2009-10-12 18:36:19 +02:00
|
|
|
{ config, pkgs, ... }:
|
2009-03-06 13:26:50 +01:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
with pkgs.lib;
|
2007-05-28 16:09:04 +02:00
|
|
|
|
|
|
|
let
|
2009-04-21 18:30:32 +02:00
|
|
|
|
|
|
|
cfg = config.services.samba;
|
2011-09-14 20:20:50 +02:00
|
|
|
|
2007-06-08 17:41:12 +02:00
|
|
|
user = "smbguest";
|
|
|
|
group = "smbguest";
|
2009-03-29 23:43:40 +02:00
|
|
|
|
2009-04-21 18:30:32 +02:00
|
|
|
logDir = "/var/log/samba";
|
|
|
|
privateDir = "/var/samba/private";
|
2011-09-14 20:20:50 +02:00
|
|
|
|
2009-03-06 13:26:50 +01:00
|
|
|
inherit (pkgs) samba;
|
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
setupScript =
|
|
|
|
''
|
|
|
|
if ! test -d /home/smbd ; then
|
|
|
|
mkdir -p /home/smbd
|
|
|
|
chown ${user} /home/smbd
|
|
|
|
chmod a+rwx /home/smbd
|
|
|
|
fi
|
|
|
|
|
|
|
|
if ! test -d /var/samba ; then
|
|
|
|
mkdir -p /var/samba/locks /var/samba/cores/nmbd /var/samba/cores/smbd /var/samba/cores/winbindd
|
|
|
|
fi
|
|
|
|
|
2012-12-27 00:54:37 +01:00
|
|
|
passwdFile="$(${pkgs.gnused}/bin/sed -n 's/^.*smb[ ]\+passwd[ ]\+file[ ]\+=[ ]\+\(.*\)/\1/p' ${configFile})"
|
2009-10-12 18:36:19 +02:00
|
|
|
if [ -n "$passwdFile" ]; then
|
2012-12-27 00:54:37 +01:00
|
|
|
echo 'INFO: [samba] creating directory containing passwd file'
|
2009-10-12 18:36:19 +02:00
|
|
|
mkdir -p "$(dirname "$passwdFile")"
|
|
|
|
fi
|
|
|
|
|
|
|
|
mkdir -p ${logDir}
|
|
|
|
mkdir -p ${privateDir}
|
|
|
|
'';
|
|
|
|
|
|
|
|
configFile = pkgs.writeText "smb.conf"
|
|
|
|
''
|
|
|
|
[ global ]
|
|
|
|
log file = ${logDir}/log.%m
|
|
|
|
private dir = ${privateDir}
|
|
|
|
${optionalString cfg.syncPasswordsByPam "pam password change = true"}
|
2007-05-28 16:09:04 +02:00
|
|
|
|
2010-03-16 17:34:27 +01:00
|
|
|
${if cfg.defaultShare.enable then ''
|
|
|
|
[default]
|
|
|
|
path = /home/smbd
|
|
|
|
read only = ${if cfg.defaultShare.writeable then "no" else "yes"}
|
|
|
|
guest ok = ${if cfg.defaultShare.guest then "yes" else "no"}
|
|
|
|
''else ""}
|
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
${cfg.extraConfig}
|
|
|
|
'';
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2011-04-13 22:06:29 +02:00
|
|
|
# This may include nss_ldap, needed for samba if it has to use ldap.
|
|
|
|
nssModulesPath = config.system.nssModules.path;
|
|
|
|
|
2012-12-27 00:54:37 +01:00
|
|
|
daemonService = appName: args:
|
|
|
|
{ description = "Samba Service daemon ${appName}";
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2012-12-27 00:54:37 +01:00
|
|
|
wantedBy = [ "samba.target" ];
|
|
|
|
partOf = [ "samba.target" ];
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2011-04-28 10:07:17 +02:00
|
|
|
environment = {
|
|
|
|
LD_LIBRARY_PATH = nssModulesPath;
|
2012-07-16 17:27:59 +02:00
|
|
|
LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
|
2011-04-28 10:07:17 +02:00
|
|
|
};
|
2011-09-14 20:20:50 +02:00
|
|
|
|
2012-12-27 00:54:37 +01:00
|
|
|
serviceConfig = {
|
|
|
|
ExecStart = "${samba}/sbin/${appName} ${args}";
|
|
|
|
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
|
|
|
};
|
2011-04-13 22:06:29 +02:00
|
|
|
|
2012-12-27 00:54:37 +01:00
|
|
|
restartTriggers = [ configFile ];
|
2009-10-12 18:36:19 +02:00
|
|
|
};
