dotfiles/Ahwxorg
1
0
Fork 0
mirror of https://github.com/Ahwxorg/nixos-config.git synced 2026-07-16 22:21:55 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: further protect smb shares

Browse source
This commit is contained in:
Ahwx 2026-06-04 03:59:00 +02:00
parent 15461dcbdb
commit 8deb1b122a
1 changed files with 46 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

59
modules/services/nfs.nix
View file

@ -2,31 +2,54 @@
config, config,
lib, lib,
pkgs, pkgs,
username,
... ...
}: }:
{ {
services = { services = {
samba = { samba = {
# syncPasswordsByPam = true;
# If set, we will still need to set users with:
# sudo smbpasswd -a yourusername
package = pkgs.samba; package = pkgs.samba;
# ^^ `samba4Full` is compiled with avahi, ldap, AD etc support (compared to the default package, `samba`. samba4Full gives issue, however) # ^^ `samba4Full` is compiled with avahi, ldap, AD etc support (compared to the default package, `samba`. samba4Full gives issue, however)
# Required for samba to register mDNS records for auto discovery # Required for samba to register mDNS records for auto discovery
# See https://github.com/NixOS/nixpkgs/blob/592047fc9e4f7b74a4dc85d1b9f5243dfe4899e3/pkgs/top-level/all-packages.nix#L27268 # See https://github.com/NixOS/nixpkgs/blob/592047fc9e4f7b74a4dc85d1b9f5243dfe4899e3/pkgs/top-level/all-packages.nix#L27268
enable = true; enable = true;
openFirewall = true; openFirewall = true;
shares.main = { settings.global = {
path = "/spinners/rootvol/nfs"; "security" = "user";
writable = "true"; "invalid users" = [ "root" ];
comment = "Hello world!"; "server smb encrypt" = "required";
}; };
shares.violet = { shares = {
path = "/spinners/violet"; main = {
writable = "true"; path = "/spinners/rootvol/nfs";
comment = "Hello world!"; writable = "true";
}; comment = "Hello world!";
shares.ahwx = { "guest ok" = "no";
path = "/spinners/ahwx"; "read only" = "no";
writable = "true"; browsable = "no";
comment = "Hello world!"; "valid users" = "access";
};
violet = {
path = "/spinners/violet";
writable = "true";
comment = "Hello world!";
"guest ok" = "no";
"read only" = "no";
browsable = "no";
"valid users" = "liv";
};
ahwx = {
path = "/spinners/ahwx";
writable = "true";
comment = "Hello world!";
"guest ok" = "no";
"read only" = "no";
browsable = "no";
"valid users" = "liv";
};
}; };
}; };
avahi = { avahi = {
@ -44,4 +67,14 @@
openFirewall = true; openFirewall = true;
}; };
}; };
users.users = {
"access" = {
isNormalUser = true;
extraGroups = [ "samba" ];
};
${username} = {
extraGroups = [ "samba" ];
};
};
} }