This repository has no description
yellow: add ksmbd
author
Jörg Thalheim
committer
lassulus
date
(Nov 8, 2023, 8:01 PM CET)
commit
32455e5a
32455e5ade5ea75579cd626b9720152add856962
parent
248adbef
248adbef20bc67e6632c7a878ccced41d6cccd69
+122
-59
+1
3modules/default.nix
+1
3modules/default.nix
+113
3modules/ksmbd.nix
+113
3modules/ksmbd.nix
···
1
+
{ config, pkgs, lib, ... }:
2
+
3
+
let
4
+
cfg = config.services.ksmbd;
5
+
6
+
smbToString = x:
7
+
if builtins.typeOf x == "bool"
8
+
then lib.boolToString x
9
+
else toString x;
10
+
11
+
shareConfig = name:
12
+
let share = lib.getAttr name cfg.shares; in
13
+
"[${name}]\n " + (smbToString (
14
+
map
15
+
(key: "${key} = ${smbToString (lib.getAttr key share)}\n")
16
+
(lib.attrNames share)
17
+
));
18
+
in
19
+
{
20
+
options = {
21
+
services.ksmbd = {
22
+
enable = lib.mkEnableOption "Enable cifsd kernel server";
23
+
24
+
openFirewall = lib.mkOption {
25
+
type = lib.types.bool;
26
+
default = false;
27
+
description = lib.mdDoc ''
28
+
Whether to automatically open the necessary ports in the firewall.
29
+
'';
30
+
};
31
+
32
+
securityType = lib.mkOption {
33
+
type = lib.types.str;
34
+
default = "user";
35
+
description = "Samba security type";
36
+
};
37
+
38
+
extraConfig = lib.mkOption {
39
+
type = lib.types.lines;
40
+
default = "";
41
+
description = ''
42
+
Additional global section and extra section lines go in here.
43
+
'';
44
+
example = ''
45
+
guest account = nobody
46
+
map to guest = bad user
47
+
'';
48
+
};
49
+
50
+
shares = lib.mkOption {
51
+
default = { };
52
+
description = ''
53
+
A set describing shared resources.
54
+
See <command>man smb.conf</command> for options.
55
+
'';
56
+
type = lib.types.attrsOf (lib.types.attrsOf lib.types.unspecified);
57
+
example = lib.literalExample ''
58
+
{ public =
59
+
{ path = "/srv/public";
60
+
"read only" = true;
61
+
browseable = "yes";
62
+
"guest ok" = "yes";
63
+
comment = "Public samba share.";
64
+
};
65
+
}
66
+
'';
67
+
};
68
+
69
+
users = lib.mkOption {
70
+
default = [ ];
71
+
type = lib.types.listOf (lib.types.submodule {
72
+
options = {
73
+
user = lib.mkOption {
74
+
type = lib.types.str;
75
+
};
76
+
passwordFile = lib.mkOption {
77
+
type = lib.types.path;
78
+
};
79
+
};
80
+
});
81
+
};
82
+
};
83
+
};
84
+
config = lib.mkIf cfg.enable {
85
+
boot.kernelModules = [ "ksmbd" ];
86
+
environment.systemPackages = [ pkgs.ksmbd-tools ];
87
+
88
+
environment.etc."ksmbd/ksmbd.conf".text = ''
89
+
[global]
90
+
security = ${cfg.securityType}
91
+
${cfg.extraConfig}
92
+
93
+
${smbToString (map shareConfig (lib.attrNames cfg.shares))}
94
+
'';
95
+
96
+
systemd.services.ksmbd = {
97
+
wantedBy = [ "multi-user.target" ];
98
+
after = [ "network.target" ];
99
+
path = [ pkgs.ksmbd-tools ];
100
+
preStart = builtins.concatStringsSep "\n"
101
+
(map (it: "ksmbd.adduser -i /run/ksmbd/passwd -a ${it.user} < ${it.passwordFile}") cfg.users);
102
+
serviceConfig = {
103
+
Type = "forking";
104
+
ExecStart = "${pkgs.ksmbd-tools}/bin/ksmbd.mountd -C /etc/ksmbd/ksmbd.conf -P /run/ksmbd/passwd";
105
+
Restart = "always";
106
+
PrivateTmp = true;
107
+
RuntimeDirectory = "ksmbd";
108
+
};
109
+
};
110
+
111
+
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 445 ];
112
+
};
113
+
}
+8
-59
2configs/services/flix/default.nix
+8
-59
2configs/services/flix/default.nix
···
163
163
};
164
164
};
165
165
166
-
services.samba = {
167
-
enable = true;
168
-
enableNmbd = false;
169
-
extraConfig = ''
170
-
workgroup = WORKGROUP
171
-
server string = ${config.networking.hostName}
172
-
# only allow retiolum addresses
173
-
hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16
174
-
175
-
# Use sendfile() for performance gain
176
-
use sendfile = true
177
-
178
-
# No NetBIOS is needed
179
-
disable netbios = true
180
-
181
-
# Only mangle non-valid NTFS names, don't care about DOS support
182
-
mangled names = illegal
183
-
184
-
# Performance optimizations
185
-
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
186
-
187
-
# Disable all printing
188
-
load printers = false
189
-
disable spoolss = true
190
-
printcap name = /dev/null
191
-
192
-
map to guest = Bad User
193
-
max log size = 50
194
-
dns proxy = no
195
-
security = user
196
-
197
-
[global]
198
-
syslog only = yes
199
-
'';
200
-
shares.public = {
201
-
comment = "Warez";
202
-
path = "/var/download";
203
-
public = "yes";
204
-
"only guest" = "yes";
205
-
"create mask" = "0644";
206
-
"directory mask" = "2777";
207
-
writable = "no";
208
-
printable = "no";
209
-
};
166
+
services.ksmbd.enable = true;
167
+
services.ksmbd.shares.public = {
168
+
path = "/var/download";
169
+
"read only" = true;
170
+
browseable = "yes";
171
+
"guest ok" = "yes";
172
+
comment = "Warez.";
210
173
};
211
174
212
175
systemd.services.bruellwuerfel =
···
248
211
{ predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
249
212
{ predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
250
213
251
-
# smbd
252
-
{ predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
253
-
{ predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; }
254
-
{ predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; }
255
-
{ predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; }
256
-
{ predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; }
257
-
{ predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; }
258
-
{ predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; }
259
-
{ predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; }
260
-
{ predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; }
261
-
{ predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; }
262
-
{ predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; }
263
-
{ predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; }
264
-
{ predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
265
-
{ predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
214
+
{ predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } # ksmb
266
215
];
267
216
};
268
217