From 125edddec7e52189c4039ef925efe0d89ad4d605 Mon Sep 17 00:00:00 2001
From: Scott Scoble <sscoble@scobleclaw.dev>
Date: Sat, 16 May 2026 23:26:43 -0700
Subject: [PATCH] Add TrueNAS SMB mount (LAN + Tailscale fallback), SSH server,
 fix mountpoint dep

---
 modules/laptop.nix | 86 +++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 73 insertions(+), 13 deletions(-)

diff --git a/modules/laptop.nix b/modules/laptop.nix
index 281745f..fc43afc 100644
--- a/modules/laptop.nix
+++ b/modules/laptop.nix
@@ -5,7 +5,6 @@
 
   # === System Packages ===
   environment.systemPackages = with pkgs; [
-    papirus-icon-theme
     # Core development tools
     qmd
     nodejs
@@ -29,14 +28,76 @@
     # SSH essentials
     openssh
     mosh
-    networkmanager
+
+    # SMB/CIFS mount support
+    cifs-utils
+    mount-truenas-shared
   ];
 
-  # === Networking ===
-  networking.networkmanager.enable = true;
-  networking.networkmanager.insertNameservers = [ "1.1.1.1" "8.8.8.8" ];
+  # === Network Shares ===
+  # TrueNAS "Shared" volume — tries LAN IP first, falls back to Tailscale
+  # Credentials stored at /etc/nixos/smb-credentials (NOT in repo)
+  systemd.tmpfiles.rules = [
+    "d /mnt/shared 0755 root root -"
+  ];
 
-  # === Wallpaper ===
+  systemd.services.mount-truenas-shared = {
+    description = "Mount TrueNAS Shared SMB volume";
+    after = [ "network-online.target" "tailscaled.service" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${pkgs.mount-truenas-shared}/bin/mount-truenas-shared";
+      ExecStop = "${pkgs.mount-truenas-shared}/bin/mount-truenas-shared umount";
+    };
+  };
+
+  nixpkgs.overlays = [
+    (final: prev: {
+      mount-truenas-shared = prev.writeShellScriptBin "mount-truenas-shared" ''
+        set -o pipefail
+
+        SHARE="Shared"
+        MOUNTPOINT="/mnt/shared"
+        CREDENTIALS="/etc/nixos/smb-credentials"
+        MOUNT_OPTS="credentials=$CREDENTIALS,vers=3.0,uid=1000,gid=100,nodfs,noperm,iocharset=utf8,file_mode=0644,dir_mode=0755"
+
+        LAN_IP="192.168.168.93"
+        TAILSCALE_IP="100.70.3.101"
+
+        # Already mounted?
+        if grep -qs "$MOUNTPOINT" /proc/mounts; then
+          exit 0
+        fi
+
+        # Find a reachable NAS
+        SERVER=""
+        timeout 2 bash -c "</dev/tcp/$LAN_IP/445" 2>/dev/null && SERVER="$LAN_IP"
+        if [ -z "$SERVER" ]; then
+          timeout 2 bash -c "</dev/tcp/$TAILSCALE_IP/445" 2>/dev/null && SERVER="$TAILSCALE_IP"
+        fi
+
+        CMD="''${1:-mount}"
+        case "$CMD" in
+          mount)
+            if [ -z "$SERVER" ]; then
+              echo "No NAS reachable (tried $LAN_IP and $TAILSCALE_IP) — mount deferred"
+              exit 0
+            fi
+            echo "Mounting $SHARE from $SERVER..."
+            mount -t cifs "//$SERVER/$SHARE" "$MOUNTPOINT" -o "$MOUNT_OPTS"
+            ;;
+          umount)
+            if grep -qs "$MOUNTPOINT" /proc/mounts; then
+              umount "$MOUNTPOINT"
+            fi
+            ;;
+        esac
+      '';
+    })
+  ];
 
   # === Shell ===
   programs.zsh = {
@@ -63,12 +124,6 @@
   users.defaultUserShell = pkgs.zsh;
 
   # === SSH ===
-  # === SSH Server ===
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-  };
-
   programs.ssh = {
     startAgent = true;
     extraConfig = ''
@@ -137,4 +192,9 @@
   boot.loader.efi.canTouchEfiVariables = true;
 }
 
-
+  # === SSH Server ===
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+    openFirewall = true;
+  };