops.yaml: encryption rule for admin age key
- secrets.nix: decrypt samba_password to /run/secrets on the host
- provisioning oneshot reads sops secret (host) or plaintext (VM), single value
- .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jupiter/services.nix

@@ -68,9 +68,10 @@
   # `services.samba` never sets it, so logins fail until provisioned.
   # This runs AFTER samba-smbd so its state dir (/var/lib/samba/private) exists
   # — an activation script runs too early and smbpasswd fails to init the passdb.
-  # The secret file must contain the password twice (new + confirm), one per line.
-  #   VM test:   vm.nix writes /etc/samba/smb-password with a throwaway value.
-  #   Real host: supply it via sops-nix/agenix — do NOT commit plaintext.
+  # Reads a single-line password from the first file that exists:
+  #   Real host: /run/secrets/samba_password  (sops-nix, see secrets.nix)
+  #   VM test:   /etc/samba/smb-password       (plaintext, see vm.nix)
+  # smbpasswd prompts new + confirm, so the value is fed twice.
   systemd.services.samba-smbpasswd = {
     description = "Provision Samba password for darman";
     after = [ "samba-smbd.service" ];
@@ -81,9 +82,14 @@
       RemainAfterExit = true;
     };
     script = ''
-      if [ -f /etc/samba/smb-password ]; then
-        ${pkgs.samba}/bin/smbpasswd -a -s darman < /etc/samba/smb-password
-      fi
+      for f in /run/secrets/samba_password /etc/samba/smb-password; do
+        if [ -f "$f" ]; then
+          pw=$(head -n1 "$f")
+          printf '%s\n%s\n' "$pw" "$pw" | ${pkgs.samba}/bin/smbpasswd -a -s darman
+          exit 0
+        fi
+      done
+      echo "no samba password source found" >&2
     '';
   };
   services.avahi = {