erik
fb782cb9fe
- services/{samba,avahi,audiobookshelf,containers,caddy,tailscale}.nix
- common.nix grows firewall base + timezone; hosts import what they need
- jupiter/vm/vps import service modules; drop the jupiter/services.nix monolith
- each module opens its own firewall ports; caddy/tailscale shared by hosts
- verified: jupiter/vps/vbox eval + jupiter builds, config equivalent
54 lines
1.7 KiB
Nix
54 lines
1.7 KiB
Nix
{ pkgs, ... }:
|
|
|
|
# Samba file server for the /mnt/data share + password provisioning.
|
|
# Import on any host that should serve the NAS.
|
|
{
|
|
services.samba = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
settings = {
|
|
global = {
|
|
"workgroup" = "WORKGROUP";
|
|
"server string" = "jupiter";
|
|
"security" = "user";
|
|
};
|
|
data = {
|
|
"path" = "/mnt/data";
|
|
"browseable" = "yes";
|
|
"read only" = "no";
|
|
"guest ok" = "no";
|
|
"valid users" = "darman";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Samba keeps its own NTLM password DB, separate from the system password.
|
|
# `services.samba` never sets it, so logins fail until provisioned.
|
|
# This runs AFTER samba-smbd so its state dir (/var/lib/samba/private) exists
|
|
# — an activation script runs too early and smbpasswd fails to init the passdb.
|
|
# Reads a single-line password from the first file that exists:
|
|
# Real host: /run/secrets/samba_password (sops-nix, see secrets.nix)
|
|
# VM test: /etc/samba/smb-password (plaintext, see vm.nix)
|
|
# smbpasswd prompts new + confirm, so the value is fed twice.
|
|
systemd.services.samba-smbpasswd = {
|
|
description = "Provision Samba password for darman";
|
|
after = [ "samba-smbd.service" ];
|
|
requires = [ "samba-smbd.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
for f in /run/secrets/samba_password /etc/samba/smb-password; do
|
|
if [ -f "$f" ]; then
|
|
pw=$(head -n1 "$f")
|
|
printf '%s\n%s\n' "$pw" "$pw" | ${pkgs.samba}/bin/smbpasswd -a -s darman
|
|
exit 0
|
|
fi
|
|
done
|
|
echo "no samba password source found" >&2
|
|
'';
|
|
};
|
|
}
|