{ pkgs, ... }:

# Samba file server for the /mnt/data share + password provisioning.
# Import on any host that should serve the NAS.
{
  services.samba = {
    enable = true;
    openFirewall = true;
    settings = {
      global = {
        "workgroup" = "WORKGROUP";
        "server string" = "jupiter";
        "security" = "user";
      };
      data = {
        "path" = "/mnt/data";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "valid users" = "darman";
      };
    };
  };

  # Samba keeps its own NTLM password DB, separate from the system password.
  # `services.samba` never sets it, so logins fail until provisioned.
  # This runs AFTER samba-smbd so its state dir (/var/lib/samba/private) exists
  # — an activation script runs too early and smbpasswd fails to init the passdb.
  # Reads a single-line password from the first file that exists:
  #   Real host: /run/secrets/samba_password  (sops-nix, see secrets.nix)
  #   VM test:   /etc/samba/smb-password       (plaintext, see vm.nix)
  # smbpasswd prompts new + confirm, so the value is fed twice.
  systemd.services.samba-smbpasswd = {
    description = "Provision Samba password for darman";
    after = [ "samba-smbd.service" ];
    requires = [ "samba-smbd.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    script = ''
      for f in /run/secrets/samba_password /etc/samba/smb-password; do
        if [ -f "$f" ]; then
          pw=$(head -n1 "$f")
          printf '%s\n%s\n' "$pw" "$pw" | ${pkgs.samba}/bin/smbpasswd -a -s darman
          exit 0
        fi
      done
      echo "no samba password source found" >&2
    '';
  };
}