feat(auth): integrate TinyAuth SSO for NetBox authentication
Deploy TinyAuth v4 as CT 115 (192.168.2.10) to provide centralized SSO authentication for NetBox via Nginx Proxy Manager. **New Infrastructure:** - CT 115: TinyAuth authentication layer - Domain: tinyauth.apophisnetworking.net - Integration: NPM auth_request → TinyAuth → NetBox **Configuration:** - Docker Compose with bcrypt-hashed credentials - NPM advanced config for auth_request integration - HTTPS enforcement via SSL termination **Issues Resolved:** - 500 Internal Server Error (Nginx config syntax) - "IP addresses not allowed" (APP_URL domain requirement) - Port mapping (8000:3000 for internal port 3000) - Invalid password (bcrypt hash requirement for v4) **Documentation:** - Complete TinyAuth README at services/tinyauth/README.md - Updated CLAUDE_STATUS.md with CT 115 infrastructure - Added bug report for scribe agent tool permissions **Note:** Container restart required on CT 115 to apply bcrypt hash 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,348 @@
|
||||
#
|
||||
# Open-iSCSI default configuration.
|
||||
# Could be located at /etc/iscsi/iscsid.conf or ~/.iscsid.conf
|
||||
#
|
||||
# Note: To set any of these values for a specific node/session run
|
||||
# the iscsiadm --mode node --op command for the value. See the README
|
||||
# and man page for iscsiadm for details on the --op command.
|
||||
#
|
||||
|
||||
######################
|
||||
# iscsid daemon config
|
||||
######################
|
||||
#
|
||||
# If you want iscsid to start the first time an iscsi tool
|
||||
# needs to access it, instead of starting it when the init
|
||||
# scripts run, set the iscsid startup command here. This
|
||||
# should normally only need to be done by distro package
|
||||
# maintainers. If you leave the iscsid daemon running all
|
||||
# the time then leave this attribute commented out.
|
||||
#
|
||||
# Default for Fedora and RHEL. Uncomment to activate.
|
||||
# iscsid.startup = /bin/systemctl start iscsid.socket iscsiuio.socket
|
||||
#
|
||||
# Default for Debian and Ubuntu. Uncomment to activate.
|
||||
iscsid.startup = /bin/systemctl start iscsid.socket
|
||||
#
|
||||
# Default if you are not using systemd. Uncomment to activate.
|
||||
# iscsid.startup = /usr/bin/service start iscsid
|
||||
|
||||
# Check for active mounts on devices reachable through a session
|
||||
# and refuse to logout if there are any. Defaults to "No".
|
||||
# iscsid.safe_logout = Yes
|
||||
|
||||
# Only require UID auth for MGMT IPCs, and not username.
|
||||
# Useful if you want to run iscsid in a constrained environment.
|
||||
# Note: Only do this if you are aware of the security implications.
|
||||
# Defaults to "No".
|
||||
# iscsid.ipc_auth_uid = Yes
|
||||
|
||||
#############################
|
||||
# NIC/HBA and driver settings
|
||||
#############################
|
||||
# open-iscsi can create a session and bind it to a NIC/HBA.
|
||||
# To set this up see the example iface config file.
|
||||
|
||||
#*****************
|
||||
# Startup settings
|
||||
#*****************
|
||||
|
||||
# To request that the iscsi service scripts startup a session, use "automatic":
|
||||
# node.startup = automatic
|
||||
#
|
||||
# To manually startup the session, use "manual". The default is manual.
|
||||
node.startup = manual
|
||||
|
||||
# For "automatic" startup nodes, setting this to "Yes" will try logins on each
|
||||
# available iface until one succeeds, and then stop. The default "No" will try
|
||||
# logins on all available ifaces simultaneously.
|
||||
node.leading_login = No
|
||||
|
||||
# *************
|
||||
# CHAP Settings
|
||||
# *************
|
||||
|
||||
# To enable CHAP authentication set node.session.auth.authmethod
|
||||
