jochen
b1f2776693
Paused: the module's manifest test, README and a full merge-check run are still to do; tests pass locally for both modules.
145 lines
3.9 KiB
JSON
145 lines
3.9 KiB
JSON
{
|
|
"module": "smb-server",
|
|
"version": "1",
|
|
"upgrade": {
|
|
"policy": "record",
|
|
"why": "the folders the devices on the home network open: a build that breaks Samba's configuration leaves every device's share refused, and the gate on this one machine does not see the devices (hq ADR 0236, ADR 0341)"
|
|
},
|
|
"capabilities": [
|
|
"package-manager",
|
|
"service-manager"
|
|
],
|
|
"claims": [
|
|
{
|
|
"name": "node-smb-server",
|
|
"scope": "node",
|
|
"serves": [
|
|
"shares",
|
|
"sessions",
|
|
"test",
|
|
"reload",
|
|
"adopt"
|
|
]
|
|
}
|
|
],
|
|
"tools": [
|
|
"smb_health"
|
|
],
|
|
"settings": {
|
|
"shares": {
|
|
"kind": "preference",
|
|
"default": "none",
|
|
"why": "a machine serves no SMB share until its assignment names one: space-separated name=folder, each optionally :ro, one share per folder, every client acting as the folder's owner (hq ADR 0341)"
|
|
},
|
|
"users": {
|
|
"kind": "preference",
|
|
"default": "none",
|
|
"why": "the logins allowed on every share, space-separated; each login's password is the secret smb-password-<login>, and a login already in Samba's database whose secret is not given keeps its password (hq ADR 0341)"
|
|
}
|
|
},
|
|
"own-secrets": {
|
|
"smb-password-*": {
|
|
"path": "${dir:state}/smb-password-*.secret",
|
|
"issued-by": "outside"
|
|
}
|
|
},
|
|
"listens": [
|
|
{
|
|
"name": "smb",
|
|
"port": 445,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"fixed": true,
|
|
"why": "SMB 2.1 and later, on 445 alone: NetBIOS is off, so 137, 138 and 139 are never opened. The home server's assignment binds it with the reach local-network (hq ADR 0340, ADR 0341), so the devices on its own network reach it and nothing beyond"
|
|
}
|
|
],
|
|
"resources": [
|
|
{
|
|
"id": "package",
|
|
"type": "package",
|
|
"package": "samba"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "."
|
|
},
|
|
{
|
|
"id": "config-dir",
|
|
"type": "directory",
|
|
"path": "/etc/smb-server",
|
|
"mode": "0755"
|
|
},
|
|
{
|
|
"id": "run-dir",
|
|
"type": "directory",
|
|
"path": "/run/smb-server",
|
|
"mode": "0755"
|
|
},
|
|
{
|
|
"id": "lib-dir",
|
|
"type": "directory",
|
|
"path": "/var/lib/smb-server",
|
|
"mode": "0755"
|
|
},
|
|
{
|
|
"id": "adopt-dir",
|
|
"type": "directory",
|
|
"path": "/var/lib/smb-server/adopt",
|
|
"mode": "0755",
|
|
"owner": "${machine:account}"
|
|
},
|
|
{
|
|
"id": "config",
|
|
"type": "file",
|
|
"path": "/etc/smb-server/shares.conf",
|
|
"mode": "0644",
|
|
"content": "# Written by the mesh (module smb-server, novox/hq ADR 0341) from this machine's assignment.\n# Replaced on every push; change the settings, never this file.\n#\n# The shares: name=folder, or name=folder:ro, one share per folder. The users: the logins allowed. The\n# module's process serves each share with every client as the folder's owner, and writes Samba's\n# configuration only once a person adopted it (node-smb-server.adopt).\nshares=${setting:shares}\nusers=${setting:users}\npasswords=${dir:state}\n"
|
|
},
|
|
{
|
|
"id": "server",
|
|
"type": "service",
|
|
"unit": "smb.service",
|
|
"state": "running",
|
|
"boot": "enabled",
|
|
"health": {
|
|
"kind": "unit"
|
|
}
|
|
},
|
|
{
|
|
"id": "config-process",
|
|
"type": "process",
|
|
"name": "smb-server-config",
|
|
"artifact": "tools",
|
|
"run": [
|
|
"./smb-server",
|
|
"config"
|
|
],
|
|
"health": {
|
|
"kind": "tool",
|
|
"tool": "smb_health",
|
|
"interval": "60s",
|
|
"timeout": "10s",
|
|
"looks": 2,
|
|
"grace": "90s"
|
|
}
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/smb-server",
|
|
"binary": "smb-server",
|
|
"loads": [
|
|
"smb-server"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|