1 files changed, 92 insertions, 0 deletions
diff --git a/hosts/poweredge-pro/fileshares.nix b/hosts/poweredge-pro/fileshares.nix
new file mode 100644
index 0000000..65ce84d
--- /dev/null
+++ b/hosts/poweredge-pro/fileshares.nix
@@ -0,0 +1,92 @@
+{ pkgs, config, ... }: {
+	# Configure services
+	services._fileShares = {
+		enable = true;
+		smb.openFirewall = true;
+		smb.enableUnixPasswordSync = true;
+		nfs.openFirewall = true;
+	};
+
+	# Configure share groups
+	users.groups.chexx.gid = 3000;
+	users.groups.scans.gid = 3003;
+
+	# Shares
+	services._fileShares.shares = {
+		chexx = {
+			path = "/VMDisk/shares/chexx";
+			smb = {
+				enable = true;
+				allowGroup = "chexx";
+				defaultFileMask = "0664";
+				defaultDirectoryMask = "0775";
+			};
+			nfs.enable = true;
+		};
+		scans = {
+			path = "/VMDisk/shares/scans";
+			smb = {
+				enable = true;
+				allowGroup = "scans";
+				defaultFileMask = "0664";
+				defaultDirectoryMask = "0775";
+			};
+			nfs.enable = true;
+		};
+		dacs = {
+			path = "/Storage/Users/Dacs";
+			smb = {
+				enable = true;
+				allowUser = "dacs";
+			};
+		};
+		tk = {
+			path = "/home/timmy/docs/shared";
+			nfs.enable = true;
+		};
+	};
+
+	# Configure password secrets for users
+	sops.secrets.smb-initial-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "smb-initial-pass"; };
+	sops.secrets.user-hashed-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "user-hashed-pass"; };
+
+	# Configure users
+	users.users.timmy.extraGroups = [ "chexx" "scans" ];
+	users.users.dacs = {
+		enable = true;
+		isNormalUser = true;
+		extraGroups = [ "chexx" "scans" ];
+		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
+		uid = 3001;
+	};
+	users.users.kyle = {
+		enable = true;
+		isNormalUser = true;
+		extraGroups = [ "chexx" "scans" ];
+		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
+		uid = 3002;
+	};
+	users.users.scanner = {
+		enable = true;
+		isSystemUser = true;
+		group = "scans";
+		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
+		uid = 3003;
+	};
+	users.users.zfsbackup = {
+		isSystemUser = true;
+		group = "zfsbackup";
+		shell = pkgs.bashInteractive;
+		hashedPassword = "!";  # Disallow login through standard means
+		openssh.authorizedKeys.keyFiles = [ ./resources/openssh/zfsbackup/truenas-10.0.0.9-rsa.pub ];
+	};
+	users.groups.zfsbackup = {};
+
+	# Configure user enrollment for samba
+	services._fileShares.smb.enrollUsers = {
+		timmy   = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+		dacs    = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+		kyle    = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+		scanner = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+	};
+}