# to CHAP. The default is None.
|
||||
#node.session.auth.authmethod = CHAP
|
||||
|
||||
# To configure which CHAP algorithms to enable, set
|
||||
# node.session.auth.chap_algs to a comma separated list.
|
||||
# The algorithms should be listed in order of decreasing
|
||||
# preference — in particular, with the most preferred algorithm first.
|
||||
# Valid values are MD5, SHA1, SHA256, and SHA3-256.
|
||||
# The default is MD5.
|
||||
#node.session.auth.chap_algs = SHA3-256,SHA256,SHA1,MD5
|
||||
|
||||
# To set a CHAP username and password for initiator
|
||||
# authentication by the target(s), uncomment the following lines:
|
||||
#node.session.auth.username = username
|
||||
#node.session.auth.password = password
|
||||
|
||||
# To set a CHAP username and password for target(s)
|
||||
# authentication by the initiator, uncomment the following lines:
|
||||
#node.session.auth.username_in = username_in
|
||||
#node.session.auth.password_in = password_in
|
||||
|
||||
# To enable CHAP authentication for a discovery session to the target,
|
||||
# set discovery.sendtargets.auth.authmethod to CHAP. The default is None.
|
||||
#discovery.sendtargets.auth.authmethod = CHAP
|
||||
|
||||
# To set a discovery session CHAP username and password for the initiator
|
||||
# authentication by the target(s), uncomment the following lines:
|
||||
#discovery.sendtargets.auth.username = username
|
||||
#discovery.sendtargets.auth.password = password
|
||||
|
||||
# To set a discovery session CHAP username and password for target(s)
|
||||
# authentication by the initiator, uncomment the following lines:
|
||||
#discovery.sendtargets.auth.username_in = username_in
|
||||
#discovery.sendtargets.auth.password_in = password_in
|
||||
|
||||
# ********
|
||||
# Timeouts
|
||||
# ********
|
||||
#
|
||||
# See the iSCSI README's Advanced Configuration section for tips
|
||||
# on setting timeouts when using multipath or doing root over iSCSI.
|
||||
#
|
||||
# To specify the length of time to wait for session re-establishment
|
||||
# before failing SCSI commands back to the application when running
|
||||
# the Linux SCSI Layer error handler, edit the line.
|
||||
# The value is in seconds and the default is 120 seconds.
|
||||
# Special values:
|
||||
# - If the value is 0, IO will be failed immediately.
|
||||
# - If the value is less than 0, IO will remain queued until the session
|
||||
# is logged back in, or until the user runs the logout command.
|
||||
node.session.timeo.replacement_timeout = 120
|
||||
|
||||
# To specify the time to wait for login to complete, edit the line.
|
||||
# The value is in seconds and the default is 15 seconds.
|
||||
node.conn[0].timeo.login_timeout = 15
|
||||
|
||||
# To specify the time to wait for logout to complete, edit the line.
|
||||
# The value is in seconds and the default is 15 seconds.
|
||||
node.conn[0].timeo.logout_timeout = 15
|
||||
|
||||
# Time interval to wait for on connection before sending a ping.
|
||||
# The value is in seconds and the default is 5 seconds.
|
||||
node.conn[0].timeo.noop_out_interval = 5
|
||||
|
||||
# To specify the time to wait for a Nop-out response before failing
|
||||
# the connection, edit this line. Failing the connection will
|
||||
# cause IO to be failed back to the SCSI layer. If using dm-multipath
|
||||
# this will cause the IO to be failed to the multipath layer.
|
||||
# The value is in seconds and the default is 5 seconds.
|
||||
node.conn[0].timeo.noop_out_timeout = 5
|
||||
|
||||
# To specify the time to wait for an abort response before
|
||||
# failing the operation and trying a logical unit reset, edit the line.
|
||||
# The value is in seconds and the default is 15 seconds.
|
||||
node.session.err_timeo.abort_timeout = 15
|
||||
