- systemd oneshot sets SMB password after samba-smbd (activation ran too early) - caddy vhost reverse_proxy to whoami so :80 actually serves - vm.nix: throwaway SMB secret for testing; real host uses sops/agenix Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>