Role Samba

Role: Samba

Configures Samba file sharing so the NAS storage is accessible from Windows, macOS, and Linux clients on the local network.

What It Does

1. Installs samba, samba-common, cifs-utils, and wsdd-server
2. Starts and enables the smbd service
3. Configures share definitions in /etc/samba/smb.conf
4. Sets Samba user passwords (injected via token replacement)
5. Validates config with testparm after changes

Packages

Package	Purpose
samba	SMB/CIFS file server
samba-common	Common Samba libraries
cifs-utils	CIFS mount utilities
wsdd-server	Web Service Discovery — makes the NAS visible in Windows Network neighbourhood

💡 Without wsdd-server, modern Windows machines won't auto-discover the NAS in File Explorer's Network view (SMBv1 browser service is deprecated).

Shares

Share	Path	Access
config	/config	Read/Write
docker	/docker	Read/Write
storage	/mnt/storage	Read/Write

All shares are accessible by the smb user, whose password is stored in Azure KeyVault and injected at deploy time.

💡 Permissions are intentionally kept simple — a single user with read/write to all shares. The NAS content is general-purpose (media, config, backups) with nothing user-specific that warrants stricter ACLs or RBAC. If that ever changes, per-share access controls can be layered in later.

How Passwords Are Set

Samba maintains its own password database (separate from Linux system passwords). The role uses smbpasswd with expect-style input to set the password non-interactively:

# Password value comes from #{SAMBA_PASSWORD}# token replacement

Handler

After any configuration change, a handler:

1. Restarts smbd.service
2. Runs testparm -s to validate the configuration

🔗 Samba wiki | smb.conf man page | wsdd