|
||||
# To specify the time to wait for a logical unit response
|
||||
# before failing the operation and trying session re-establishment,
|
||||
# edit the line.
|
||||
# The value is in seconds and the default is 30 seconds.
|
||||
node.session.err_timeo.lu_reset_timeout = 30
|
||||
|
||||
# To specify the time to wait for a target response
|
||||
# before failing the operation and trying session re-establishment,
|
||||
# edit the line.
|
||||
# The value is in seconds and the default is 30 seconds.
|
||||
node.session.err_timeo.tgt_reset_timeout = 30
|
||||
|
||||
# The value is in seconds and the default is 60 seconds.
|
||||
node.session.err_timeo.host_reset_timeout = 60
|
||||
|
||||
|
||||
#******
|
||||
# Retry
|
||||
#******
|
||||
|
||||
# To specify the number of times iscsid should retry a login
|
||||
# if the login attempt fails due to the node.conn[0].timeo.login_timeout
|
||||
# expiring, modify the following line. Note that if the login fails
|
||||
# quickly (before node.conn[0].timeo.login_timeout fires) because the network
|
||||
# layer or the target returns an error, iscsid may retry the login more than
|
||||
# node.session.initial_login_retry_max times.
|
||||
#
|
||||
# This retry count along with node.conn[0].timeo.login_timeout
|
||||
# determines the maximum amount of time iscsid will try to
|
||||
# establish the initial login. node.session.initial_login_retry_max is
|
||||
# multiplied by the node.conn[0].timeo.login_timeout to determine the
|
||||
# maximum amount.
|
||||
#
|
||||
# The default node.session.initial_login_retry_max is 8 and
|
||||
# node.conn[0].timeo.login_timeout is 15 so we have:
|
||||
#
|
||||
# node.conn[0].timeo.login_timeout * node.session.initial_login_retry_max = 120s
|
||||
#
|
||||
# Valid values are any integer value. This only
|
||||
# affects the initial login. Setting it to a high value can slow
|
||||
# down the iscsi service startup. Setting it to a low value can
|
||||
# cause a session to not get logged into, if there are distuptions
|
||||
# during startup or if the network is not ready at that time.
|
||||
node.session.initial_login_retry_max = 8
|
||||
|
||||
################################
|
||||
# session and device queue depth
|
||||
################################
|
||||
|
||||
# To control how many commands the session will queue, set
|
||||
# node.session.cmds_max to an integer between 2 and 2048 that is also
|
||||
# a power of 2. The default is 128.
|
||||
node.session.cmds_max = 128
|
||||
|
||||
# To control the device's queue depth, set node.session.queue_depth
|
||||
# to a value between 1 and 1024. The default is 32.
|
||||
node.session.queue_depth = 32
|
||||
|
||||
##################################
|
||||
# MISC SYSTEM PERFORMANCE SETTINGS
|
||||
##################################
|
||||
|
||||
# For software iscsi (iscsi_tcp) and iser (ib_iser), each session
|
||||
# has a thread used to transmit or queue data to the hardware. For
|
||||
# cxgb3i, you will get a thread per host.
|
||||
#
|
||||
# Setting the thread's priority to a lower value can lead to higher throughput
|
||||
# and lower latencies. The lowest value is -20. Setting the priority to
|
||||
# a higher value, can lead to reduced IO performance, but if you are seeing
|
||||
# the iscsi or scsi threads dominate the use of the CPU then you may want
|
||||
# to set this value higher.
|
||||
#
|
||||
# Note: For cxgb3i, you must set all sessions to the same value.
|
||||
# Otherwise the behavior is not defined.
|
||||
#
|
||||
# The default value is -20. The setting must be between -20 and 20.
|
||||
node.session.xmit_thread_priority = -20
|
||||
|
||||
|
||||
#***************
|
||||
# iSCSI settings
|
||||
#***************
|
||||
|
||||
