Expand variables.nix: NFS shares, ports, image size, GC/rotation, Pi host

Adds nested vars.nfsShares (subpath + mountpoint per dataset, previously
duplicated independently across server.nix's NFS exports, mount-data.nix's
client mounts, docker.nix's tmpfiles rules, traefik's log rotation path,
and hosts/server/host.nix's beszel config), vars.ports (every literal port
in modules/ and hosts/, kept as separate entries per service even where
numbers coincide so changing one can't silently change another), plus
vars.proxmoxImageSize, vars.nixCacheGcMaxAge, vars.traefikLogRotate, and
raspberryPiHost/raspiNfsPath/raspiMountpoint for the Pi's own NFS export.

Also fixes docker.nix/minimal.nix/gui.nix hardcoding the literal "nixos"
username instead of the existing vars.primaryUser, found during the sweep.

system.stateVersion is deliberately left untouched everywhere -- per
NixOS's own docs that value must stay fixed from first install, not
follow any shared variable.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/beszel/enable-agent.nix

@@ -4,6 +4,6 @@
   services.beszel.agent.enable = true;
   services.beszel.agent.environment = {
     #DOCKER_HOST = "tcp://docker-socket-proxy:2375";
-    HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.beszelHubPort}";
+    HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.ports.beszelHub}";
   };
 }

modules/build-types/docker.nix

@@ -28,13 +28,18 @@
   boot.supportedFilesystems = [ "nfs" ];
 
   systemd.tmpfiles.rules = [
-    "L+ /home/nixos/docker - - - - /mnt/docker/config"
-    "d /mnt/docker 0755 nixos users -"
-    "d /mnt/raspi-backup 0755 nixos users -"
+    "L+ /home/${vars.primaryUser}/docker - - - - ${vars.nfsShares.dockerConfig.mountpoint}"
+    "d /mnt/docker 0755 ${vars.primaryUser} users -"
+    "d ${vars.nfsShares.raspiVolumes.mountpoint} 0755 ${vars.primaryUser} users -"
   ];
 
-  users.users.nixos.extraGroups = [ "docker" ];
+  users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
   services.openssh.settings.PermitRootLogin = "yes";
 
-  networking.firewall.allowedTCPPorts = [ 80 8080 443 vars.beszelHubPort ];
+  networking.firewall.allowedTCPPorts = [
+    vars.ports.dockerHttp
+    vars.ports.dockerExtra
+    vars.ports.dockerHttps
+    vars.ports.beszelHub
+  ];
 }

modules/build-types/gui.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, inputs, ... }:
+{ config, pkgs, lib, inputs, vars, ... }:
 
 {
   environment.systemPackages = with pkgs; [
@@ -65,7 +65,7 @@
   # The networkmanager group only exists when NM is actually enabled — the
   # lxc platform module force-disables it, so don't add the user to a group
   # that won't exist there.
-  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
+  users.users.${vars.primaryUser}.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
 
   programs.firefox.enable = true;
 

modules/build-types/minimal.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, config, ... }:
+{ lib, pkgs, config, vars, ... }:
 
 {
   networking.networkmanager.enable = true;
@@ -6,7 +6,7 @@
   # The networkmanager group only exists when NM is actually enabled — the
   # lxc platform module force-disables it, so don't add the user to a group
   # that won't exist there.
-  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
+  users.users.${vars.primaryUser}.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
 
   environment.systemPackages = with pkgs; [
     inetutils

modules/build-types/pxe-boot.nix

@@ -155,6 +155,6 @@ in
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 ];
-  networking.firewall.allowedUDPPorts = [ 69 ];
+  networking.firewall.allowedTCPPorts = [ vars.ports.pxeBootHttp ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp ];
 }

modules/build-types/server.nix

@@ -16,13 +16,13 @@
   services.nfs.server = {
     enable = true;
     exports = ''
-      ${vars.storageRoot}/docker/config ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
-      ${vars.storageRoot}/docker/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
-      ${vars.storageRoot}/docker/databases ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
-      ${vars.storageRoot}/docker/nextcloud-data ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
-      ${vars.storageRoot}/raspi/volumes ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.dockerConfig.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.dockerDatabases.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.nextcloudData.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
+      ${vars.storageRoot}/${vars.nfsShares.raspiVolumes.subpath} ${vars.lanCidr}(rw,sync,no_subtree_check,no_root_squash)
     '';
   };
 
