retroarch

hosts/arrakis/default.nix

@@ -20,11 +20,22 @@
     ../common/features/nix-ld.nix
     ../common/features/bluetooth.nix
     ../common/features/ledger.nix
+    ../common/features/smb-mounts.nix
     ../common/features/home
   ];
 
   networking.hostName = "arrakis";
 
+  # NAS media share — reachable only over the wg-home VPN. Lazy automount, so it
+  # never blocks boot and (re)mounts on first access once the VPN is up.
+  custom.smbMounts = [
+    {
+      server = "10.6.10.45";
+      share = "media";
+      mountPoint = "/mnt/media";
+    }
+  ];
+
   boot.kernelParams = [
     "i915=force_probe=46a6"
     "i915.enable_psr=0"

hosts/common/features/smb-mounts.nix

@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Lazy, VPN-friendly SMB/CIFS automounts.
+#
+# Each entry becomes a systemd *automount* rather than a plain mount, so:
+#   * boot never hangs — nothing connects to the server at boot; only the
+#     lightweight .automount unit is installed (noauto + x-systemd.automount).
+#   * it mounts on first access — when something touches the mount point (e.g.
+#     RetroArch reading its save dir), systemd performs the real CIFS mount.
+#   * it's VPN-safe — a short mount-timeout means an access while the VPN is
+#     down fails fast instead of blocking, and the automount re-arms so the next
+#     access retries. Once wg-home is up, the next access succeeds. An idle
+#     timeout unmounts the share so it re-mounts fresh after a VPN drop (no
+#     stale handles).
+#
+# NOTE: wg-home is a NetworkManager connection managed outside the flake, so the
+# mount deliberately does NOT depend on the wg interface unit — the on-access
+# retry model needs no knowledge of when the VPN is up.
+let
+  cfg = config.custom.smbMounts;
+in
+{
+  options.custom.smbMounts = lib.mkOption {
+    description = "Guest SMB/CIFS shares to expose as lazy, VPN-safe automounts.";
+    default = [ ];
+    type = lib.types.listOf (
+      lib.types.submodule {
+        options = {
+          server = lib.mkOption {
+            type = lib.types.str;
+            description = "SMB server host or IP (reachable over the VPN), e.g. \"10.10.0.1\".";
+          };
+          share = lib.mkOption {
+            type = lib.types.str;
+            description = "Share name on the server, e.g. \"retroarch\".";
+          };
+          mountPoint = lib.mkOption {
+            type = lib.types.str;
+            description = "Local mount point, e.g. \"/mnt/retroarch\".";
+          };
+          user = lib.mkOption {
+            type = lib.types.str;
+            default = "naps62";
+            description = "Local owner of the mounted files (CIFS uid/gid).";
+          };
+          idleTimeout = lib.mkOption {
+            type = lib.types.str;
+            default = "600";
+            description = "Seconds of inactivity before the share is unmounted.";
+          };
+        };
+      }
+    );
+  };
+
+  config = lib.mkIf (cfg != [ ]) {
+    # mount.cifs helper must be on PATH for systemd to perform the mount.
+    environment.systemPackages = [ pkgs.cifs-utils ];
+
+    fileSystems = lib.listToAttrs (
+      map (m: {
+        name = m.mountPoint;
+        value = {
+          device = "//${m.server}/${m.share}";
+          fsType = "cifs";
+          options = [
+            # --- guest auth (no credentials) ---
+            "guest"
+            # --- lazy, VPN-safe automount ---
+            "_netdev" # network fs: don't treat as a boot-blocking local mount
+            "noauto" # don't mount at boot…
+            "x-systemd.automount" # …mount on first access instead
+            "x-systemd.mount-timeout=10s" # fail fast if the server is unreachable
+            "x-systemd.idle-timeout=${m.idleTimeout}" # unmount when idle → fresh remount after VPN drop
+            "nofail" # never let a failed mount fault the system
+            # --- ownership / perms so ${m.user} can read+write ---
+            "uid=${m.user}"
+            "gid=users"
+            "file_mode=0664"
+            "dir_mode=0775"
+            # If the server is old and rejects the negotiated dialect, pin it,
+            # e.g. add "vers=1.0" and "sec=ntlm". Modern servers auto-negotiate.
+          ];
+        };
+      }) cfg
+    );
+  };
+}

hosts/konishi/default.nix

@@ -19,11 +19,22 @@
     ../common/features/wine.nix
     ../common/features/gaming
     ../common/features/appimage.nix
+    ../common/features/smb-mounts.nix
     ../common/features/home
   ];
 
   networking.hostName = "konishi";
 
+  # NAS media share — reachable only over the wg-home VPN. Lazy automount, so it
+  # never blocks boot and (re)mounts on first access once the VPN is up.
+  custom.smbMounts = [
+    {
+      server = "10.6.10.45";
+      share = "media";
+      mountPoint = "/mnt/media";
+    }
+  ];
+
   # Arm Wake-on-LAN (magic packet) on the Intel igc NIC and re-apply it on every
   # boot — the driver resets WoL state otherwise. Lets Moonlight wake this box
   # from suspend to stream. NOTE: also needs "Wake on LAN" enabled in BIOS (and