# To enable R2T flow control (i.e., the initiator must wait for an R2T
|
||||
# command before sending any data), uncomment the following line:
|
||||
#
|
||||
#node.session.iscsi.InitialR2T = Yes
|
||||
#
|
||||
# To disable R2T flow control (i.e., the initiator has an implied
|
||||
# initial R2T of "FirstBurstLength" at offset 0), uncomment the following line:
|
||||
#
|
||||
# The defaults is No.
|
||||
node.session.iscsi.InitialR2T = No
|
||||
|
||||
#
|
||||
# To disable immediate data (i.e., the initiator does not send
|
||||
# unsolicited data with the iSCSI command PDU), uncomment the following line:
|
||||
#
|
||||
#node.session.iscsi.ImmediateData = No
|
||||
#
|
||||
# To enable immediate data (i.e., the initiator sends unsolicited data
|
||||
# with the iSCSI command packet), uncomment the following line:
|
||||
#
|
||||
# The default is Yes.
|
||||
node.session.iscsi.ImmediateData = Yes
|
||||
|
||||
# To specify the maximum number of unsolicited data bytes the initiator
|
||||
# can send in an iSCSI PDU to a target, edit the following line.
|
||||
#
|
||||
# The value is the number of bytes in the range of 512 to (2^24-1) and
|
||||
# the default is 262144.
|
||||
node.session.iscsi.FirstBurstLength = 262144
|
||||
|
||||
# To specify the maximum SCSI payload that the initiator will negotiate
|
||||
# with the target for, edit the following line.
|
||||
#
|
||||
# The value is the number of bytes in the range of 512 to (2^24-1) and
|
||||
# the defauls it 16776192.
|
||||
node.session.iscsi.MaxBurstLength = 16776192
|
||||
|
||||
# To specify the maximum number of data bytes the initiator can receive
|
||||
# in an iSCSI PDU from a target, edit the following line.
|
||||
#
|
||||
# The value is the number of bytes in the range of 512 to (2^24-1) and
|
||||
# the default is 262144.
|
||||
node.conn[0].iscsi.MaxRecvDataSegmentLength = 262144
|
||||
|
||||
# To specify the maximum number of data bytes the initiator will send
|
||||
# in an iSCSI PDU to the target, edit the following line.
|
||||
#
|
||||
# The value is the number of bytes in the range of 512 to (2^24-1).
|
||||
# Zero is a special case. If set to zero, the initiator will use
|
||||
# the target's MaxRecvDataSegmentLength for the MaxXmitDataSegmentLength.
|
||||
# The default is 0.
|
||||
node.conn[0].iscsi.MaxXmitDataSegmentLength = 0
|
||||
|
||||
# To specify the maximum number of data bytes the initiator can receive
|
||||
# in an iSCSI PDU from a target during a discovery session, edit the
|
||||
# following line.
|
||||
#
|
||||
# The value is the number of bytes in the range of 512 to (2^24-1) and
|
||||
# the default is 32768.
|
||||
discovery.sendtargets.iscsi.MaxRecvDataSegmentLength = 32768
|
||||
|
||||
# To allow the targets to control the setting of the digest checking,
|
||||
# with the initiator requesting a preference of enabling the checking,
|
||||
# uncomment one or both of the following lines:
|
||||
#node.conn[0].iscsi.HeaderDigest = CRC32C,None
|
||||
#node.conn[0].iscsi.DataDigest = CRC32C,None
|
||||
#
|
||||
# To allow the targets to control the setting of the digest checking,
|
||||
# with the initiator requesting a preference of disabling the checking,
|
||||
# uncomment one or both of the following lines:
|
||||
#node.conn[0].iscsi.HeaderDigest = None,CRC32C
|
||||
#node.conn[0].iscsi.DataDigest = None,CRC32C
|
||||
#
|
||||
# To enable CRC32C digest checking for the header and/or data part of
|
||||
# iSCSI PDUs, uncomment one or both of the following lines:
|
||||
#node.conn[0].iscsi.HeaderDigest = CRC32C
|
||||
#node.conn[0].iscsi.DataDigest = CRC32C
|
||||
#
|
||||
# To disable digest checking for the header and/or data part of
|
||||
# iSCSI PDUs, uncomment one or both of the following lines:
|
||||
