skydick: enable LDAP-backed NSS for POSIX identity resolution ...

Add users.ldap with nslcd pointed at ldap://10.0.0.1/ for passwd/group
lookups. This is identity-only: loginPam=false keeps SSH/console auth
local, and Samba stays on tdbsam until sambaSamAccount objects exist
in LDAP.

- Add agenix secret for LDAP bind credential (cn=query_user)
- nss_initgroups_ignoreusers ALLLOCAL avoids boot-time NSS deadlock
- Add openldap package for admin ldapsearch/ldapmodify
- Update DATAPOOL.md to reflect LDAP identity model, numeric UID/GID
  in tmpfiles for LDAP-only users, and current auth boundaries

Co-Authored-By: Claude Opus 4.6 <[email protected]>

monitoring: auto-discover SMART devices instead of hardcoding ...

Remove smartDevices option and per-host device lists. Telegraf will
now scan all block devices automatically, so disks can be added or
removed without config changes.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

common: add TUNA mirror as primary Nix substituter, add btop ...

cache.nixos.org has ~1.1s latency from CN. TUNA mirror responds
in ~29ms (38x faster). Set connect-timeout=5 and
stalled-download-timeout=15 to fail fast on unreachable mirrors.

Also add btop to skydick monitoring packages.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: add Telegraf monitoring with SMART, ZFS, and system metrics ...

Sends metrics to door1 InfluxDB (bucket: skydick) via Telegraf.
Monitors all 5 Mach2 SAS drives, NVMe P4500, and boot SSD via SMART.
InfluxDB token encrypted with agenix.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: extract datapool.nix for Mach2 ZFS storage config ...

Move all storage-serving config (NFS, Samba, iSCSI, tmpfiles, firewall
ports, storage group) from default.nix into datapool.nix. Add Mach2
dual-actuator mirror layout documentation, new datasets (torrent, vm),
and clean permission model (setgid storage group for user data).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: unify ylw as common admin, keep host-specific passwords and groups ...

Move ylw base identity (isNormalUser, wheel, SSH key) to modules/users.nix
alongside ldx. Host configs retain only extra groups and hashedPassword.
Also renames ye-lw21 to ylw on skydick.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

skydick: disable IPv6 to avoid wg-outbound ULA masquerade timeout ...

IPv6 traffic from skydick goes through freedom routing on 10.0.0.1,
which masquerades with ULA fd99:23eb:1682:fe::2 (not globally routable).
This causes nix/cargo downloads to timeout on AAAA records. Skydick has
no IPv6 use cases as a LAN storage server.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Initial skyworks infrastructure flake ...

Unified NixOS configuration for skydick (storage server) and
xlab-gateway (lab router). Flat module structure with shared
common/users/ssh modules, agenix secrets, disko, and deploy-rs.

Co-Authored-By: Claude Opus 4.6 <[email protected]>