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
in
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
{
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
###### interface
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
options = {
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
# !!! clean up the descriptions.
|
2011-09-14 20:20:50 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
services.samba = {
|
|
|
|
|
|
|
|
enable = mkOption {
|
|
|
|
default = false;
|
|
|
|
description = "
|
2010-07-07 14:32:56 +02:00
|
|
|
Whether to enable Samba, which provides file and print
|
|
|
|
services to Windows clients through the SMB/CIFS protocol.
|
2009-10-12 18:36:19 +02:00
|
|
|
";
|
|
|
|
};
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
syncPasswordsByPam = mkOption {
|
|
|
|
default = false;
|
|
|
|
description = "
|
|
|
|
enabling this will add a line directly after pam_unix.so.
|
|
|
|
Whenever a password is changed the samba password will be updated as well.
|
|
|
|
However you still yave to add the samba password once using smbpasswd -a user
|
|
|
|
If you don't want to maintain an extra pwd database you still can send plain text
|
|
|
|
passwords which is not secure.
|
|
|
|
";
|
|
|
|
};
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
extraConfig = mkOption {
|
|
|
|
# !!! Bad default.
|
|
|
|
default = ''
|
|
|
|
# [global] continuing global section here, section is started by nix to set pids etc
|
|
|
|
|
|
|
|
smb passwd file = /etc/samba/passwd
|
|
|
|
|
|
|
|
# is this useful ?
|
|
|
|
domain master = auto
|
|
|
|
|
|
|
|
encrypt passwords = Yes
|
|
|
|
client plaintext auth = No
|
|
|
|
|
|
|
|
# yes: if you use this you probably also want to enable syncPasswordsByPam
|
|
|
|
# no: You can still use the pam password database. However
|
|
|
|
# passwords will be sent plain text on network (discouraged)
|
|
|
|
|
|
|
|
workgroup = Users
|
|
|
|
server string = %h
|
|
|
|
comment = Samba
|
|
|
|
log file = /var/log/samba/log.%m
|
|
|
|
log level = 10
|
|
|
|
max log size = 50000
|
2010-03-16 18:17:37 +01:00
|
|
|
security = ${cfg.securityType}
|
2009-10-12 18:36:19 +02:00
|
|
|
|
|
|
|
client lanman auth = Yes
|
|
|
|
dns proxy = no
|
|
|
|
invalid users = root
|
|
|
|
passdb backend = tdbsam
|
|
|
|
passwd program = /usr/bin/passwd %u
|
|
|
|
'';
|
|
|
|
|
|
|
|
description = "
|
|
|
|
additional global section and extra section lines go in here.
|
|
|
|
";
|
|
|
|
};
|
2009-04-21 18:30:32 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
configFile = mkOption {
|
|
|
|
description = "
|
|
|
|
internal use to pass filepath to samba pam module
|
|
|
|
";
|
|
|
|
};
|
2010-03-16 17:34:27 +01:00
|
|
|
|
|
|
|
defaultShare = {
|
|
|
|
enable = mkOption {
|
2012-11-30 15:07:39 +01:00
|
|
|
description = "Whether to share /home/smbd as 'default'.";
|
|
|
|
default = false;
|
|
|
|
};
|
2010-03-16 17:34:27 +01:00
|
|
|
writeable = mkOption {
|
2012-11-30 15:07:39 +01:00
|
|
|
description = "Whether to allow write access to default share.";
|
|
|
|
default = false;
|
|
|
|
};
|
2010-03-16 17:34:27 +01:00
|
|
|
guest = mkOption {
|
2012-11-30 15:07:39 +01:00
|
|
|
description = "Whether to allow guest access to default share.";
|
|
|
|
default = true;
|
|
|
|
};
|
2010-03-16 17:34:27 +01:00
|
|
|
};
|
|
|
|
|
2010-03-16 18:17:37 +01:00
|
|
|
securityType = mkOption {
|
|
|
|
description = "Samba security type";
|
2012-11-30 15:07:39 +01:00
|
|
|
default = "user";
|
|
|
|
example = "share";
|
2010-03-16 18:17:37 +01:00
|
|
|
};
|
|
|
|
|
2013-08-25 22:12:14 +02:00
|
|
|
nsswins = mkOption {
|
|
|
|
default = false;
|
|
|
|
type = types.uniq types.bool;
|
|
|
|
description = ''
|
|
|
|
Whether to enable the WINS NSS (Name Service Switch) plug-in.