#node.conn[0].iscsi.HeaderDigest = None
|
||||
#node.conn[0].iscsi.DataDigest = None
|
||||
#
|
||||
# The default is to never use DataDigests or HeaderDigests.
|
||||
#
|
||||
|
||||
# For multipath configurations, you may want more than one session to be
|
||||
# created on each iface record. If node.session.nr_sessions is greater
|
||||
# than 1, performing a 'login' for that node will ensure that the
|
||||
# appropriate number of sessions is created.
|
||||
node.session.nr_sessions = 1
|
||||
|
||||
# When iscsid starts up, it recovers existing sessions (if possible).
|
||||
# If the target for a session has gone away when this occurs, the
|
||||
# iscsid daemon normally tries to reestablish each session,
|
||||
# in succession, in the background, by trying again every two
|
||||
# seconds until all sessions are restored. This configuration
|
||||
# variable can limits the number of retries for each session.
|
||||
# For example, setting reopen_max=150 would mean that each session
|
||||
# recovery was limited to about five minutes.
|
||||
node.session.reopen_max = 0
|
||||
|
||||
#************
|
||||
# Workarounds
|
||||
#************
|
||||
|
||||
# Some targets like IET prefer that an initiator does not respond to PDUs like
|
||||
# R2Ts after it has sent a task management function like an ABORT TASK or a
|
||||
# LOGICAL UNIT RESET. To adopt this behavior, uncomment the following line.
|
||||
# The default is Yes.
|
||||
node.session.iscsi.FastAbort = Yes
|
||||
|
||||
# Some targets like Equalogic prefer that an initiator continue to respond to
|
||||
# R2Ts after it has sent a task management function like an ABORT TASK or a
|
||||
# LOGICAL UNIT RESET. To adopt this behavior, uncomment the following line.
|
||||
# node.session.iscsi.FastAbort = No
|
||||
|
||||
# To prevent doing automatic scans that would add unwanted luns to the system,
|
||||
# we can disable them and have sessions only do manually requested scans.
|
||||
# Automatic scans are performed on startup, on login, and on AEN/AER reception
|
||||
# on devices supporting it. For HW drivers, all sessions will use the value
|
||||
# defined in the configuration file. This configuration option is independent
|
||||
# of the scsi_mod.scan parameter. The default is auto.
|
||||
node.session.scan = auto
|
||||
@@ -0,0 +1,6 @@
|
||||
Name Type Status Total Used Available %
|
||||
PBS-Backups pbs active 1009313392 285348128 672621292 28.27%
|
||||
Vault zfspool active 4546625536 551310364 3995315172 12.13%
|
||||
iso-share nfs active 3220451328 46755840 3173695488 1.45%
|
||||
local dir active 45024148 8604632 34099952 19.11%
|
||||
local-lvm lvmthin active 68988928 6898 68982029 0.01%
|
||||
@@ -0,0 +1,236 @@
|
||||
#
|
||||
# Sample configuration file for the Samba suite for Debian GNU/Linux.
|
||||
#
|
||||
#
|
||||
# This is the main Samba configuration file. You should read the
|
||||
# smb.conf(5) manual page in order to understand the options listed
|
||||
# here. Samba has a huge number of configurable options most of which
|
||||
# are not shown in this example
|
||||
#
|
||||
# Some options that are often worth tuning have been included as
|
||||
# commented-out examples in this file.
|
||||
# - When such options are commented with ";", the proposed setting
|
||||
# differs from the default Samba behaviour
|
||||
# - When commented with "#", the proposed setting is the default
|
||||
# behaviour of Samba but the option is considered important
|
||||
# enough to be mentioned here
|
||||
#
|
||||
# NOTE: Whenever you modify this file you should run the command
|
||||
# "testparm" to check that you have not made any basic syntactic
|
||||
# errors.
|
||||
|
||||
#======================= Global Settings =======================
|
||||
|
||||
[global]
