infra-nix/README.md

# infra-nix: NixOS Infrastructure

Dieses Repository enthält die deklarative NixOS-Infrastruktur für:
- **fileserver**: SMB, FileBrowser, rclone-Backup, DJ-Beets Musik-Library
- **gateway**: AdGuardHome (DNS), Caddy (Reverse Proxy)

## Quick Deploy

```bash
# Alle Systeme deployen
make deploy

# Nur fileserver deployen
make deploy-fileserver

# Nur gateway deployen
make deploy-gateway
```

---

## DJ-Beets Projekt (`src/dj-beets/`)

Dein eigenes Projekt als Beets-Ersatz. Wird beim Deploy auf `/opt/dj-beets` kopiert.

**Details siehe:** [src/dj-beets/README.md](src/dj-beets/README.md)

**Workflow:**
1. Lokal in `src/dj-beets/` entwickeln
2. `make deploy-fileserver` → deployed auf Server
3. Auto-Import läuft alle 10 Minuten via Timer

---

## Fileserver: rclone + SMB Quickstart

This guide covers setting up rclone (Google Drive) and setting the SMB password for user `danlin`.

---

## rclone (Google Drive)

The system has `rclone` installed and a systemd job to sync `/data` to a remote named `gdrive`:

- Service: `rclone-backup.service` (oneshot)
- Timer: `rclone-backup.timer` (runs daily 03:00)
- Log: `/var/log/rclone-backup.log`

### 1) Create the remote `gdrive`
Run on the fileserver:

```bash
sudo -i
rclone config
```

Then:
- n) New remote
- name: `gdrive`
- storage: `drive` (Google Drive)
- Use auto config? For headless server choose "No"
  - Follow the printed instructions using another machine, or run on a desktop and copy the token
- Keep defaults unless you need a service account
- y) Yes to save

Verify:
```bash
rclone lsd gdrive:
rclone mkdir gdrive:backup-daten
```

### 2) Test backup manually
```bash
sudo systemctl start rclone-backup.service
sudo journalctl -u rclone-backup -e
sudo tail -n 100 /var/log/rclone-backup.log
```

### 3) Check/enable timer
```bash
systemctl list-timers '*rclone*'
sudo systemctl enable --now rclone-backup.timer
```

---

## SMB password for `danlin`

The share configuration:
- Protected share: `daten` → requires user `danlin`
- Guest share: `daten-share` → guest access allowed

Set the Samba password for `danlin` (independent from system login password):

```bash
sudo smbpasswd -a danlin
```

Useful commands:
```bash
sudo pdbedit -L                   # list Samba users
sudo systemctl status samba
sudo journalctl -u samba -e
```

Access examples:
- Windows: `\\fileserver\daten` or `\\fileserver\daten-share`
- macOS Finder: Go → Connect to Server → `smb://fileserver/daten` or `smb://fileserver/daten-share`

---

## Troubleshooting
- rclone auth on headless: use `rclone authorize 'drive'` on a desktop and paste token
- Permissions: ensure `/data/daten` and `/data/daten/share` exist and are writable (`systemd-tmpfiles` creates them)
- Firewall: SMB ports 139/445 are open by module config

---

rclone (Google Drive)

The system has rclone installed and a systemd job to sync /data to a remote named gdrive:

• Service: rclone-backup.service (oneshot)
• Timer: rclone-backup.timer (runs daily 03:00)
• Log: /var/log/rclone-backup.log

1) Create the remote gdrive

Run on the fileserver:

sudo -i
rclone config

Then:

• n) New remote
• name: gdrive
• storage: drive (Google Drive)
• Use auto config? For headless server choose "No"
  • Follow the printed instructions using another machine, or run on a desktop and copy the token
• Keep defaults unless you need a service account
• y) Yes to save

Verify:

rclone lsd gdrive:
rclone mkdir gdrive:backup-daten

2) Test backup manually

sudo systemctl start rclone-backup.service
sudo journalctl -u rclone-backup -e
sudo tail -n 100 /var/log/rclone-backup.log

3) Check/enable timer

systemctl list-timers '*rclone*'
sudo systemctl enable --now rclone-backup.timer

---

SMB password for danlin

The share configuration:

• Protected share: daten → requires user danlin
• Guest share: daten-share → guest access allowed

Set the Samba password for danlin (independent from system login password):

sudo smbpasswd -a danlin

Useful commands:

sudo pdbedit -L                   # list Samba users
sudo systemctl status samba
sudo journalctl -u samba -e

Access examples:

• Windows: \\fileserver\daten or \\fileserver\daten-share
• macOS Finder: Go → Connect to Server → smb://fileserver/daten or smb://fileserver/daten-share

---

Troubleshooting

• rclone auth on headless: use rclone authorize 'drive' on a desktop and paste token
• Permissions: ensure /data/daten and /data/daten/share exist and are writable (systemd-tmpfiles creates them)
• Firewall: SMB ports 139/445 are open by module config