{config, pkgs, ...} : {
  services = {
    samba = {
      enable = true;
      package = pkgs.samba4Full;
      openFirewall = true;

      settings = {
        global = {
          "server smb encrypt" = "required";
          "server min protocol" = "SMB3_00";
          "workgroup" = "WORKGROUP";
          "security" = "user";
          "browseable" = "yes";
        };

        # "private-shatteredmint" = {
        #   "path" = "/srv/shatteredmint";
        #   "writable" = "yes";
        #   "comment" = "private share for shatteredmint";
        #   "browseable" = "yes";
        # };
        "homes" = {
          "path" = "/srv/private/%S";
          "writable" = "yes";
          "comment" = "homes share";
          "browseable" = "no";
        };
      };
    };
    samba-wsdd = {
      enable = true;
      openFirewall = true;
    };
  };
}