{ ... }:
{
  users.groups.time_machine = {};
  users.users.time_machine = {
    isSystemUser = true;
    group = "time_machine";
  };

  networking.firewall.interfaces.enp90s0.allowedTCPPorts = [ 445 ];
  networking.firewall.interfaces.enp90s0.allowedUDPPorts = [ 445 ];

  services.samba = {
    enable = true;
    settings = {
        global = {
          "workgroup" = "WORKGROUP";
          "server string" = "smbnix";
          "netbios name" = "smbnix";
          "security" = "user";

          # Only available on localhost and lan
          "hosts allow" = "192.168.2.0/24 127.0.0.1 localhost";
          "hosts deny" = "0.0.0.0/0";
          "guest account" = "nobody";
          "map to guest" = "bad user";
        };
      "tm_share" = {
        "path" = "/srv/timemachine";
        "valid users" = "time_machine";
        "public" = "no";
        "writable" = "yes";
        "force user" = "time_machine";
        "fruit:aapl" = "yes";
        "fruit:time machine" = "yes";
        "vfs objects" = "catia fruit streams_xattr";
      };
    };
  };

  services.avahi = {
    enable = true;

    publish.enable = true;
    publish.userServices = true;
    nssmdns4 = true;

      # https://wiki.nixos.org/wiki/Samba#Apple_Time_Machine
      extraServiceFiles = {
        timemachine = ''
          <?xml version="1.0" standalone='no'?>
          <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
          <service-group>
            <name replace-wildcards="yes">%h</name>
            <service>
              <type>_smb._tcp</type>
              <port>445</port>
            </service>
              <service>
              <type>_device-info._tcp</type>
              <port>0</port>
              <txt-record>model=TimeCapsule8,119</txt-record>
            </service>
            <service>
              <type>_adisk._tcp</type>
              <!--
                change tm_share to share name, if you changed it.
              -->
              <txt-record>dk0=adVN=tm_share,adVF=0x82</txt-record>
              <txt-record>sys=waMa=0,adVF=0x100</txt-record>
            </service>
          </service-group>
        '';
      };
    };

  fileSystems."/srv/timemachine" = {
    device = "zpool/backup/timemachine";
    fsType = "zfs";
    options = [ "zfsutil" ];
  };
}