From d1a371f48b95140279528c2a2ff619d39c177a7c Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 27 Jan 2016 22:00:50 +0100
Subject: ma 1 omo: add samba share

---
 makefu/1systems/omo.nix | 49 ++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 44 insertions(+), 5 deletions(-)

(limited to 'makefu/1systems')

diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index 552af4e4f..9162f2ed4 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -32,9 +32,35 @@ in {
       ../3modules
     ];
   # services.openssh.allowSFTP = false;
-  krebs.build.host = config.krebs.hosts.omo;
   krebs.build.source.git.nixpkgs.rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
 
+  # samba share /media/crypt1/share
+  users.extraUsers.smbguest = {
+    name = "smbguest";
+    uid = config.ids.uids.smbguest;
+    description = "smb guest user";
+    home = "/var/empty";
+  };
+  services.samba = {
+    enable = true;
+    shares = {
+      winshare = {
+        path = "/media/crypt1/share";
+        "read only" = "no";
+        browseable = "yes";
+        "guest ok" = "yes";
+      };
+    };
+    extraConfig = ''
+      guest account = smbguest
+      map to guest = bad user
+      # disable printing
+      load printers = no
+      printing = bsd
+      printcap name = /dev/null
+      disable spoolss = yes
+    '';
+  };
   # copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
   services.sabnzbd.enable = true;
   systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
@@ -97,9 +123,22 @@ in {
     extraModulePackages = [ ];
   };
 
-  networking.firewall.allowedUDPPorts = [ 655 ];
-  # 8080: sabnzbd
-  networking.firewall.allowedTCPPorts = [ 80 655 8080 ];
+  networking.firewall.allowedUDPPorts = [
+    # tinc
+    655
+    # samba
+    137 138
+  ];
+  networking.firewall.allowedTCPPorts = [
+    # nginx
+    80
+    # tinc
+    655
+    # samba
+    445 139
+    # sabnzbd
+    8080
+  ];
 
   hardware.enableAllFirmware = true;
   hardware.cpu.amd.updateMicrocode = true;
@@ -107,5 +146,5 @@ in {
   zramSwap.enable = true;
   zramSwap.numDevices = 2;
 
-
+  krebs.build.host = config.krebs.hosts.omo;
 }
-- 
cgit v1.2.3


From f6a3c1f3d6b013641b077baf8ddb3a78e75d8b95 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Wed, 27 Jan 2016 22:20:32 +0100
Subject: ma 1 omo: cleanup, fix firewalling

---
 makefu/1systems/omo.nix | 29 +++++++++++------------------
 1 file changed, 11 insertions(+), 18 deletions(-)

(limited to 'makefu/1systems')

diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index 9162f2ed4..19183fea8 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -31,11 +31,19 @@ in {
       ../2configs/nginx/omo-share.nix
       ../3modules
     ];
+  networking.firewall.trustedInterfaces = [ "enp3s0" ];
+  # udp:137 udp:138 tcp:445 tcp:139 - samba, allowed in local net
+  # tcp:80          - nginx for sharing files
+  # tcp:655 udp:655 - tinc
+  # tcp:8080        - sabnzbd
+  networking.firewall.allowedUDPPorts = [ 655 ];
+  networking.firewall.allowedTCPPorts = [ 80 655 8080 ];
+
   # services.openssh.allowSFTP = false;
   krebs.build.source.git.nixpkgs.rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
 
   # samba share /media/crypt1/share
-  users.extraUsers.smbguest = {
+  users.users.smbguest = {
     name = "smbguest";
     uid = config.ids.uids.smbguest;
     description = "smb guest user";
@@ -61,6 +69,7 @@ in {
       disable spoolss = yes
     '';
   };
+
   # copy config from <secrets/sabnzbd.ini> to /var/lib/sabnzbd/
   services.sabnzbd.enable = true;
   systemd.services.sabnzbd.environment.SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
@@ -93,6 +102,7 @@ in {
       ${pkgs.hdparm}/sbin/hdparm -y ${disk}
     '') allDisks);
 
+  # crypto unlocking
   boot = {
     initrd.luks = {
       devices = let
@@ -123,23 +133,6 @@ in {
     extraModulePackages = [ ];
   };
 
-  networking.firewall.allowedUDPPorts = [
-    # tinc
-    655
-    # samba
-    137 138
-  ];
-  networking.firewall.allowedTCPPorts = [
-    # nginx
-    80
-    # tinc
-    655
-    # samba
-    445 139
-    # sabnzbd
-    8080
-  ];
-
   hardware.enableAllFirmware = true;
   hardware.cpu.amd.updateMicrocode = true;
 
-- 
cgit v1.2.3

[cgit] Unable to lock slot /tmp/cgit/04100000.lock: No such file or directory (2)