darmanandClaude Sonnet 5
6f24ab69ad
Comments had drifted into multi-paragraph narrative (git commit lineage, debugging stories, restated code) in several hot spots (scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix). Trim every comment to its load-bearing "why" — gotchas, safety warnings, and non-obvious rationale survive verbatim in substance, just tightened to 1-2 sentences; historical narrative and anything already covered in CLAUDE.md is cut. No code/logic changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
53 lines
1.6 KiB
Nix
53 lines
1.6 KiB
Nix
{ pkgs, ... }:
|
|
|
|
# Samba file server for the /mnt/data share + password provisioning.
|
|
# Import on any host that should serve the NAS.
|
|
{
|
|
services.samba = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
settings = {
|
|
global = {
|
|
"workgroup" = "WORKGROUP";
|
|
"server string" = "jupiter";
|
|
"security" = "user";
|
|
};
|
|
data = {
|
|
"path" = "/mnt/data";
|
|
"browseable" = "yes";
|
|
"read only" = "no";
|
|
"guest ok" = "no";
|
|
"valid users" = "darman";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Samba keeps its own NTLM password DB, separate from the system password —
|
|
# `services.samba` never sets it, and this runs as a service (not an
|
|
# activation script, which fires too early for smbpasswd's passdb) after
|
|
# samba-smbd. Reads a single-line password from the first existing file,
|
|
# feeding it twice since smbpasswd prompts new+confirm:
|
|
# Real host: /run/secrets/samba_password (sops-nix, see secrets.nix)
|
|
# VM test: /etc/samba/smb-password (plaintext, see vm.nix)
|
|
systemd.services.samba-smbpasswd = {
|
|
description = "Provision Samba password for darman";
|
|
after = [ "samba-smbd.service" ];
|
|
requires = [ "samba-smbd.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
for f in /run/secrets/samba_password /etc/samba/smb-password; do
|
|
if [ -f "$f" ]; then
|
|
pw=$(head -n1 "$f")
|
|
printf '%s\n%s\n' "$pw" "$pw" | ${pkgs.samba}/bin/smbpasswd -a -s darman
|
|
exit 0
|
|
fi
|
|
done
|
|
echo "no samba password source found" >&2
|
|
'';
|
|
};
|
|
}
|