|
||||
|
||||
## Browsing/Identification ###
|
||||
|
||||
# Change this to the workgroup/NT-domain name your Samba server will part of
|
||||
workgroup = WORKGROUP
|
||||
|
||||
#### Networking ####
|
||||
|
||||
# The specific set of interfaces / networks to bind to
|
||||
# This can be either the interface name or an IP address/netmask;
|
||||
# interface names are normally preferred
|
||||
; interfaces = 127.0.0.0/8 eth0
|
||||
|
||||
# Only bind to the named interfaces and/or networks; you must use the
|
||||
# 'interfaces' option above to use this.
|
||||
# It is recommended that you enable this feature if your Samba machine is
|
||||
# not protected by a firewall or is a firewall itself. However, this
|
||||
# option cannot handle dynamic or non-broadcast interfaces correctly.
|
||||
; bind interfaces only = yes
|
||||
|
||||
|
||||
|
||||
#### Debugging/Accounting ####
|
||||
|
||||
# This tells Samba to use a separate log file for each machine
|
||||
# that connects
|
||||
log file = /var/log/samba/log.%m
|
||||
|
||||
# Cap the size of the individual log files (in KiB).
|
||||
max log size = 1000
|
||||
|
||||
# We want Samba to only log to /var/log/samba/log.{smbd,nmbd}.
|
||||
# Append syslog@1 if you want important messages to be sent to syslog too.
|
||||
logging = file
|
||||
|
||||
# Do something sensible when Samba crashes: mail the admin a backtrace
|
||||
panic action = /usr/share/samba/panic-action %d
|
||||
|
||||
|
||||
####### Authentication #######
|
||||
|
||||
# Server role. Defines in which mode Samba will operate. Possible
|
||||
# values are "standalone server", "member server", "classic primary
|
||||
# domain controller", "classic backup domain controller", "active
|
||||
# directory domain controller".
|
||||
#
|
||||
# Most people will want "standalone server" or "member server".
|
||||
# Running as "active directory domain controller" will require first
|
||||
# running "samba-tool domain provision" to wipe databases and create a
|
||||
# new domain.
|
||||
server role = standalone server
|
||||
|
||||
obey pam restrictions = yes
|
||||
|
||||
# This boolean parameter controls whether Samba attempts to sync the Unix
|
||||
# password with the SMB password when the encrypted SMB password in the
|
||||
# passdb is changed.
|
||||
unix password sync = yes
|
||||
|
||||
# For Unix password sync to work on a Debian GNU/Linux system, the following
|
||||
# parameters must be set (thanks to Ian Kahan <<kahan@informatik.tu-muenchen.de> for
|
||||
# sending the correct chat script for the passwd program in Debian Sarge).
|
||||
passwd program = /usr/bin/passwd %u
|
||||
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
|
||||
|
||||
# This boolean controls whether PAM will be used for password changes
|
||||
# when requested by an SMB client instead of the program listed in
|
||||
# 'passwd program'. The default is 'no'.
|
||||
pam password change = yes
|
||||
|
||||
# This option controls how unsuccessful authentication attempts are mapped
|
||||
# to anonymous connections
|
||||
map to guest = bad user
|
||||
|
||||
########## Domains ###########
|
||||
|
||||
#
|
||||
# The following settings only takes effect if 'server role = classic
|
||||
# primary domain controller', 'server role = classic backup domain controller'
|
||||
# or 'domain logons' is set
|
||||
#
|
||||
|
||||
# It specifies the location of the user's
|
||||
# profile directory from the client point of view) The following
|
||||
# required a [profiles] share to be setup on the samba server (see
|
||||
# below)
|
||||
; logon path = \\%N\profiles\%U
|
||||
# Another common choice is storing the profile in the user's home directory
|
