{ pkgs, lib, ... }:
{
  # This is mostly to get smbpasswd
  environment.systemPackages = [ pkgs.samba ];

  services.samba-wsdd = {
    enable = true;
    openFirewall = true;
  };

  services.samba = {
    enable = true;
    openFirewall = true;
    securityType = "user";
    extraConfig = ''
      workgroup = beatific
      server string = backyard smb server
      netbios name = backyard
      deadtime = 300

      local master = yes
      domain master = yes
      preferred master = yes

      guest account = nobody
      map to guest = bad user

      case sensitive = yes
      veto files = /^.DS_Store$/^.Trash-1000$/

      load printers = no
      printcap name = /dev/null
      printing = bsd

      log file = /var/log/samba/client-%m.log
      log level = 2
      max log size = 64

      hide dot files = no
      hosts allow = 10.22.20., 192.168.1.
      map archive = no
      # this must be set to false to make symlinks outside /home work
      # could potentially be fixed by mounting pool to /home, bind mounting to /pool, and setting both nofail
      unix extensions = no

      ntlm auth = yes
    '';
    shares = let
      homeShare = user: {
        path = "/home/${user}";
        comment = "${user}'s home folder";
        browseable = "yes";
        "read only" = "no";
        "guest okay" = "no";
        "create mask" = "0640";
        "force create mode" = "0640";
        "directory mask" = "0750";
        "force directory mode" = "0750";
        "valid users" = "${user}";
        "follow symlinks" = "yes";
        "wide links" = "yes";
      };
    in {
      tvb = homeShare "tvb";
    };
  };
}