{ pkgs, ... }:

# Samba file server for the /mnt/data share + password provisioning.
# Import on any host that should serve the NAS.
{
  services.samba = {
    enable = true;
    openFirewall = true;
    settings = {
      global = {
        "workgroup" = "WORKGROUP";
        "server string" = "jupiter";
        "security" = "user";
      };
      data = {
        "path" = "/mnt/data";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "valid users" = "darman";
      };
    };
  };

  # Samba keeps its own NTLM password DB, separate from the system password —
  # `services.samba` never sets it, and this runs as a service (not an
  # activation script, which fires too early for smbpasswd's passdb) after
  # samba-smbd. Reads a single-line password from the first existing file,
  # feeding it twice since smbpasswd prompts new+confirm:
  #   Real host: /run/secrets/samba_password  (sops-nix, see secrets.nix)
  #   VM test:   /etc/samba/smb-password       (plaintext, see vm.nix)
  systemd.services.samba-smbpasswd = {
    description = "Provision Samba password for darman";
    after = [ "samba-smbd.service" ];
    requires = [ "samba-smbd.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    script = ''
      for f in /run/secrets/samba_password /etc/samba/smb-password; do
        if [ -f "$f" ]; then
          pw=$(head -n1 "$f")
          printf '%s\n%s\n' "$pw" "$pw" | ${pkgs.samba}/bin/smbpasswd -a -s darman
          exit 0
        fi
      done
      echo "no samba password source found" >&2
    '';
  };
}