||||
# (this is Samba's default)
|
||||
# logon path = \\%N\%U\profile
|
||||
|
||||
# The following setting only takes effect if 'domain logons' is set
|
||||
# It specifies the location of a user's home directory (from the client
|
||||
# point of view)
|
||||
; logon drive = H:
|
||||
# logon home = \\%N\%U
|
||||
|
||||
# The following setting only takes effect if 'domain logons' is set
|
||||
# It specifies the script to run during logon. The script must be stored
|
||||
# in the [netlogon] share
|
||||
# NOTE: Must be store in 'DOS' file format convention
|
||||
; logon script = logon.cmd
|
||||
|
||||
# This allows Unix users to be created on the domain controller via the SAMR
|
||||
# RPC pipe. The example command creates a user account with a disabled Unix
|
||||
# password; please adapt to your needs
|
||||
; add user script = /usr/sbin/useradd --create-home %u
|
||||
|
||||
# This allows machine accounts to be created on the domain controller via the
|
||||
# SAMR RPC pipe.
|
||||
# The following assumes a "machines" group exists on the system
|
||||
; add machine script = /usr/sbin/useradd -g machines -c "%u machine account" -d /var/lib/samba -s /bin/false %u
|
||||
|
||||
# This allows Unix groups to be created on the domain controller via the SAMR
|
||||
# RPC pipe.
|
||||
; add group script = /usr/sbin/addgroup --force-badname %g
|
||||
|
||||
############ Misc ############
|
||||
|
||||
# Using the following line enables you to customise your configuration
|
||||
# on a per machine basis. The %m gets replaced with the netbios name
|
||||
# of the machine that is connecting
|
||||
; include = /home/samba/etc/smb.conf.%m
|
||||
|
||||
# Some defaults for winbind (make sure you're not using the ranges
|
||||
# for something else.)
|
||||
; idmap config * : backend = tdb
|
||||
; idmap config * : range = 3000-7999
|
||||
; idmap config YOURDOMAINHERE : backend = tdb
|
||||
; idmap config YOURDOMAINHERE : range = 100000-999999
|
||||
; template shell = /bin/bash
|
||||
|
||||
# Setup usershare options to enable non-root users to share folders
|
||||
# with the net usershare command.
|
||||
|
||||
# Maximum number of usershare. 0 means that usershare is disabled.
|
||||
# usershare max shares = 100
|
||||
|
||||
# Allow users who've been granted usershare privileges to create
|
||||
# public shares, not just authenticated ones
|
||||
usershare allow guests = yes
|
||||
|
||||
#======================= Share Definitions =======================
|
||||
|
||||
[homes]
|
||||
comment = Home Directories
|
||||
browseable = no
|
||||
|
||||
# By default, the home directories are exported read-only. Change the
|
||||
# next parameter to 'no' if you want to be able to write to them.
|
||||
read only = yes
|
||||
|
||||
# File creation mask is set to 0700 for security reasons. If you want to
|
||||
# create files with group=rw permissions, set next parameter to 0775.
|
||||
create mask = 0700
|
||||
|
||||
# Directory creation mask is set to 0700 for security reasons. If you want to
|
||||
# create dirs. with group=rw permissions, set next parameter to 0775.
|
||||
directory mask = 0700
|
||||
|
||||
# By default, \\server\username shares can be connected to by anyone
|
||||
# with access to the samba server.
|
||||
# The following parameter makes sure that only "username" can connect
|
||||
# to \\server\username
|
||||
# This might need tweaking when using external authentication schemes
|
||||
valid users = %S
|
||||
|
||||
# Un-comment the following and create the netlogon directory for Domain Logons
|
||||
# (you need to configure Samba to act as a domain controller too.)
|
||||
;[netlogon]
