This repository has no description
Revert "yellow: add ksmbd"
This reverts commit 32455e5ade5ea75579cd626b9720152add856962.
author
lassulus
date
(Nov 8, 2023, 9:51 PM CET)
commit
bad17409
bad1740920ddaaedf266b228d34906c9dfd16df3
parent
808fe855
808fe855eeae5412c46602912a6c4d526d0d51f5
+59
-122
-1
3modules/default.nix
-1
3modules/default.nix
-113
3modules/ksmbd.nix
-113
3modules/ksmbd.nix
···
1
-
{ config, pkgs, lib, ... }:
2
-
3
-
let
4
-
cfg = config.services.ksmbd;
5
-
6
-
smbToString = x:
7
-
if builtins.typeOf x == "bool"
8
-
then lib.boolToString x
9
-
else toString x;
10
-
11
-
shareConfig = name:
12
-
let share = lib.getAttr name cfg.shares; in
13
-
"[${name}]\n " + (smbToString (
14
-
map
15
-
(key: "${key} = ${smbToString (lib.getAttr key share)}\n")
16
-
(lib.attrNames share)
17
-
));
18
-
in
19
-
{
20
-
options = {
21
-
services.ksmbd = {
22
-
enable = lib.mkEnableOption "Enable cifsd kernel server";
23
-
24
-
openFirewall = lib.mkOption {
25
-
type = lib.types.bool;
26
-
default = false;
27
-
description = lib.mdDoc ''
28
-
Whether to automatically open the necessary ports in the firewall.
29
-
'';
30
-
};
31
-
32
-
securityType = lib.mkOption {
33
-
type = lib.types.str;
34
-
default = "user";
35
-
description = "Samba security type";
36
-
};
37
-
38
-
extraConfig = lib.mkOption {
39
-
type = lib.types.lines;
40
-
default = "";
41
-
description = ''
42
-
Additional global section and extra section lines go in here.
43
-
'';
44
-
example = ''
45
-
guest account = nobody
46
-
map to guest = bad user
47
-
'';
48
-
};
49
-
50
-
shares = lib.mkOption {
51
-
default = { };
52
-
description = ''
53
-
A set describing shared resources.
54
-
See <command>man smb.conf</command> for options.
55
-
'';
56
-
type = lib.types.attrsOf (lib.types.attrsOf lib.types.unspecified);
57
-
example = lib.literalExample ''
58
-
{ public =
59
-
{ path = "/srv/public";
60
-
"read only" = true;
61
-
browseable = "yes";
62
-
"guest ok" = "yes";
63
-
comment = "Public samba share.";
64
-
};
65
-
}
66
-
'';
67
-
};
68
-
69
-
users = lib.mkOption {
70
-
default = [ ];
71
-
type = lib.types.listOf (lib.types.submodule {
72
-
options = {
73
-
user = lib.mkOption {
74
-
type = lib.types.str;
75
-
};
76
-
passwordFile = lib.mkOption {
77
-
type = lib.types.path;
78
-
};
79
-
};
80
-
});
81
-
};
82
-
};
83
-
};
84
-
config = lib.mkIf cfg.enable {
85
-
boot.kernelModules = [ "ksmbd" ];
86
-
environment.systemPackages = [ pkgs.ksmbd-tools ];
87
-
88
-
environment.etc."ksmbd/ksmbd.conf".text = ''
89
-
[global]
90
-
security = ${cfg.securityType}
91
-
${cfg.extraConfig}
92
-
93
-
${smbToString (map shareConfig (lib.attrNames cfg.shares))}
94
-
'';
95
-
96
-
systemd.services.ksmbd = {
97
-
wantedBy = [ "multi-user.target" ];
98
-
after = [ "network.target" ];
99
-
path = [ pkgs.ksmbd-tools ];
100
-
preStart = builtins.concatStringsSep "\n"
101
-
(map (it: "ksmbd.adduser -i /run/ksmbd/passwd -a ${it.user} < ${it.passwordFile}") cfg.users);
102
-
serviceConfig = {
103
-
Type = "forking";
104
-
ExecStart = "${pkgs.ksmbd-tools}/bin/ksmbd.mountd -C /etc/ksmbd/ksmbd.conf -P /run/ksmbd/passwd";