|
|
|
|
Enabling it allows applications to resolve WINS/NetBIOS names (a.k.a.
|
|
|
|
Windows machine names) by transparently querying the winbindd daemon.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2009-04-21 18:30:32 +02:00
|
|
|
};
|
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
};
|
2011-09-14 20:20:50 +02:00
|
|
|
|
2007-05-28 16:09:04 +02:00
|
|
|
|
2009-10-12 18:36:19 +02:00
|
|
|
###### implementation
|
2009-03-06 13:26:50 +01:00
|
|
|
|
2012-11-30 15:07:39 +01:00
|
|
|
config = mkMerge
|
|
|
|
[ { # Always provide a smb.conf to shut up programs like smbclient and smbspool.
|
|
|
|
environment.etc = singleton
|
|
|
|
{ source =
|
|
|
|
if cfg.enable then configFile
|
|
|
|
else pkgs.writeText "smb-dummy.conf" "# Samba is disabled.";
|
|
|
|
target = "samba/smb.conf";
|
|
|
|
};
|
|
|
|
}
|
2007-05-28 16:09:04 +02:00
|
|
|
|
2012-11-30 15:07:39 +01:00
|
|
|
(mkIf config.services.samba.enable {
|
2013-08-23 11:33:24 +02:00
|
|
|
users.extraUsers.smbguest = {
|
|
|
|
description = "Samba service user";
|
|
|
|
group = group;
|
|
|
|
uid = config.ids.uids.smbguest;
|
|
|
|
};
|
2009-03-06 13:26:50 +01:00
|
|
|
|
2013-08-23 11:33:24 +02:00
|
|
|
users.extraGroups.smbguest.gid = config.ids.uids.smbguest;
|
2009-10-12 18:36:19 +02:00
|
|
|
|
2013-08-25 22:12:14 +02:00
|
|
|
system.nssModules = optional cfg.nsswins samba;
|
|
|
|
|
2013-01-16 12:33:18 +01:00
|
|
|
systemd = {
|
2012-12-27 00:54:37 +01:00
|
|
|
targets.samba = {
|
2012-11-30 15:07:39 +01:00
|
|
|
description = "Samba server";
|
2012-12-27 00:54:37 +01:00
|
|
|
requires = [ "samba-setup.service" ];
|
|
|
|
after = [ "samba-setup.service" "network.target" ];
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
2012-11-30 15:07:39 +01:00
|
|
|
};
|
2007-05-28 16:09:04 +02:00
|
|
|
|
2012-12-27 00:54:37 +01:00
|
|
|
services = {
|
|
|
|
"samba-nmbd" = daemonService "nmbd" "-F";
|
|
|
|
"samba-smbd" = daemonService "smbd" "-F";
|
|
|
|
"samba-winbindd" = daemonService "winbindd" "-F";
|
|
|
|
"samba-setup" = {
|
|
|
|
description = "Samba setup task";
|
|
|
|
script = setupScript;
|
|
|
|
unitConfig.RequiresMountsFor = "/home/smbd /var/samba /var/log/samba";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
2007-05-28 16:09:04 +02:00
|
|
|
|
2012-11-30 15:07:39 +01:00
|
|
|
})
|
|
|
|
];
|
2011-09-14 20:20:50 +02:00
|
|
|
|
2007-05-28 16:09:04 +02:00
|
|
|
}
|