|
||||
; comment = Network Logon Service
|
||||
; path = /home/samba/netlogon
|
||||
; guest ok = yes
|
||||
; read only = yes
|
||||
|
||||
# Un-comment the following and create the profiles directory to store
|
||||
# users profiles (see the "logon path" option above)
|
||||
# (you need to configure Samba to act as a domain controller too.)
|
||||
# The path below should be writable by all users so that their
|
||||
# profile directory may be created the first time they log on
|
||||
;[profiles]
|
||||
; comment = Users profiles
|
||||
; path = /home/samba/profiles
|
||||
; guest ok = no
|
||||
; browseable = no
|
||||
; create mask = 0600
|
||||
; directory mask = 0700
|
||||
|
||||
[printers]
|
||||
comment = All Printers
|
||||
browseable = no
|
||||
path = /var/tmp
|
||||
printable = yes
|
||||
guest ok = no
|
||||
read only = yes
|
||||
create mask = 0700
|
||||
|
||||
# Windows clients look for this share name as a source of downloadable
|
||||
# printer drivers
|
||||
[print$]
|
||||
comment = Printer Drivers
|
||||
path = /var/lib/samba/printers
|
||||
browseable = yes
|
||||
read only = yes
|
||||
guest ok = no
|
||||
# Uncomment to allow remote administration of Windows print drivers.
|
||||
# You may need to replace 'lpadmin' with the name of the group your
|
||||
# admin users are members of.
|
||||
# Please note that you also need to set appropriate Unix permissions
|
||||
# to the drivers directory for these users to have write rights in it
|
||||
; write list = root, @lpadmin
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
NAME USED AVAIL REFER MOUNTPOINT
|
||||
Vault 526G 3.72T 112K /Vault
|
||||
Vault/base-104-disk-0 38.4G 3.75T 5.87G -
|
||||
Vault/base-107-disk-0 56.5G 3.77T 5.69G -
|
||||
Vault/subvol-102-disk-0 721M 1.30G 721M /Vault/subvol-102-disk-0
|
||||
Vault/subvol-103-disk-0 1.68G 2.32G 1.68G /Vault/subvol-103-disk-0
|
||||
Vault/subvol-112-disk-0 535M 2.48G 535M /Vault/subvol-112-disk-0
|
||||
Vault/subvol-113-disk-0 2.17G 17.9G 2.14G /Vault/subvol-113-disk-0
|
||||
Vault/vm-100-disk-0 102G 3.79T 33.2G -
|
||||
Vault/vm-101-cloudinit 6M 3.72T 72K -
|
||||
Vault/vm-101-disk-0 9.15G 3.72T 12.2G -
|
||||
Vault/vm-105-disk-0 32.5G 3.74T 16.3G -
|
||||
Vault/vm-106-disk-0 32.5G 3.74T 11.3G -
|
||||
Vault/vm-107-cloudinit 6M 3.72T 72K -
|
||||
Vault/vm-108-disk-0 102G 3.81T 14.0G -
|
||||
Vault/vm-109-disk-0 32.5G 3.75T 235M -
|
||||
Vault/vm-110-disk-0 32.5G 3.75T 4.32G -
|
||||
Vault/vm-111-disk-0 32.5G 3.75T 4.54G -
|
||||
Vault/vm-114-disk-0 50.8G 3.77T 4.24G -
|
||||
Vault/vm-114-disk-1 3M 3.72T 72K -
|
||||
@@ -0,0 +1,2 @@
|
||||
NAME SIZE ALLOC FREE CKPOINT EXPANDSZ FRAG CAP DEDUP HEALTH ALTROOT
|
||||
Vault 4.36T 114G 4.25T - - 8% 2% 1.00x ONLINE -
|
||||
@@ -0,0 +1,10 @@
|
||||
pool: Vault
|
||||
state: ONLINE
|
||||
scan: scrub repaired 0B in 00:09:21 with 0 errors on Sun Nov 9 00:33:22 2025
|
||||
config:
|
||||
|
||||
NAME STATE READ WRITE CKSUM
|
||||
Vault ONLINE 0 0 0
|
||||
scsi-3600508e00000000012df59c25c59f20a ONLINE 0 0 0
|
||||
|
||||
errors: No known data errors
|
||||
Reference in New Issue
Block a user