make sure DHCP start after interface initialization

skydick: switch Samba to ldapsam, rename ylw→ye-lw21, drop legacy datasets ...

- Samba passdb backend changed from tdbsam to ldapsam:ldap://10.0.0.1
- Added samba-ldap-admin-password oneshot to seed LDAP admin cred before smbd
- Pinned storage group to GID 997 to match LDAP posixGroup
- Renamed ylw to ye-lw21 across all hosts (users.nix, skydick, xlab-gateway)
- Removed legacy tmpfiles and NFS exports (share/backup/torrent/vm destroyed)
- Added bootstrap LDIF for sambaDomain, storage group, machines OU

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: equalize ldx and ylw permissions ...

- Add ylw to NOPASSWD sudo rule (matching ldx for deploy-rs)
- Add ldx hashedPassword on xlab-gateway (matching ylw)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: unify ylw as common admin, keep host-specific passwords and groups ...

Move ylw base identity (isNormalUser, wheel, SSH key) to modules/users.nix
alongside ldx. Host configs retain only extra groups and hashedPassword.
Also renames ye-lw21 to ylw on skydick.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: fix ylw user missing isNormalUser and add wheel group ...

Co-Authored-By: Claude Opus 4.6 <[email protected]>

add ylw user to xlab-gateway

xlab-gateway: add ULA route for internal IPv6 reachability ...

Route fd99:23eb:1682::/48 via wg-to-wgnet in main table so
xlab-gateway and LAN clients can reach 10.0.0.1's IPv6
(fd99:23eb:1682::1). Without this, ULA traffic went through
the WAN default route and got dropped.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

refactor xlab-gateway IPv6: /64 SLAAC, scoped policy routing, no NAT66 ...

- Change LAN prefix from fd99:23eb:1682:fd:df::/80 to fd99:23eb:1682:1::/64
- Switch from DHCPv6 stateful to SLAAC (AdvAutonomous on, AdvManagedFlag off)
- Add RDNSS in radvd pointing to fd99:23eb:1682::1
- Scope policy routing rules to LAN sources only (fixes gateway IPv6 breakage)
- Remove NAT66 masquerade on wg-to-wgnet (10.0.0.1 routes fd99:23eb:1682:1::/64 natively)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

fix nftables syntax: use meta nfproto ipv6 in inet table ...

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: route client IPv6 through wg-to-wgnet ...

- Re-add IPv6 default route (::/0) via wg-to-wgnet in table 1002
- Add NAT66 masquerade on wg-to-wgnet for client ULA→tunnel translation
- Campus WAN has no IPv6 transit; wgnet provides it

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: fix IPv6 routing, clean up table names ...

- Remove IPv6 default route from freedom table (1002) — wgnet peer
  doesn't forward IPv6, causing TLS resets on outbound connections
- Remove Tsinghua IPv6 throw route (unnecessary without IPv6 default)
- IPv6 now uses native WAN path instead of WireGuard tunnel
- Rename table 1002 from typo 'wg-to-skywme' to 'freedom-wgnet'

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: add hardware-configuration.nix, disable wait-online ...

- Import generated hardware-configuration.nix (Intel CPU microcode,
  boot modules for ehci_pci, ahci, nvme, kvm-intel)
- Disable systemd-networkd-wait-online (gateway doesn't need to block
  boot waiting for WireGuard interfaces)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add agenix-encrypted secrets and flake.lock ...

- Encrypted WireGuard keys for xlab-gateway (wgnet, skyworks, warp)
- Encrypted WireGuard PSK for wg-to-wgnet
- Placeholder skydick WireGuard secret
- Updated disko.nix with correct NVMe disk ID (MEMPEK1J016GAD)
- Generated flake.lock pinning nixpkgs 24.11, disko, agenix, deploy-rs

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Initial skyworks infrastructure flake ...

Unified NixOS configuration for skydick (storage server) and
xlab-gateway (lab router). Flat module structure with shared
common/users/ssh modules, agenix secrets, disko, and deploy-rs.

Co-Authored-By: Claude Opus 4.6 <[email protected]>