From f42f3e0e08a99e9e25b47223aa5ea1060edab39b Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 18 Jul 2026 11:11:43 +0200 Subject: [PATCH] feat(samba): felhom-samba infra image (R-7 slice 1, Part 0) Own pinned alpine image (3.21@sha256:48b0309c) + smbd/nmbd/wsdd/tini. Dumb by design: smb.conf bind-mounted read-only, no baked name/password, passdb on a volume. Three-daemon stack per the R-6 spike verdict (nmbd required alongside wsdd, else Explorer double-click 0x80070035). build-samba-image.sh helper. --- controller/infra-images/samba/Dockerfile | 27 +++++++++++++++++ controller/infra-images/samba/entrypoint.sh | 33 +++++++++++++++++++++ controller/scripts/build-samba-image.sh | 33 +++++++++++++++++++++ 3 files changed, 93 insertions(+) create mode 100644 controller/infra-images/samba/Dockerfile create mode 100644 controller/infra-images/samba/entrypoint.sh create mode 100644 controller/scripts/build-samba-image.sh diff --git a/controller/infra-images/samba/Dockerfile b/controller/infra-images/samba/Dockerfile new file mode 100644 index 0000000..cfb42f5 --- /dev/null +++ b/controller/infra-images/samba/Dockerfile @@ -0,0 +1,27 @@ +# felhom-samba — the LAN SMB-sharing infra image for felhom-controller (R-7 slice 1). +# +# DUMB BY DESIGN: /etc/samba/smb.conf is bind-mounted READ-ONLY by the controller, which +# owns all rendering. This image templates nothing and bakes NO share name and NO password. +# The three-daemon discovery stack is the spike verdict +# (felhom.eu/documentation/audits/SPIKE-lan-discovery-2026-07-18.md, S4/S4b): +# - smbd : the SMB/CIFS server (445) +# - nmbd : NetBIOS name service — REQUIRED alongside wsdd. wsdd-only makes the box visible +# in Explorer but the double-click fails 0x80070035 (no flat-name resolution); +# nmbd is what makes \\ resolve + mount (S4b, proven live). +# - wsdd : WS-Discovery, so the box appears in Windows Explorer's Network view. +FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d + +# samba = smbd + nmbd + smbpasswd/testparm (meta-package proven installable in the spike); +# wsdd = WS-Discovery daemon; tini = a proper PID1 to reap nmbd/wsdd and forward signals. +RUN apk add --no-cache samba wsdd tini \ + && rm -rf /var/cache/apk/* \ + && rm -f /etc/samba/smb.conf + +# passdb on a named volume → the household SMB password survives container recreation +# (share add/remove re-renders + `compose up -d`, which recreates the container). +VOLUME ["/var/lib/samba"] + +COPY entrypoint.sh /entrypoint.sh +RUN chmod +x /entrypoint.sh + +ENTRYPOINT ["/sbin/tini", "--", "/entrypoint.sh"] diff --git a/controller/infra-images/samba/entrypoint.sh b/controller/infra-images/samba/entrypoint.sh new file mode 100644 index 0000000..0720a06 --- /dev/null +++ b/controller/infra-images/samba/entrypoint.sh @@ -0,0 +1,33 @@ +#!/bin/sh +# felhom-samba entrypoint (R-7 slice 1). A dumb supervisor: smb.conf is bind-mounted +# READ-ONLY by the controller, so nothing here templates config or bakes a secret. It +# only ensures the household unix user exists (uid:gid 1000) and launches the three +# discovery daemons. Verdict source: SPIKE-lan-discovery-2026-07-18 (S4/S4b). +set -e + +FELHOM_UID="${FELHOM_UID:-1000}" +FELHOM_GID="${FELHOM_GID:-1000}" +SERVER_NAME="${FELHOM_SERVER_NAME:-FELHOM}" +IFACE="${FELHOM_IFACE:-eth0}" + +# Household group/user at uid:gid 1000 — files written over SMB then match the app + +# backup ownership convention (smb.conf sets `force user = felhom` per share). +if ! getent group "$FELHOM_GID" >/dev/null 2>&1; then + addgroup -g "$FELHOM_GID" felhom 2>/dev/null || true +fi +GRP_NAME="$(getent group "$FELHOM_GID" 2>/dev/null | cut -d: -f1)" +[ -z "$GRP_NAME" ] && GRP_NAME=felhom +if ! getent passwd "$FELHOM_UID" >/dev/null 2>&1; then + adduser -D -H -u "$FELHOM_UID" -G "$GRP_NAME" -s /sbin/nologin felhom 2>/dev/null || true +fi + +mkdir -p /var/lib/samba/private /run/samba + +echo "[felhom-samba] launching nmbd + wsdd + smbd (server=${SERVER_NAME} iface=${IFACE} uid=${FELHOM_UID})" + +# nmbd: NetBIOS flat-name resolution so \\ resolves and mounts (the S4b fix). +nmbd --daemon --no-process-group +# wsdd: WS-Discovery so the box appears in Windows Explorer's Network view. +wsdd -i "$IFACE" -4 -H 4 -s -n "$SERVER_NAME" -w WORKGROUP & +# smbd in the foreground = the container's main process. +exec smbd --foreground --no-process-group diff --git a/controller/scripts/build-samba-image.sh b/controller/scripts/build-samba-image.sh new file mode 100644 index 0000000..a95bdec --- /dev/null +++ b/controller/scripts/build-samba-image.sh @@ -0,0 +1,33 @@ +#!/usr/bin/env bash +# ============================================================================= +# felhom-samba — infra image build+push helper (R-7 slice 1). +# Run on the build server (192.168.0.180). Mirrors build.sh usage. +# +# ./build-samba-image.sh 1.0.0 # build local only +# ./build-samba-image.sh 1.0.0 --push # build + push to Gitea registry +# +# NEVER tags :latest (a floating tag breaks reproducible pins). The controller pins the +# exact tag in the generated compose. After --push, verify ANONYMOUS pull works (the guest +# pulls infra images without creds — same as the controller self-update path). +# ============================================================================= +set -euo pipefail + +VERSION="${1:?usage: build-samba-image.sh [--push]}" +ACTION="${2:-}" + +REGISTRY="gitea.dooplex.hu/admin" +IMAGE="${REGISTRY}/felhom-samba" +CTX="$(cd "$(dirname "$0")/../infra-images/samba" && pwd)" + +echo "[INFO] building ${IMAGE}:${VERSION}" +echo "[INFO] context: ${CTX}" +docker build -t "${IMAGE}:${VERSION}" "${CTX}" + +if [[ "${ACTION}" == "--push" ]]; then + echo "[INFO] pushing ${IMAGE}:${VERSION}" + docker push "${IMAGE}:${VERSION}" + echo "[INFO] pushed. Verify anonymous pull (guest has no registry creds):" + echo " docker logout ${REGISTRY%%/*} 2>/dev/null; docker pull ${IMAGE}:${VERSION}" +else + echo "[INFO] local build only. To push: ./build-samba-image.sh ${VERSION} --push" +fi