minime: config time machine

3 files changed, 83 insertions, 1 deletions

diff --git a/hosts/minime/default.nix b/hosts/minime/default.nix
index 6c07f2d..ab8b325 100644
--- a/hosts/minime/default.nix
+++ b/hosts/minime/default.nix
@@ -5,6 +5,7 @@
     ./hardware-configuration.nix
     ./networking
     ./zfs.nix
+    ./timemachine.nix
   ];
 
   sops.defaultSopsFile = ./secrets.yaml;
diff --git a/hosts/minime/timemachine.nix b/hosts/minime/timemachine.nix
new file mode 100644
index 0000000..988b006
--- /dev/null
+++ b/hosts/minime/timemachine.nix
@@ -0,0 +1,81 @@
+{ ... }:
+{
+  users.groups.time_machine = {};
+  users.users.time_machine = {
+    isSystemUser = true;
+    group = "time_machine";
+  };
+
+  networking.firewall.interfaces.enp90s0.allowedTCPPorts = [ 445 ];
+  networking.firewall.interfaces.enp90s0.allowedUDPPorts = [ 445 ];
+
+  services.samba = {
+    enable = true;
+    settings = {
+        global = {
+          "workgroup" = "WORKGROUP";
+          "server string" = "smbnix";
+          "netbios name" = "smbnix";
+          "security" = "user";
+
+          # Only available on localhost and lan
+          "hosts allow" = "192.168.2.0/24 127.0.0.1 localhost";
+          "hosts deny" = "0.0.0.0/0";
+          "guest account" = "nobody";
+          "map to guest" = "bad user";
+        };
+      "tm_share" = {
+        "path" = "/srv/timemachine";
+        "valid users" = "time_machine";
+        "public" = "no";
+        "writable" = "yes";
+        "force user" = "time_machine";
+        "fruit:aapl" = "yes";
+        "fruit:time machine" = "yes";
+        "vfs objects" = "catia fruit streams_xattr";
+      };
+    };
+  };
+
+  services.avahi = {
+    enable = true;
+
+    publish.enable = true;
+    publish.userServices = true;
+    nssmdns4 = true;
+
+      # https://wiki.nixos.org/wiki/Samba#Apple_Time_Machine
+      extraServiceFiles = {
+        timemachine = ''
+          <?xml version="1.0" standalone='no'?>
+          <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
+          <service-group>
+            <name replace-wildcards="yes">%h</name>
+            <service>
+              <type>_smb._tcp</type>
+              <port>445</port>
+            </service>
+              <service>
+              <type>_device-info._tcp</type>
+              <port>0</port>
+              <txt-record>model=TimeCapsule8,119</txt-record>
+            </service>
+            <service>
+              <type>_adisk._tcp</type>
+              <!--
+                change tm_share to share name, if you changed it.
+              -->
+              <txt-record>dk0=adVN=tm_share,adVF=0x82</txt-record>
+              <txt-record>sys=waMa=0,adVF=0x100</txt-record>
+            </service>
+          </service-group>
+        '';
+      };
+    };
+
+  fileSystems."/srv/timemachine" = {
+    device = "zpool/backup/timemachine";
+    fsType = "zfs";
+    options = [ "zfsutil" ];
+  };
+}
diff --git a/hosts/minime/zfs.nix b/hosts/minime/zfs.nix
index 5c779c6..b13098b 100644
--- a/hosts/minime/zfs.nix
+++ b/hosts/minime/zfs.nix
@@ -5,7 +5,6 @@
 {
   services.fstrim.enable = true;
   services.zfs = {
-    autoSnapshot.enable = true;
     trim.enable = true;
     autoScrub = {
       enable = true;
@@ -29,6 +28,7 @@
       hostKeys = [ /etc/secrets/initrd/ssh_host_rsa_key ];
       authorizedKeys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK 0xa@toaster 2024-12-31"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan"
       ];
     };
     postCommands = ''