skydick: keep SMB passwords synced from LDAP

skydick: switch Samba to ldapsam, rename ylw→ye-lw21, drop legacy datasets ...

- Samba passdb backend changed from tdbsam to ldapsam:ldap://10.0.0.1
- Added samba-ldap-admin-password oneshot to seed LDAP admin cred before smbd
- Pinned storage group to GID 997 to match LDAP posixGroup
- Renamed ylw to ye-lw21 across all hosts (users.nix, skydick, xlab-gateway)
- Removed legacy tmpfiles and NFS exports (share/backup/torrent/vm destroyed)
- Added bootstrap LDIF for sambaDomain, storage group, machines OU

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: update DATAPOOL.md for ldapsam, ye-lw21 rename, and storage group model ...

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: enable LDAP-backed NSS for POSIX identity resolution ...

Add users.ldap with nslcd pointed at ldap://10.0.0.1/ for passwd/group
lookups. This is identity-only: loginPam=false keeps SSH/console auth
local, and Samba stays on tdbsam until sambaSamAccount objects exist
in LDAP.

- Add agenix secret for LDAP bind credential (cn=query_user)
- nss_initgroups_ignoreusers ALLLOCAL avoids boot-time NSS deadlock
- Add openldap package for admin ldapsearch/ldapmodify
- Update DATAPOOL.md to reflect LDAP identity model, numeric UID/GID
  in tmpfiles for LDAP-only users, and current auth boundaries

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: redesign datapool with per-user datasets and service model ...

Replace flat purpose-first layout (share/media/torrent/backup/vm) with
user-first hierarchy:

- dick/public: shared collaborative files
- dick/media: shared media with data/ + library/ in one hardlink domain
- dick/users/<user>/{files,bt-state,vm}: per-user private trees with
  ZFS quotas, per-user NFS all_squash, and Samba [homes]
- dick/system/{backup,vm}: admin-only system datasets
- dick/templates/vm: read-only shared VM base images

NFS exports split media into rw writer (all_squash to qbittorrent) and
ro reader (/media/library).  Per-user exports use explicit anonuid/gid.
Samba uses [public] for shared, [homes] for per-user, [media] ro for
library.  Legacy exports preserved for active migration.

Add DATAPOOL.md with user/admin guide covering SMB/NFS connection,
new-user provisioning, quotas, and troubleshooting.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

monitoring: auto-discover SMART devices instead of hardcoding ...

Remove smartDevices option and per-host device lists. Telegraf will
now scan all block devices automatically, so disks can be added or
removed without config changes.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: increase NFS server threads to 64 ...

Default 8 threads is insufficient for 10GbE throughput.
64 threads allow better parallelism for concurrent NFS clients.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

common: add TUNA mirror as primary Nix substituter, add btop ...

cache.nixos.org has ~1.1s latency from CN. TUNA mirror responds
in ~29ms (38x faster). Set connect-timeout=5 and
stalled-download-timeout=15 to fail fast on unreachable mirrors.

Also add btop to skydick monitoring packages.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: use all_squash for media/torrent NFS exports ...

Map all NFS client UIDs to qbittorrent:storage (900:997) on
media and torrent exports. Eliminates need for UID/GID
coordination between NFS clients and server.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: fix qbittorrent UID collision with ylw ...

UID 1002 was already assigned to ylw on skydick. Change qbittorrent
system user to UID 900 to avoid the collision. NFS sec=sys maps by
UID number, so this must not conflict with any normal user.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: add qbittorrent user and make media NFS export writable ...

Add qbittorrent system user (UID 1002, group storage) for NFS
root_squash write access. Change /srv/media export from ro,async
to rw,sync to support *arr torrent downloads under /srv/media/torrents/.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: add Telegraf monitoring with SMART, ZFS, and system metrics ...

Sends metrics to door1 InfluxDB (bucket: skydick) via Telegraf.
Monitors all 5 Mach2 SAS drives, NVMe P4500, and boot SSD via SMART.
InfluxDB token encrypted with agenix.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: add NVMe SLOG+L2ARC documentation for datapool ...

Intel DC P4600 750GB: 8GB SLOG partition for sync write acceleration,
remaining ~690GB as L2ARC read cache for VM working sets.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: fill in actual Mach2 WWNs for datapool creation ...

5x ST14000NM0001 14TB SAS Mach2 drives, 4 active + 1 spare.
Mirror vdevs pair LUN0/LUN1 from different physical drives.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: extract datapool.nix for Mach2 ZFS storage config ...

Move all storage-serving config (NFS, Samba, iSCSI, tmpfiles, firewall
ports, storage group) from default.nix into datapool.nix. Add Mach2
dual-actuator mirror layout documentation, new datasets (torrent, vm),
and clean permission model (setgid storage group for user data).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: unify ylw as common admin, keep host-specific passwords and groups ...

Move ylw base identity (isNormalUser, wheel, SSH key) to modules/users.nix
alongside ldx. Host configs retain only extra groups and hashedPassword.
Also renames ye-lw21 to ylw on skydick.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: disable IPv6 to avoid wg-outbound ULA masquerade timeout ...

IPv6 traffic from skydick goes through freedom routing on 10.0.0.1,
which masquerades with ULA fd99:23eb:1682:fe::2 (not globally routable).
This causes nix/cargo downloads to timeout on AAAA records. Skydick has
no IPv6 use cases as a LAN storage server.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Initial skyworks infrastructure flake ...

Unified NixOS configuration for skydick (storage server) and
xlab-gateway (lab router). Flat module structure with shared
common/users/ssh modules, agenix secrets, disko, and deploy-rs.

Co-Authored-By: Claude Opus 4.6 <[email protected]>