# docker-compose.yml example for https://github.com/ServerContainers/samba

services:
  samba:
    build: .
    image: ghcr.io/servercontainers/samba
    restart: always
    # note that this network_mode makes it super easy (especially for zeroconf) but is not as safe as exposing ports directly
    # more about that here: https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html#hostnetwork
    network_mode: host
    # uncomment to solve bug: https://github.com/ServerContainers/samba/issues/50 - wsdd2 only - not needed for samba
    cap_add:
      - CAP_NET_ADMIN
    environment:
      # uncomment to enable fail fast (currently only fails fast if there are conflicts/errors during user/group creation)
      FAIL_FAST: 1

      #MODEL: 'TimeCapsule'
      #AVAHI_NAME: n100-fileshare

      SAMBA_CONF_LOG_LEVEL: 3

      # uncomment to disable optional services
      #WSDD2_DISABLE: 1
      #AVAHI_DISABLE: 1
      #NETBIOS_DISABLE: 1
      # Avahi Installation on docker host: sudo apt-get install avahi-daemon

      GROUP_family: 1500

      # example for hashed password (user: foo | password: bar) - generated using create-hash.sh script.
      # sudo docker run -ti --rm --entrypoint create-hash.sh ghcr.io/servercontainers/samba

      #ACCOUNT_oster: "oster:1000:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:86C156FC198B358CCCF6278D8BD49B6A:[U          ]:LCT-61B0859A:"
      ACCOUNT_oster: "oster:1000:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:079B8E33CB77467761A3B505A15D8163:[U          ]:LCT-67A885B6:"
      ACCOUNT_karin: "karin:1001:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:580F67E12940BCE800781B09EA453D4D:[U          ]:LCT-67BF7AE3:"
      ACCOUNT_test: "test:1002:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:1910BD9285A6B8C9344D9F5CC74E0878:[U          ]:LCT-68015D9D:"
      # example for password hashes in the list format:
      # - "ACCOUNT_foo=foo:1000:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:8846F7EAEE8FB117AD06BDD830B7586C:[U          ]:LCT-5FE1F7DF:"
      UID_oster: 1000
      UID_karin: 1001
      UID_test: 1002
      GROUPS_oster: family
      GROUPS_karin: family

      SAMBA_VOLUME_CONFIG_oster: "[oster]; path=/shares/oster; valid users = oster; guest ok = no; read only = no; browseable = yes"
      SAMBA_VOLUME_CONFIG_karin: "[karin]; path=/shares/karin; valid users = karin; guest ok = no; read only = no; browseable = yes"
      SAMBA_VOLUME_CONFIG_test: "[test]; path=/shares/test; valid users = test; guest ok = no; read only = no; browseable = yes"
      SAMBA_VOLUME_CONFIG_paperless: "[paperless]; path=/shares/paperless-consume; valid users = oster, karin; guest ok = no; read only = no; browseable = yes"
      SAMBA_VOLUME_CONFIG_public: "[Public]; path=/shares/public; valid users = oster, karin; guest ok = no; read only = no; browseable = yes"
      SAMBA_VOLUME_CONFIG_public_ro: "[Public ReadOnly]; path=/shares/public; guest ok = yes; read only = yes; browseable = yes"
      SAMBA_VOLUME_CONFIG_video_ro: "[Video]; path=/shares/video; valid users = oster, karin; guest ok = no; read only = no; browseable = yes"
      SAMBA_VOLUME_CONFIG_music_ro: "[Music]; path=/shares/music; valid users = oster, karin; guest ok = no; read only = no; browseable = yes"
      SAMBA_VOLUME_CONFIG_ebooks_ro: "[Ebooks]; path=/shares/ebooks; valid users = oster, karin; guest ok = no; read only = no; browseable = yes"
      SAMBA_VOLUME_CONFIG_karinstefan: "[karin stefan]; path=/shares/karin-stefan; valid users = oster, karin, test; guest ok = no; read only = no; browseable = yes"
      #SAMBA_VOLUME_CONFIG_guestmultilineexample: |
      #  [Guest Share]
      #   path = /shares/guest
      #   guest ok = yes
      #   browseable = yes

    volumes:
      - /etc/avahi/services/:/external/avahi

      # avoid loops when mounting folders to /shares (I'd recommend explicit mapping for each share)
      - /media/ssd/public:/shares/public
      - /media/ssd/oster:/shares/oster
      - /media/ssd/karin:/shares/karin
      - /media/ssd/test:/shares/test
      - /media/ssd/karin-stefan:/shares/karin-stefan
      - /media/extension/music:/shares/music
      - /media/extension/video:/shares/video
      - /media/extension/ebooks:/shares/ebooks
      - ./paperless-consume:/shares/paperless-consume