diff options
| -rw-r--r-- | hosts/poweredge/fileshares.nix | 55 | ||||
| -rw-r--r-- | nixos/services/fileshares.nix | 48 |
2 files changed, 76 insertions, 27 deletions
diff --git a/hosts/poweredge/fileshares.nix b/hosts/poweredge/fileshares.nix index c5fca71..faf0f83 100644 --- a/hosts/poweredge/fileshares.nix +++ b/hosts/poweredge/fileshares.nix @@ -7,17 +7,6 @@ }; # Shares services._fileShares.shares = { - PS2 = { - path = "/media/ingens/games/ps2"; - smb = { - enable = true; - allowUser = "ps2"; - extraOptions = { - "min protocol" = "NT1"; - "max protocol" = "NT1"; - }; - }; - }; WinBackups = { path = "/media/ingens/backups/windows"; smb.enable = true; @@ -35,13 +24,45 @@ path = "/media/ingens/backups"; nfs.enable = true; }; + games = { + path = "/media/ingens/games"; + nfs.enable = true; + }; + documents = { + path = "/media/ingens/documents"; + nfs.enable = true; + smb.enable = true; + }; }; - # ps2 user - users.users.ps2 = { - isSystemUser = true; - password = "ps2"; - group = "ps2"; + # retro shares + containers.retronas = { + autoStart = true; + bindMounts = { + "/media/ingens/games" = { + hostPath = "/media/ingens/games"; + isReadOnly = false; + }; + }; + + config = { config, pkgs, ... }: { + imports = [ ../../nixos/services/fileshares.nix ]; # Get fileshares module + + services._fileShares = { + enable = true; + smb = { + port = 1445; + enableLegacyNT1 = true; # purpose of this container + openFirewall = true; + }; + }; + services._fileShares.shares = { + PS2 = { + path = "/media/ingens/games/ps2"; + smb.enable = true; + smb.allowGuests = true; + }; + }; + }; }; - users.groups.ps2 = {}; } diff --git a/nixos/services/fileshares.nix b/nixos/services/fileshares.nix index e61797f..90327b8 100644 --- a/nixos/services/fileshares.nix +++ b/nixos/services/fileshares.nix @@ -67,6 +67,14 @@ "hosts deny" = lib.mkDefault "0.0.0.0/0"; "guest account" = lib.mkDefault "nobody"; "map to guest" = lib.mkDefault "bad user"; + "smb ports" = cfg.smb.port; + }; + sambaLegacyNT1Settings.global = { + "server min protocol" = "NT1"; + "server max protocol" = "NT1"; + "ntlm auth" = lib.boolToYesNo true; + "lanman auth" = lib.boolToYesNo true; + "client lanman auth" = lib.boolToYesNo true; }; mkSambaShare = s: { "path" = s.path; @@ -82,7 +90,9 @@ "hosts deny" = lib.mkIf (s.allowHosts != []) "ALL"; "hosts allow" = lib.mkIf (s.allowHosts != []) (lib.concatStringsSep " " s.allowHosts); } // s.smb.extraOptions; - sambaSettings = sambaGlobalSettings // lib.mapAttrs (_: v: mkSambaShare v) sambaShares; + sambaSettings = sambaGlobalSettings + // lib.optionalAttrs cfg.smb.enableLegacyNT1 sambaLegacyNT1Settings + // lib.mapAttrs (_: v: mkSambaShare v) sambaShares; # NFS mkNFSShareHost = s: host: ''${host}(${if s.readOnly then "ro" else "rw"},sync,no_subtree_check)''; # TODO configure @@ -100,6 +110,15 @@ in { }; smb = { openFirewall = lib.mkEnableOption "open firewall for smb"; + port = lib.mkOption { + type = lib.types.int; + default = 445; + }; + enableLegacyNT1 = lib.mkEnableOption '' + enable legacy smb1/nt1 protocol support with ntlm/lanman auth. + required for very old clients (windows xp, legacy nas devices, etc). + ''; + enableNetBiosDiscovery = lib.mkEnableOption "enable netbios name resolution for clients"; }; nfs = { enableNFSv3 = lib.mkEnableOption "enable support for nfsv3"; @@ -113,6 +132,7 @@ in { services.samba = { enable = true; openFirewall = lib.mkDefault cfg.smb.openFirewall; + nmbd.enable = cfg.smb.enableNetBiosDiscovery; settings = sambaSettings; }; }) @@ -136,15 +156,23 @@ in { }) ]; - # NFS firewall - networking.firewall = lib.mkIf cfg.nfs.openFirewall ( - if cfg.nfs.enableNFSv3 then { - allowedTCPPorts = [ 111 2049 4000 4001 4002 20048 ]; - allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 ]; - } else { - allowedTCPPorts = [ 2049 ]; - } - ); + # Firewall + networking.firewall = lib.mkMerge [ + (lib.mkIf cfg.nfs.openFirewall ( + if cfg.nfs.enableNFSv3 then { + allowedTCPPorts = [ 111 2049 4000 4001 4002 20048 ]; + allowedUDPPorts = [ 111 2049 4000 4001 4002 20048 ]; + } else { + allowedTCPPorts = [ 2049 ]; + } + )) + + (lib.mkIf cfg.smb.openFirewall { + allowedTCPPorts = [ cfg.smb.port ] + ++ lib.optional cfg.smb.enableNetBiosDiscovery 139; + allowedUDPPorts = lib.optionals cfg.smb.enableNetBiosDiscovery [ 137 138 ]; + }) + ]; }) ]); } |