From b691b0faa814dcaef4ef6b6c709a73ae4b232e7f Mon Sep 17 00:00:00 2001
From: Tim Keller <tjk@tjkeller.xyz>
Date: Mon, 24 Aug 2026 18:11:45 -0500
Subject: poweredge-pro initial config

---
 hosts/poweredge-pro/fileshares.nix | 84 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 hosts/poweredge-pro/fileshares.nix

(limited to 'hosts/poweredge-pro/fileshares.nix')

diff --git a/hosts/poweredge-pro/fileshares.nix b/hosts/poweredge-pro/fileshares.nix
new file mode 100644
index 0000000..9d68e3d
--- /dev/null
+++ b/hosts/poweredge-pro/fileshares.nix
@@ -0,0 +1,84 @@
+{ config, ... }: {
+	# Configure services
+	services._fileShares = {
+		enable = true;
+		smb.openFirewall = true;
+		smb.enableUnixPasswordSync = true;
+		nfs.openFirewall = true;
+	};
+
+	# Configure share groups
+	users.groups.chexx.gid = 3000;
+	users.groups.scans.gid = 3003;
+
+	# Shares
+	services._fileShares.shares = {
+		chexx = {
+			path = "/Storage/chexx";
+			smb = {
+				enable = true;
+				allowGroup = "chexx";
+				defaultFileMask = "0664";
+				defaultDirectoryMask = "0775";
+			};
+			nfs.enable = true;
+		};
+		scans = {
+			path = "/Storage/Scans";
+			smb = {
+				enable = true;
+				allowGroup = "scans";
+				defaultFileMask = "0664";
+				defaultDirectoryMask = "0775";
+			};
+			nfs.enable = true;
+		};
+		dacs = {
+			path = "/Storage/Users/Dacs";
+			smb = {
+				enable = true;
+				allowUser = "dacs";
+			};
+		};
+		tk = {
+			path = "/home/timmy";
+			nfs.enable = true;
+		};
+	};
+
+	# Configure password secrets for users
+	sops.secrets.smb-initial-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "smb-initial-pass"; };
+	sops.secrets.user-hashed-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "user-hashed-pass"; };
+
+	# Configure users
+	users.users.timmy.extraGroups = [ "chexx" "scans" ];
+	users.users.dacs = {
+		enable = true;
+		isNormalUser = true;
+		extraGroups = [ "chexx" "scans" ];
+		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
+		uid = 3001;
+	};
+	users.users.kyle = {
+		enable = true;
+		isNormalUser = true;
+		extraGroups = [ "chexx" "scans" ];
+		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
+		uid = 3002;
+	};
+	users.users.scanner = {
+		enable = true;
+		isSystemUser = true;
+		group = "scans";
+		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
+		uid = 3003;
+	};
+
+	# Configure user enrollment for samba
+	services._fileShares.smb.enrollUsers = {
+		timmy   = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+		dacs    = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+		kyle    = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+		scanner = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
+	};
+}
-- 
cgit v1.2.3