{
  flake,
  ...
}:
let
  inherit (flake.config.services) instances;
  inherit (flake.config.people) user0;
  service = instances.samba;
  jellyfin = instances.jellyfin;
in
{
  # If you ever need to start fresh, you need to add yourself to the Samba users database:
  # sudo smbpasswd -a username
  services = {
    samba = {
      # package = pkgs.samba4Full;
      enable = true;
      openFirewall = true;
      settings = {
        "storage" = {
          path = "/mnt/storage/${instances.jellyfin.name}/media";
          browseable = "yes";
          writeable = "yes";
          "guest ok" = "no";
          "create mask" = "0664";
          "directory mask" = "0775";
          "force user" = jellyfin.name;
          "force group" = jellyfin.name;
          "force create mode" = "0664";
          "force directory mode" = "0775";
        };
        "transfer" = {
          path = "/mnt/transfer";
          browseable = "yes";
          "read only" = "no";
          "guest ok" = "no";
          "create mask" = "0664";
          "directory mask" = "0775";
          "force user" = user0;
          "force group" = "users";
        };
      };
    };
  };
  systemd.tmpfiles.rules = [
    "d /mnt/transfer 2775 root root -"
  ];
  networking = {
    firewall = {
      allowedTCPPorts = [
        service.ports.port0
      ];
    };
  };
}