{ config, ... }: {
	# Configure services
	services._fileShares = {
		enable = true;
		smb.openFirewall = true;
		smb.enableUnixPasswordSync = true;
		nfs.openFirewall = true;
	};

	# Configure share groups
	users.groups.chexx.gid = 3000;
	users.groups.scans.gid = 3003;

	# Shares
	services._fileShares.shares = {
		chexx = {
			path = "/Storage/chexx";
			smb = {
				enable = true;
				allowGroup = "chexx";
				defaultFileMask = "0664";
				defaultDirectoryMask = "0775";
			};
			nfs.enable = true;
		};
		scans = {
			path = "/Storage/Scans";
			smb = {
				enable = true;
				allowGroup = "scans";
				defaultFileMask = "0664";
				defaultDirectoryMask = "0775";
			};
			nfs.enable = true;
		};
		dacs = {
			path = "/Storage/Users/Dacs";
			smb = {
				enable = true;
				allowUser = "dacs";
			};
		};
		tk = {
			path = "/home/timmy";
			nfs.enable = true;
		};
	};

	# Configure password secrets for users
	sops.secrets.smb-initial-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "smb-initial-pass"; };
	sops.secrets.user-hashed-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "user-hashed-pass"; };

	# Configure users
	users.users.timmy.extraGroups = [ "chexx" "scans" ];
	users.users.dacs = {
		enable = true;
		isNormalUser = true;
		extraGroups = [ "chexx" "scans" ];
		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
		uid = 3001;
	};
	users.users.kyle = {
		enable = true;
		isNormalUser = true;
		extraGroups = [ "chexx" "scans" ];
		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
		uid = 3002;
	};
	users.users.scanner = {
		enable = true;
		isSystemUser = true;
		group = "scans";
		hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
		uid = 3003;
	};

	# Configure user enrollment for samba
	services._fileShares.smb.enrollUsers = {
		timmy   = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
		dacs    = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
		kyle    = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
		scanner = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
	};
}