darmanandClaude Sonnet 5
d7a66f3e3b
Group service modules by category (media, network, vpn, identity, dev, desktop) to make the growing services/ dir easier to navigate. containers.nix stays at the top level since it's a shared backend, not a single-category service. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
54 lines
1.7 KiB
Nix
54 lines
1.7 KiB
Nix
{ pkgs, ... }:
|
|
|
|
# Samba file server for the /mnt/data share + password provisioning.
|
|
# Import on any host that should serve the NAS.
|
|
{
|
|
services.samba = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
settings = {
|
|
global = {
|
|
"workgroup" = "WORKGROUP";
|
|
"server string" = "jupiter";
|
|
"security" = "user";
|
|
};
|
|
data = {
|
|
"path" = "/mnt/data";
|
|
"browseable" = "yes";
|
|
"read only" = "no";
|
|
"guest ok" = "no";
|
|
"valid users" = "darman";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Samba keeps its own NTLM password DB, separate from the system password;
|
|
# `services.samba` never sets it, so logins fail until provisioned. Runs
|
|
# AFTER samba-smbd so its state dir exists — an activation script runs too
|
|
# early and smbpasswd fails to init the passdb. Reads a single-line
|
|
# password from the first file that exists:
|
|
# Real host: /run/secrets/samba_password (sops-nix, see secrets.nix)
|
|
# VM test: /etc/samba/smb-password (plaintext, see vm.nix)
|
|
# smbpasswd prompts new + confirm, so the value is fed twice.
|
|
systemd.services.samba-smbpasswd = {
|
|
description = "Provision Samba password for darman";
|
|
after = [ "samba-smbd.service" ];
|
|
requires = [ "samba-smbd.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
for f in /run/secrets/samba_password /etc/samba/smb-password; do
|
|
if [ -f "$f" ]; then
|
|
pw=$(head -n1 "$f")
|
|
printf '%s\n%s\n' "$pw" "$pw" | ${pkgs.samba}/bin/smbpasswd -a -s darman
|
|
exit 0
|
|
fi
|
|
done
|
|
echo "no samba password source found" >&2
|
|
'';
|
|
};
|
|
}
|