Expand variables.nix: NFS shares, ports, image size, GC/rotation, Pi host

Adds nested vars.nfsShares (subpath + mountpoint per dataset, previously
duplicated independently across server.nix's NFS exports, mount-data.nix's
client mounts, docker.nix's tmpfiles rules, traefik's log rotation path,
and hosts/server/host.nix's beszel config), vars.ports (every literal port
in modules/ and hosts/, kept as separate entries per service even where
numbers coincide so changing one can't silently change another), plus
vars.proxmoxImageSize, vars.nixCacheGcMaxAge, vars.traefikLogRotate, and
raspberryPiHost/raspiNfsPath/raspiMountpoint for the Pi's own NFS export.

Also fixes docker.nix/minimal.nix/gui.nix hardcoding the literal "nixos"
username instead of the existing vars.primaryUser, found during the sweep.

system.stateVersion is deliberately left untouched everywhere -- per
NixOS's own docs that value must stay fixed from first install, not
follow any shared variable.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

variables.nix

@@ -12,6 +12,11 @@
   nfsServerHost = "server"; # NFS export source hostname
   dockerHost = "docker"; # docker-compose stack host
 
+  # Raspberry Pi's own Tailscale hostname (not fronted by `server` — it
+  # exports its own NFS share directly). Resolved as
+  # "${raspberryPiHost}.${tailnetDomain}" in modules/raspi/mount-data.nix.
+  raspberryPiHost = "raspberrypi";
+
   remoteBuilderUser = "nixremote"; # remote builder SSH user
 
   # Public keys authorized to SSH in as remoteBuilderUser on the nix-cache
@@ -32,13 +37,113 @@
 
   # System
   timeZone = "Australia/Brisbane";
-  primaryUser = "nixos"; # main interactive user on every host
+
+  # Main interactive user on every host. Every module that grants this user
+  # a group, a home directory, or tmpfiles ownership should reference
+  # vars.primaryUser rather than the literal "nixos", so renaming it is a
+  # one-line change.
+  primaryUser = "nixos";
 
   # Storage
   storageRoot = "/tank"; # ZFS pool root on `server`
 
-  # Well-known ports for LAN services referenced from multiple hosts
-  beszelHubPort = 8090;
-  pveWebPort = 8006;
-  pbsWebPort = 8007;
+  # NFS datasets exported from `storageRoot` on `nfsServerHost` and mounted
+  # by client hosts. `subpath` is relative to `storageRoot` — combined with
+  # it to build both the export line in modules/build-types/server.nix and
+  # the "<nfsServerHost>:<storageRoot>/<subpath>" device string each client
+  # mount uses in modules/docker/mount-data.nix. `mountpoint` is the
+  # absolute local path clients mount it at, referenced by that same file's
+  # fileSystems attribute name plus every other place that needs to know
+  # where the share lives locally (modules/build-types/docker.nix's
+  # tmpfiles rules, modules/traefik/rotate-logs.nix's log path). Renaming a
+  # dataset or moving where it's mounted only needs changing it here — the
+  # export and every client reference follow automatically.
+  nfsShares = {
+    dockerConfig = {
+      subpath = "docker/config";
+      mountpoint = "/mnt/docker/config";
+    };
+    dockerDatabases = {
+      subpath = "docker/databases";
+      mountpoint = "/mnt/docker/databases";
+    };
+    dockerVolumes = {
+      subpath = "docker/volumes";
+      mountpoint = "/mnt/docker/volumes";
+    };
+    nextcloudData = {
+      subpath = "docker/nextcloud-data";
+      mountpoint = "/mnt/nextcloud-data";
+    };
+    raspiVolumes = {
+      subpath = "raspi/volumes";
+      mountpoint = "/mnt/raspi-backup";
+    };
+  };
+
+  # The Raspberry Pi's own NFS export — not under storageRoot/nfsServerHost,
+  # served directly by the Pi itself over Tailscale (see raspberryPiHost
+  # above) and mounted at raspiMountpoint by modules/raspi/mount-data.nix.
+  raspiNfsPath = "/home/raspi/raspi";
+  raspiMountpoint = "/mnt/raspi";
+
+  # Every literal port referenced from modules/ or hosts/, grouped by the
+  # service/host that opens or connects to it — kept as separate entries
+  # even where two happen to share a number today (e.g. nixCacheHttp and
+  # pxeBootHttp are both 80) so changing one service's port can never
+  # silently change an unrelated one.
+  ports = {
+    # nix-cache's nginx reverse proxy in front of nix-serve
+    # (modules/nix-cache/server.nix).
+    nixCacheHttp = 80;
+
+    # pxe-boot's nginx asset server, also used to build pxeBaseUrl
+    # (modules/build-types/pxe-boot.nix).
+    pxeBootHttp = 80;
+
+    # pxe-boot's atftpd TFTP server — UDP, not TCP
+    # (modules/build-types/pxe-boot.nix).
+    pxeBootTftp = 69;
+
+    # `server`'s NFS exports need both the portmapper (rpcbind) and the
+    # NFS data port itself opened (modules/build-types/server.nix).
+    nfsRpcbind = 111;
+    nfsd = 2049;
+
+    # Opened on the docker host's firewall for the Traefik-fronted
+    # container stack (docker-compose config lives in the separate
+    # /home/debian/docker repo, not here): 80/443 are Traefik's own
+    # HTTP/HTTPS listeners; 8080 is an additional exposed service whose
+    # exact backend isn't declared in this repo (modules/build-types/docker.nix).
+    dockerHttp = 80;
+    dockerHttps = 443;
+    dockerExtra = 8080;
+
+    # Beszel monitoring hub, reachable at
+    # http://<dockerHost>.<homeDomain>:<beszelHub> from every agent
+    # (modules/beszel/enable-agent.nix, hosts/nixos/home.nix).
+    beszelHub = 8090;
+
+    # Proxmox VE and Proxmox Backup Server web UIs, opened as desktop
+    # shortcuts on the gui build type (hosts/nixos/home.nix).
+    pveWeb = 8006;
+    pbsWeb = 8007;
+  };
+
+  # .raw disk image size for every proxmox-* host's standalone Disko image
+  # build (modules/disko/proxmox.nix, config.system.build.diskoImagesScript
+  # — see docs/proxmox-images.md). Root fills whatever's left after the ESP
+  # and swap partitions within this total.
+  proxmoxImageSize = "20G";
+
+  # nix-cache's Nix store garbage collection retention
+  # (modules/nix-cache/server.nix).
+  nixCacheGcMaxAge = "30d";
+
+  # Traefik access log rotation, watched on the docker host at
+  # nfsShares.dockerVolumes.mountpoint (modules/traefik/rotate-logs.nix).
+  traefikLogRotate = {
+    maxSize = "100M"; # rotate once a log file exceeds this size
+    keep = 20; # number of rotated logs to retain before deleting the oldest
+  };
 }