Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity, dev, desktop) to make the growing services/ dir easier to navigate. containers.nix stays at the top level since it's a shared backend, not a single-category service. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-20 06:08:43 +02:00
parent 4679afa505
commit d7a66f3e3b
27 changed files with 41 additions and 38 deletions
@@ -0,0 +1,53 @@
+{ pkgs, ... }:
+
+# Samba file server for the /mnt/data share + password provisioning.
+# Import on any host that should serve the NAS.
+{
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        "workgroup" = "WORKGROUP";
+        "server string" = "jupiter";
+        "security" = "user";
+      };
+      data = {
+        "path" = "/mnt/data";
+        "browseable" = "yes";
+        "read only" = "no";
+        "guest ok" = "no";
+        "valid users" = "darman";
+      };
+    };
+  };
+
+  # Samba keeps its own NTLM password DB, separate from the system password;
+  # `services.samba` never sets it, so logins fail until provisioned. Runs
+  # AFTER samba-smbd so its state dir exists — an activation script runs too
+  # early and smbpasswd fails to init the passdb. Reads a single-line
+  # password from the first file that exists:
+  #   Real host: /run/secrets/samba_password  (sops-nix, see secrets.nix)
+  #   VM test:   /etc/samba/smb-password       (plaintext, see vm.nix)
+  # smbpasswd prompts new + confirm, so the value is fed twice.
+  systemd.services.samba-smbpasswd = {
+    description = "Provision Samba password for darman";
+    after = [ "samba-smbd.service" ];
+    requires = [ "samba-smbd.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      for f in /run/secrets/samba_password /etc/samba/smb-password; do
+        if [ -f "$f" ]; then
+          pw=$(head -n1 "$f")
+          printf '%s\n%s\n' "$pw" "$pw" | ${pkgs.samba}/bin/smbpasswd -a -s darman
+          exit 0
+        fi
+      done
+      echo "no samba password source found" >&2
+    '';
+  };
+}