feat: disko OS-disk layout + nixos-anywhere install flow

- add disko input; jupiter partitions/formats OS disk declaratively
- hardware-configuration.nix carries kernel modules only (disko owns fileSystems)
- data disk stays a plain unformatted mount, out of disko
- vbox unchanged (virtualbox-image supplies its own disk)
- README: nixos-anywhere remote install + daily rebuild loop

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -5,46 +5,78 @@ Flake-based NixOS config. Host: `jupiter` (ZimaBlade, NAS + services).
 ## Structure
 
 ```
-flake.nix                        # inputs + nixosConfigurations.jupiter
-jupiter/configuration.nix        # system, users, ssh, samba, containers, caddy
-jupiter/hardware-configuration.nix  # PLACEHOLDER — regenerate on real machine
+flake.nix                           # inputs (nixpkgs, disko) + nixosConfigurations
+jupiter/configuration.nix           # real host: imports + bootloader + data mount
+jupiter/disk-config.nix             # disko: OS-disk partitions + filesystems
+jupiter/hardware-configuration.nix  # PLACEHOLDER — kernel modules, regenerate on target
+jupiter/services.nix                # shared: users, ssh, samba, containers, caddy
+jupiter/vm.nix                      # VirtualBox test image (jupiter-vbox)
 ```
 
-## First install (on the ZimaBlade)
+Two configs from one service definition: `jupiter` (real host, disko-partitioned)
+and `jupiter-vbox` (test OVA). Both import `services.nix`.
 
-1. Boot NixOS minimal ISO, partition + mount disks at `/mnt`.
-2. Generate hardware config:
-   ```
-   sudo nixos-generate-config --root /mnt
-   ```
-   Copy `/mnt/etc/nixos/hardware-configuration.nix` into `jupiter/`.
-3. Add your SSH public key to `users.users.erik.openssh.authorizedKeys.keys`.
-4. Install:
-   ```
-   sudo nixos-install --flake .#jupiter
-   ```
-
-## Rebuild after changes
+## Test in VirtualBox (no hardware needed)
 
 ```
-sudo nixos-rebuild switch --flake .#jupiter
+nix build .#nixosConfigurations.jupiter-vbox.config.system.build.virtualBoxOVA
+VBoxManage import result/*.ova --vsys 0 --vmname jupiter-vbox
+VBoxManage startvm jupiter-vbox --type headless
 ```
+Login `darman` / `test`. Forward ports with `VBoxManage modifyvm ... --natpf1`.
+
+## First install on the ZimaBlade — nixos-anywhere + disko
+
+Wipes the OS disk and installs the flake over SSH. No USB needed if the box
+already runs Linux (ZimaOS) reachable by root SSH — nixos-anywhere kexecs into
+an installer, partitions via disko, installs.
+
+> ⚠️  The OS disk in `disk-config.nix` is WIPED. Set `device` to the OS disk
+> ONLY (by-id). Back up / physically identify the NAS data disk first — it must
+> NOT appear in disko. `lsblk -o NAME,SERIAL,SIZE,MODEL` to identify.
+
+1. Set the real OS disk id in `jupiter/disk-config.nix`
+   (`ls -l /dev/disk/by-id`), and the data-disk mount in `configuration.nix`.
+2. Add your SSH pubkey to `users.users.darman.openssh.authorizedKeys.keys`.
+3. Wire the samba secret (see Notes) — real password, not the VM's plaintext.
+4. Run from your laptop:
+   ```
+   nix run github:nix-community/nixos-anywhere -- \
+     --flake .#jupiter \
+     --generate-hardware-config nixos-generate-config ./jupiter/hardware-configuration.nix \
+     --target-host root@<zimablade-ip>
+   ```
+   `--generate-hardware-config` pulls the target's real kernel modules into the
+   placeholder for you. Commit the result. Reboot into NixOS.
+
+Manual alternative (USB ISO): boot installer, `disko` the disk, then
+`nixos-install --flake .#jupiter`.
+
+## Rebuild after changes (the daily loop)
 
-Remote from laptop:
 ```
+# from laptop, build + activate on jupiter over SSH:
 nixos-rebuild switch --flake .#jupiter \
-  --target-host erik@jupiter --use-remote-sudo
+  --target-host darman@jupiter --use-remote-sudo
 ```
+Rollback: `nixos-rebuild switch --rollback`, or pick a prior generation at boot.
 
 ## Adding a service
 
 Copy the `whoami` block in `oci-containers.containers`, swap image/ports/volumes.
 Native NixOS module exists for many apps (Nextcloud, Jellyfin, Grafana...) —
-prefer `services.<app>` over a container when available.
+prefer `services.<app>` over a container when available. Add a `caddy`
+`virtualHosts` block to expose it.
 
 ## Notes
 
 - Backend is Podman with `dockerCompat` — `docker` CLI works, no daemon.
-- Set correct `time.timeZone` and Samba `path` for your data mount.
+- Samba keeps its own password DB. `services.samba` never sets it; a systemd
+  oneshot (`samba-smbpasswd`) provisions it from `/etc/samba/smb-password`.
+  Real host: supply that file via **sops-nix / agenix**, never commit plaintext.
+- Data disk: plain `fileSystems."/mnt/data"` in configuration.nix — kept out of
+  disko so it is never formatted. Reference by `by-id` / `by-uuid`.
 - `system.stateVersion` = `26.05`, install-time schema. Do NOT bump on upgrades.
+- Terraform is not used: a single bare-metal box has no provider API. disko +
+  nixos-anywhere cover provisioning natively.
 ```