62 lines
2.2 KiB
Nix
62 lines
2.2 KiB
Nix
|
{
|
|||
|
|
config,
|
|||
|
|
secrets,
|
|||
|
|
...
|
|||
|
|
}: {
|
|||
|
|
# Samba provides file and print services for various Microsoft Windows
|
|||
|
|
# clients.
|
|||
|
|
# https://wiki.nixos.org/wiki/Samba
|
|||
|
|
#
|
|||
|
|
# The setup can be tested by:
|
|||
|
|
# > smbclient -L \\\\192.168.0.10
|
|||
|
|
# > smbclient \\\\192.168.0.21\\downloads -U caspervk
|
|||
|
|
#
|
|||
|
|
# Running .exe's and installing programs through a network drive doesn't
|
|||
|
|
# always work on Windows. The following tricks Windows by "mounting" the
|
|||
|
|
# network drive to a local drive letter (or something like that, who knows).
|
|||
|
|
# In cmd as administrator:
|
|||
|
|
# > net use \\192.168.0.10\downloads
|
|||
|
|
# > SUBST M: \\192.168.0.10\downloads
|
|||
|
|
# > dir M:
|
|||
|
|
# > M:\Programs\install.exe
|
|||
|
|
services.samba = {
|
|||
|
|
enable = true;
|
|||
|
|
# Disable discovery: don't reply to NetBIOS over IP name service requests
|
|||
|
|
# or participate in the browsing protocols which make up the Windows
|
|||
|
|
# “Network Neighborhood” view.
|
|||
|
|
enableNmbd = false;
|
|||
|
|
# Disable Samba’s winbindd, which provides a number of services to the Name
|
|||
|
|
# Service Switch capability found in most modern C libraries, to arbitrary
|
|||
|
|
# applications via PAM and ntlm_auth and to Samba itself.
|
|||
|
|
enableWinbindd = false;
|
|||
|
|
# https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html
|
|||
|
|
extraConfig = ''
|
|||
|
|
# Only allow local access. This should also be enforced by the firewall.
|
|||
|
|
hosts deny ALL
|
|||
|
|
hosts allow = 192.168.0.0/16 127.0.0.1 localhost
|
|||
|
|
# Use user and group information from TDB database.
|
|||
|
|
# The age-encrypted database is created by setting in the config
|
|||
|
|
# > passdb backend = passdb backend = tdbsam:/tmp/samba-password-database
|
|||
|
|
# and running
|
|||
|
|
# > sudo pdbedit --create --user=caspervk
|
|||
|
|
passdb backend = tdbsam:${config.age.secrets.samba-password-database.path}
|
|||
|
|
# Allow Windows clients to run .exe's
|
|||
|
|
acl allow execute always = True
|
|||
|
|
'';
|
|||
|
|
shares = {
|
|||
|
|
downloads = {
|
|||
|
|
path = "/srv/torrents/downloads";
|
|||
|
|
# Use the 'torrent' group for access for all users connecting
|
|||
|
|
"force group" = "torrent";
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
age.secrets.samba-password-database = {
|
|||
|
|
file = "${secrets}/secrets/samba-password-database.age";
|
|||
|
|
mode = "400";
|
|||
|
|
owner = "root";
|
|||
|
|
group = "root";
|
|||
|
|
};
|
|||
|
|
}
|