nixos-config/modules/system/services/server/fileserver/samba/default.nix

{ config, lib, ... }:
{
  services = lib.mkIf config.system.server.enable {
    samba = {
      enable = true;
      securityType = "user";
      openFirewall = true;
      settings = {
        global = {
          "workgroup" = "WORKGROUP";
          "server string" = "JimSMB";
          "security" = "user";
          "hosts allow" = "${config.ips.localSpan}. 127.0.0.1 localhost";
          "hosts deny" = "0.0.0.0/0";
          "guest account" = "nobody";
          "map to guest" = "bad user";
        };
      };
    };

    # Advertise to Windows
    samba-wsdd = {
      enable = true;
      openFirewall = true;
    };
  };
}