forked from lukas/nixos-config
94 lines
2.6 KiB
Nix
94 lines
2.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
{
|
|
users.groups.smbwebdav = { };
|
|
|
|
users.users.smbwebdav = {
|
|
isSystemUser = true;
|
|
group = "smbwebdav";
|
|
shell = "${pkgs.shadow}/bin/nologin";
|
|
};
|
|
|
|
users.users.webdav.extraGroups = [ "smbwebdav" ];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/www/webdav 0770 webdav smbwebdav - -"
|
|
];
|
|
|
|
services.webdav = {
|
|
enable = true;
|
|
environmentFile = config.age.secrets.webdav.path;
|
|
settings = {
|
|
address = "0.0.0.0";
|
|
port = 8012;
|
|
scope = "/var/www/webdav";
|
|
modify = true;
|
|
auth = true;
|
|
users = [
|
|
{
|
|
username = "{env}ENV_USERNAME";
|
|
password = "{env}ENV_PASSWORD";
|
|
}
|
|
];
|
|
permissions = "RCUD";
|
|
cors = {
|
|
enabled = true;
|
|
credentials = true;
|
|
allowed_headers = [ "Depth" "Authorization" "Content-Type" "Overwrite" "Destination" ];
|
|
allowed_hosts = [ "https://board.${config.domain}" ];
|
|
allowed_methods = [ "GET" "PUT" "PROPFIND" "OPTIONS" "DELETE" ];
|
|
exposed_headers = [ "Content-Length" "Content-Range" ];
|
|
};
|
|
};
|
|
};
|
|
|
|
services.samba = {
|
|
enable = true;
|
|
settings = {
|
|
global = {
|
|
"server string" = "pinix files";
|
|
"server min protocol" = "SMB3";
|
|
"smb ports" = 445;
|
|
"map to guest" = "never";
|
|
};
|
|
webdav = {
|
|
path = "/var/www/webdav";
|
|
"valid users" = "smbwebdav";
|
|
"read only" = "no";
|
|
"guest ok" = "no";
|
|
"force group" = "smbwebdav";
|
|
"vfs objects" = "streams_xattr";
|
|
"ea support" = "yes";
|
|
"store dos attributes" = "yes";
|
|
"create mask" = "0660";
|
|
"directory mask" = "0770";
|
|
};
|
|
};
|
|
};
|
|
|
|
networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 445 ];
|
|
|
|
systemd.services.samba-smbd = {
|
|
after = [ "tailscaled-autoconnect.service" ];
|
|
wants = [ "tailscaled-autoconnect.service" ];
|
|
};
|
|
|
|
systemd.services.samba-webdav-password = {
|
|
description = "Set the SMB password for the WebDAV share";
|
|
before = [ "samba-smbd.service" ];
|
|
requiredBy = [ "samba-smbd.service" ];
|
|
restartTriggers = [ config.age.secrets.webdav.file ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
set -eu
|
|
password="$(${pkgs.gawk}/bin/awk -F= '$1 == "ENV_PASSWORD" { sub(/^[^=]*=/, ""); print; exit }' ${config.age.secrets.webdav.path})"
|
|
if [ -z "$password" ]; then
|
|
echo "ENV_PASSWORD is missing from the WebDAV secret" >&2
|
|
exit 1
|
|
fi
|
|
printf '%s\n%s\n' "$password" "$password" | ${pkgs.samba}/bin/smbpasswd -a -s smbwebdav
|
|
'';
|
|
};
|
|
}
|