feat(hosts): make config multi-host and add vps host

Parametrize networking, users, and containers modules under
myNetworking/myUsers/myContainers so both hosts share the same logic
instead of duplicating it, and split desktop/server module imports
into modules/profiles/. Adds hosts/vps (not installed yet, hardware
config and bootloader device are placeholders) to run Traefik,
Headscale, Headplane, and Gitea via a combined Docker Compose stack.

Wires up agenix for secrets and migrates miku-homelab's WireGuard
private key off a plain filesystem path into an encrypted
secrets/miku-homelab-wg.age. The vps side of that tunnel still needs
its own key generated and encrypted after install.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

modules/services/containers.nix

@@ -1,70 +1,92 @@
-{ pkgs, ... }: 
-{
-  virtualisation = {
-    containers.enable = true;
-    podman = {
-      enable = true;
-      defaultNetwork.settings.dns_enabled = true;
-    };
-    docker = {
-      enable = true;
-      storageDriver = "btrfs";
-      daemon.settings = {
-      dns = [ "1.1.1.1" "8.8.8.8" ];
+{ lib, pkgs, config, ... }:
+
+let
+  cfg = config.myContainers;
+
+  composeStackOpts = { ... }: {
+    options = {
+      path = lib.mkOption {
+        type = lib.types.path;
+        description = "Directory containing the docker-compose.yml for this stack.";
+      };
+      after = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Extra systemd units this stack's compose service should start after and want, beyond docker.service.";
       };
     };
   };
 
- systemd.services = {
-  init-docker-networks = {
-    description = "Crear redes globales de Docker si no existen";
-    after = [ "docker.service" ];
-    requires = [ "docker.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = "${pkgs.bash}/bin/bash -c '${pkgs.docker}/bin/docker network inspect homelab_net >/dev/null 2>&1 || ${pkgs.docker}/bin/docker network create homelab_net'";
+  mkComposeService = name: stack: {
+    name = "docker-compose-${name}";
+    value = {
+      description = "Docker Compose stack: ${name}";
+      after = [ "docker.service" ] ++ lib.optional (cfg.globalNetwork != null) "init-docker-networks.service" ++ stack.after;
+      wants = [ "docker.service" ] ++ lib.optional (cfg.globalNetwork != null) "init-docker-networks.service" ++ stack.after;
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        WorkingDirectory = stack.path;
+        ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
+        ExecStop = "${pkgs.docker}/bin/docker compose down";
+      };
     };
   };
-  docker-compose-tools = {
-    description = "Stack de Docker Compose: Tools";
-    after = [ "docker.service" "network-online.target" "tailscaled.service" ];
-    wants = [ "docker.service" "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      WorkingDirectory = "/mnt/containers/tools";
-      ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
-      ExecStop = "${pkgs.docker}/bin/docker compose down";
+in
+{
+  options.myContainers = {
+    enable = lib.mkEnableOption "Docker/Podman container support and Docker Compose stacks";
+
+    storageDriver = lib.mkOption {
+      type = lib.types.nullOr (lib.types.enum [ "aufs" "btrfs" "devicemapper" "overlay" "overlay2" "zfs" ]);
+      default = null;
+      description = "Docker storage driver to use. Leave null to let Docker choose.";
+    };
+
+    globalNetwork = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "Name of a shared Docker network to create on boot, for compose stacks to join. Leave null to skip.";
+    };
+
+    composeStacks = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule composeStackOpts);
+      default = { };
+      description = "Docker Compose stacks to run as systemd services, each producing a docker-compose-<name> unit.";
     };
   };
-  docker-compose-arrs = {
-    description = "Stack de Docker Compose: Arrs";
-    after = [ "docker.service" "docker-compose-tools.service" "local-fs.target" ];
-    wants = [ "docker.service" "docker-compose-tools.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      WorkingDirectory = "/mnt/containers/arrs";
-      ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
-      ExecStop = "${pkgs.docker}/bin/docker compose down";
+
+  config = lib.mkIf cfg.enable {
+    virtualisation = {
+      containers.enable = true;
+      podman = {
+        enable = true;
+        defaultNetwork.settings.dns_enabled = true;
+      };
+      docker = {
+        enable = true;
+        storageDriver = cfg.storageDriver;
+        daemon.settings = {
+          dns = [ "1.1.1.1" "8.8.8.8" ];
+        };
+      };
     };
+
+    systemd.services =
+      lib.optionalAttrs (cfg.globalNetwork != null) {
+        init-docker-networks = {
+          description = "Create the ${cfg.globalNetwork} Docker network if it doesn't exist";
+          after = [ "docker.service" ];
+          requires = [ "docker.service" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${pkgs.bash}/bin/bash -c '${pkgs.docker}/bin/docker network inspect ${cfg.globalNetwork} >/dev/null 2>&1 || ${pkgs.docker}/bin/docker network create ${cfg.globalNetwork}'";
+          };
+        };
+      }
+      // lib.mapAttrs' mkComposeService cfg.composeStacks;
   };
-  docker-compose-gameservers = {
-    description = "Stack de Docker Compose: Gameservers";
-    after = [ "docker.service" "docker-compose-tools.service" ];
-    wants = [ "docker.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      WorkingDirectory = "/mnt/containers/gameserver";
-      ExecStart = "${pkgs.docker}/bin/docker compose up -d --remove-orphans";
-      ExecStop = "${pkgs.docker}/bin/docker compose down";
-    };
-  };
- };
 }

modules/services/samba.nix

@@ -0,0 +1,27 @@
+{
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      global = {
+        "vfs objects" = "acl_xattr";
+        "map acl inherit" = "yes";
+        "store dos attributes" = "yes";
+      };
+      mikufanclub = {
+        path = "/mnt/data/mikufanclub";
+        writable = "yes";
+        "valid users" = "mikushare emmatherock";
+        "force group" = "mikushare-group";
+        "create mask" = "0660";
+        "directory mask" = "0770";
+      };
+      data-private = {
+        path = "/mnt/data";
+        writable = "yes";
+        "valid users" = "emmatherock";
+        "browseable" = "yes";
+      };
+    };
+  };
+}