-  networking.firewall.allowedTCPPorts = [ 111 2049 ];
+  networking.firewall.allowedTCPPorts = [ vars.ports.nfsRpcbind vars.ports.nfsd ];
 }

modules/disko/proxmox.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, vars, ... }:
 
 {
   disko.devices = {
@@ -13,7 +13,7 @@
       # whatever's left after ESP + swap within it); imageName keeps each
       # host's image distinctly named instead of every proxmox-* host
       # producing an identical "main.raw".
-      imageSize = "20G";
+      imageSize = vars.proxmoxImageSize;
       imageName = config.networking.hostName;
 
       content = {

modules/docker/mount-data.nix

@@ -2,8 +2,8 @@
 
 {
   fileSystems = {
-    "/mnt/docker/config" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/config";
+    ${vars.nfsShares.dockerConfig.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerConfig.subpath}";
       fsType = "nfs";
 
       options = [
@@ -14,8 +14,8 @@
       ];
     };
 
-    "/mnt/docker/databases" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/databases";
+    ${vars.nfsShares.dockerDatabases.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerDatabases.subpath}";
       fsType = "nfs";
 
       options = [
@@ -26,8 +26,8 @@
       ];
     };
 
-    "/mnt/docker/volumes" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/volumes";
+    ${vars.nfsShares.dockerVolumes.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
       fsType = "nfs";
 
       options = [
@@ -38,8 +38,8 @@
       ];
     };
 
-    "/mnt/nextcloud-data" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/docker/nextcloud-data";
+    ${vars.nfsShares.nextcloudData.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.nextcloudData.subpath}";
       fsType = "nfs";
 
       options = [
@@ -50,8 +50,8 @@
       ];
     };
 
-    "/mnt/raspi-backup" = {
-      device = "${vars.nfsServerHost}:${vars.storageRoot}/raspi/volumes";
+    ${vars.nfsShares.raspiVolumes.mountpoint} = {
+      device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.raspiVolumes.subpath}";
       fsType = "nfs";
 
       options = [

modules/nix-cache/server.nix

@@ -28,7 +28,7 @@
     openssh.enable = true;
   };
 
-  networking.firewall.allowedTCPPorts = [ 80 ];
+  networking.firewall.allowedTCPPorts = [ vars.ports.nixCacheHttp ];
 
   users.groups.${vars.remoteBuilderUser} = { };
 
@@ -54,6 +54,6 @@
   nix.gc = {
     automatic = true;
     dates = "weekly";
-    options = "--delete-older-than 30d";
+    options = "--delete-older-than ${vars.nixCacheGcMaxAge}";
   };
 }

modules/raspi/mount-data.nix

@@ -1,8 +1,8 @@
 { vars, ... }:
 
 {
-  fileSystems."/mnt/raspi" = {
-    device = "raspberrypi.${vars.tailnetDomain}:/home/raspi/raspi";
+  fileSystems.${vars.raspiMountpoint} = {
+    device = "${vars.raspberryPiHost}.${vars.tailnetDomain}:${vars.raspiNfsPath}";
     fsType = "nfs4";
     options = [
       "nofail"

modules/traefik/rotate-logs.nix

@@ -1,14 +1,14 @@
-_:
+{ vars, ... }:
 
 {
   services.logrotate = {
     enable = true;
 
     settings = {
-      "/mnt/docker/volumes/traefik-data/logs/*.log" = {
+      "${vars.nfsShares.dockerVolumes.mountpoint}/traefik-data/logs/*.log" = {
         daily = true;
-        size = "100M";
-        rotate = 20;
+        size = vars.traefikLogRotate.maxSize;
+        rotate = vars.traefikLogRotate.keep;
         compress = true;
         missingok = true;
         notifempty = true;