105
-
Restart = "always";
106
-
PrivateTmp = true;
107
-
RuntimeDirectory = "ksmbd";
108
-
};
109
-
};
110
-
111
-
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 445 ];
112
-
};
113
-
}
+59
-8
2configs/services/flix/default.nix
+59
-8
2configs/services/flix/default.nix
···
163
163
};
164
164
};
165
165
166
-
services.ksmbd.enable = true;
167
-
services.ksmbd.shares.public = {
168
-
path = "/var/download";
169
-
"read only" = true;
170
-
browseable = "yes";
171
-
"guest ok" = "yes";
172
-
comment = "Warez.";
166
+
services.samba = {
167
+
enable = true;
168
+
enableNmbd = false;
169
+
extraConfig = ''
170
+
workgroup = WORKGROUP
171
+
server string = ${config.networking.hostName}
172
+
# only allow retiolum addresses
173
+
hosts allow = 42::/16 10.243.0.0/16 10.244.0.0/16
174
+
175
+
# Use sendfile() for performance gain
176
+
use sendfile = true
177
+
178
+
# No NetBIOS is needed
179
+
disable netbios = true
180
+
181
+
# Only mangle non-valid NTFS names, don't care about DOS support
182
+
mangled names = illegal
183
+
184
+
# Performance optimizations
185
+
socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
186
+
187
+
# Disable all printing
188
+
load printers = false
189
+
disable spoolss = true
190
+
printcap name = /dev/null
191
+
192
+
map to guest = Bad User
193
+
max log size = 50
194
+
dns proxy = no
195
+
security = user
196
+
197
+
[global]
198
+
syslog only = yes
199
+
'';
200
+
shares.public = {
201
+
comment = "Warez";
202
+
path = "/var/download";
203
+
public = "yes";
204
+
"only guest" = "yes";
205
+
"create mask" = "0644";
206
+
"directory mask" = "2777";
207
+
writable = "no";
208
+
printable = "no";
209
+
};
173
210
};
174
211
services.ksmbd.extraConfig = ''
175
212
bind interfaces only = yes
···
215
252
{ predicate = "-p tcp --dport 7878"; target = "ACCEPT"; } # radarr
216
253
{ predicate = "-p tcp --dport 6767"; target = "ACCEPT"; } # bazarr
217
254
218
-
{ predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; } # ksmb
255
+
# smbd
256
+
{ predicate = "-i retiolum -p tcp --dport 445"; target = "ACCEPT"; }
257
+
{ predicate = "-i retiolum -p tcp --dport 111"; target = "ACCEPT"; }
258
+
{ predicate = "-i retiolum -p udp --dport 111"; target = "ACCEPT"; }
259
+
{ predicate = "-i retiolum -p tcp --dport 2049"; target = "ACCEPT"; }
260
+
{ predicate = "-i retiolum -p udp --dport 2049"; target = "ACCEPT"; }
261
+
{ predicate = "-i retiolum -p tcp --dport 4000:4002"; target = "ACCEPT"; }
262
+
{ predicate = "-i retiolum -p udp --dport 4000:4002"; target = "ACCEPT"; }
263
+
{ predicate = "-i wiregrill -p tcp --dport 445"; target = "ACCEPT"; }
264
+
{ predicate = "-i wiregrill -p tcp --dport 111"; target = "ACCEPT"; }
265
+
{ predicate = "-i wiregrill -p udp --dport 111"; target = "ACCEPT"; }
266
+
{ predicate = "-i wiregrill -p tcp --dport 2049"; target = "ACCEPT"; }
267
+
{ predicate = "-i wiregrill -p udp --dport 2049"; target = "ACCEPT"; }
268
+
{ predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
269
+
{ predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
219
270
];
220
271
};
221
272