{
  "module": "smb-server",
  "version": "1",
  "upgrade": {
    "policy": "record",
    "why": "the folders the devices on the home network open: a build that breaks Samba's configuration leaves every device's share refused, and the gate on this one machine does not see the devices (hq ADR 0236, ADR 0341)"
  },
  "capabilities": [
    "package-manager",
    "service-manager"
  ],
  "claims": [
    {
      "name": "node-smb-server",
      "scope": "node",
      "serves": [
        "shares",
        "sessions",
        "test",
        "reload",
        "adopt"
      ]
    }
  ],
  "tools": [
    "smb_health"
  ],
  "settings": {
    "shares": {
      "kind": "preference",
      "default": "none",
      "why": "a machine serves no SMB share until its assignment names one: space-separated name=folder, each optionally :ro, one share per folder, every client acting as the folder's owner (hq ADR 0341)"
    },
    "users": {
      "kind": "preference",
      "default": "none",
      "why": "the logins allowed on every share, space-separated; each login's password is the secret smb-password-<login>, and a login already in Samba's database whose secret is not given keeps its password (hq ADR 0341)"
    }
  },
  "own-secrets": {
    "smb-password-*": {
      "path": "${dir:state}/smb-password-*.secret",
      "issued-by": "outside"
    }
  },
  "listens": [
    {
      "name": "smb",
      "port": 445,
      "protocol": "tcp",
      "from": "mesh",
      "fixed": true,
      "why": "SMB 2.1 and later, on 445 alone: NetBIOS is off, so 137, 138 and 139 are never opened. The home server's assignment binds it with the reach local-network (hq ADR 0340, ADR 0341), so the devices on its own network reach it and nothing beyond"
    }
  ],
  "resources": [
    {
      "id": "package",
      "type": "package",
      "package": "samba"
    },
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "place": "."
    },
    {
      "id": "config-dir",
      "type": "directory",
      "path": "/etc/smb-server",
      "mode": "0755"
    },
    {
      "id": "run-dir",
      "type": "directory",
      "path": "/run/smb-server",
      "mode": "0755"
    },
    {
      "id": "lib-dir",
      "type": "directory",
      "path": "/var/lib/smb-server",
      "mode": "0755"
    },
    {
      "id": "adopt-dir",
      "type": "directory",
      "path": "/var/lib/smb-server/adopt",
      "mode": "0755",
      "owner": "${machine:account}"
    },
    {
      "id": "config",
      "type": "file",
      "path": "/etc/smb-server/shares.conf",
      "mode": "0644",
      "content": "# Written by the mesh (module smb-server, novox/hq ADR 0341) from this machine's assignment.\n# Replaced on every push; change the settings, never this file.\n#\n# The shares: name=folder, or name=folder:ro, one share per folder. The users: the logins allowed. The\n# module's process serves each share with every client as the folder's owner, and writes Samba's\n# configuration only once a person adopted it (node-smb-server.adopt).\nshares=${setting:shares}\nusers=${setting:users}\npasswords=${dir:state}\n"
    },
    {
      "id": "server",
      "type": "service",
      "unit": "smb.service",
      "state": "running",
      "boot": "enabled",
      "health": {
        "kind": "unit"
      }
    },
    {
      "id": "config-process",
      "type": "process",
      "name": "smb-server-config",
      "artifact": "tools",
      "run": [
        "./smb-server",
        "config"
      ],
      "health": {
        "kind": "tool",
        "tool": "smb_health",
        "interval": "60s",
        "timeout": "10s",
        "looks": 2,
        "grace": "90s"
      }
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "tools",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/smb-server",
        "binary": "smb-server",
        "loads": [
          "smb-server"
        ]
      }
    ]
  }
}