rearrange file-server modules

modules/file-server/dufs.nix

@@ -0,0 +1,61 @@
+# NOTE: Authentication file at: `/etc/dufs-auth` with mode 600
+# content: `username:password`
+
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.dufs;
+  authFile = "/etc/dufs-auth";
+in
+{
+  options.services.dufs = {
+    sharedPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "Path to the folder to share via WebDAV. Set to null to disable dufs.";
+      example = "/mnt/storage/shared";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 5099;
+      description = "Port to listen on";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "root";
+      description = "User account under which dufs runs";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "root";
+      description = "Group under which dufs runs";
+    };
+  };
+
+  config = lib.mkIf (cfg.sharedPath != null) {
+    # Install dufs package
+    environment.systemPackages = [ pkgs.dufs ];
+
+    systemd.services.dufs = {
+      description = "Dufs WebDAV File Server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        UMask = "0022";
+        ExecStart = ''/bin/sh -c "${pkgs.dufs}/bin/dufs ${cfg.sharedPath} --port ${toString cfg.port} --bind 0.0.0.0 --allow-all --auth $(cat ${authFile})@/:rw"'';
+        Restart = "on-failure";
+        RestartSec = "10s";
+      };
+    };
+
+    # Open firewall port (optional, since traffic comes through WireGuard)
+    # networking.firewall.allowedTCPPorts = [ cfg.port ];
+  };
+}

modules/file-server/samba.nix

@@ -0,0 +1,68 @@
+# NOTE: Samba user password manually set: `sudo smbpasswd -a ${cfg.user}`
+
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.samba-custom;
+in
+{
+  options.services.samba-custom = {
+    sharedPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "Path to the folder to share via Samba. Set to null to disable Samba sharing.";
+      example = "/mnt/storage/shared";
+    };
+
+    shareName = lib.mkOption {
+      type = lib.types.str;
+      default = "shared";
+      description = "Name of the Samba share as it appears on the network";
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "yanlin";
+      description = "Unix user that owns the shared directory and will be used for Samba authentication";
+    };
+  };
+
+  config = lib.mkIf (cfg.sharedPath != null) {
+    # Enable Samba service
+    services.samba = {
+      enable = true;
+      openFirewall = true;
+
+      settings = {
+        global = {
+          "workgroup" = "WORKGROUP";
+          "server string" = "${config.networking.hostName} Samba Server";
+          "netbios name" = config.networking.hostName;
+          "security" = "user";
+          "guest account" = "nobody";
+          "map to guest" = "bad user";
+
+          # Security enhancements
+          "server min protocol" = "SMB3_00";
+          "smb encrypt" = "desired";
+        };
+
+        "${cfg.shareName}" = {
+          "path" = cfg.sharedPath;
+          "valid users" = cfg.user;
+          "public" = "no";
+          "writeable" = "yes";
+          "force user" = cfg.user;
+          "create mask" = "0644";
+          "directory mask" = "0755";
+        };
+      };
+    };
+
+    # Create directory and set permissions
+    systemd.tmpfiles.rules = [
+      "d ${cfg.sharedPath} 0755 ${cfg.user} users - -"
+    ];
+
+  };
+}