Automount samba shares

common/default.nix

@@ -57,6 +57,7 @@
     shell = pkgs.fish;
     openssh.authorizedKeys.keys = (import ./ssh.nix).users;
     hashedPassword = "$6$TuDO46rILr$gkPUuLKZe3psexhs8WFZMpzgEBGksE.c3Tjh1f8sD0KMC4oV89K2pqAABfl.Lpxu2jVdr5bgvR5cWnZRnji/r/";
+    uid = 1000;
   };
   nix.trustedUsers = [ "root" "googlebot" ];
 

common/hosts.nix

@@ -3,6 +3,11 @@
 let
   system = (import ./ssh.nix).system;
 in {
+  networking.hosts = {
+    # some DNS providers filter local ip results from DNS request
+    "172.30.145.180" = [ "s0.zt.neet.dev" ];
+  };
+
   programs.ssh.knownHosts = {
     liza = {
       hostNames = [ "liza" "liza.neet.dev" ];

common/pc/default.nix

@@ -17,6 +17,7 @@ in {
     ./discord.nix
     ./steam.nix
     ./touchpad.nix
+    ./mount-samba.nix
   ];
 
   options.de = {

common/pc/mount-samba.nix

@@ -0,0 +1,36 @@
+# mounts the samba share on s0 over zeroteir
+
+{ config, lib, ... }:
+
+let
+  cfg = config.services.mount-samba;
+
+  # prevents hanging on network split
+  network_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+
+  user_opts = "uid=${toString config.users.users.googlebot.uid},file_mode=0660,dir_mode=0770,user";
+  auth_opts = "credentials=/run/agenix/smb-secrets";
+  version_opts = "vers=2.1";
+
+  opts = "${network_opts},${user_opts},${version_opts}";
+in {
+  options.services.mount-samba = {
+    enable = lib.mkEnableOption "enable mounting samba shares";
+  };
+
+  config = lib.mkIf (cfg.enable && config.services.zerotierone.enable) {
+    fileSystems."/mnt/public" = {
+        device = "//s0.zt.neet.dev/public";
+        fsType = "cifs";
+        options = ["guest,${opts}"];
+    };
+
+    fileSystems."/mnt/private" = {
+        device = "//s0.zt.neet.dev/googlebot";
+        fsType = "cifs";
+        options = ["${auth_opts},${opts}"];
+    };
+
+    age.secrets.smb-secrets.file = ../../secrets/smb-secrets.age;
+  };
+}

machines/ray/configuration.nix

@@ -49,6 +49,8 @@
 
   services.zerotierone.enable = true;
 
+  services.mount-samba.enable = true;
+
   de.enable = true;
   de.touchpad.enable = true;
 }

secrets/secrets.nix

@@ -17,4 +17,5 @@ in
   "spotifyd.age".publicKeys = all;
   "wolframalpha.age".publicKeys = all;
   "cloudflared-navidrome.json.age".publicKeys = all;
+  "smb-secrets.age".publicKeys = all;
 }