blob: 9d68e3d06b013da12f6987675aa8da19dd1e1068 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
{ config, ... }: {
# Configure services
services._fileShares = {
enable = true;
smb.openFirewall = true;
smb.enableUnixPasswordSync = true;
nfs.openFirewall = true;
};
# Configure share groups
users.groups.chexx.gid = 3000;
users.groups.scans.gid = 3003;
# Shares
services._fileShares.shares = {
chexx = {
path = "/Storage/chexx";
smb = {
enable = true;
allowGroup = "chexx";
defaultFileMask = "0664";
defaultDirectoryMask = "0775";
};
nfs.enable = true;
};
scans = {
path = "/Storage/Scans";
smb = {
enable = true;
allowGroup = "scans";
defaultFileMask = "0664";
defaultDirectoryMask = "0775";
};
nfs.enable = true;
};
dacs = {
path = "/Storage/Users/Dacs";
smb = {
enable = true;
allowUser = "dacs";
};
};
tk = {
path = "/home/timmy";
nfs.enable = true;
};
};
# Configure password secrets for users
sops.secrets.smb-initial-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "smb-initial-pass"; };
sops.secrets.user-hashed-pass = { sopsFile = ./resources/secrets/initial-pass.yaml; key = "user-hashed-pass"; };
# Configure users
users.users.timmy.extraGroups = [ "chexx" "scans" ];
users.users.dacs = {
enable = true;
isNormalUser = true;
extraGroups = [ "chexx" "scans" ];
hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
uid = 3001;
};
users.users.kyle = {
enable = true;
isNormalUser = true;
extraGroups = [ "chexx" "scans" ];
hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
uid = 3002;
};
users.users.scanner = {
enable = true;
isSystemUser = true;
group = "scans";
hashedPasswordFile = config.sops.secrets.user-hashed-pass.path;
uid = 3003;
};
# Configure user enrollment for samba
services._fileShares.smb.enrollUsers = {
timmy = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
dacs = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
kyle = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
scanner = { enable = true; passwordFile = config.sops.secrets.smb-initial-pass.path; };
};
}
|
