From 1810d60d213f419a4499692fb9ac5868cf2f8837 Mon Sep 17 00:00:00 2001 From: marc Date: Sat, 20 Jun 2026 01:00:02 +0200 Subject: [PATCH] Document SMB/NFS share settings in README Explains valid users, folder permissions, force user/group, guest ok, no_root_squash, all_squash with use cases and recipes Co-Authored-By: Claude Sonnet 4.6 --- README.md | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/README.md b/README.md index 13259e8..c1bd83b 100644 --- a/README.md +++ b/README.md @@ -90,6 +90,60 @@ All routes require a login session. Go to `http://:5000` — you will be --- +## Share settings reference + +### SMB share settings + +**Valid Users** — who is allowed to connect to the share. Checked by Samba before the OS even looks at folder permissions. Separate multiple entries with a space or comma. Prefix with `@` for a whole group. + +``` +alice bob → only alice and bob can connect +@family → everyone in the 'family' group +alice @family → alice plus everyone in family +``` + +**Folder Permissions (Owner / Group / Mode)** — the actual Linux filesystem permissions on the shared folder. Applied by `chown`/`chmod` on the server. Valid Users controls the door; folder permissions control what's inside. + +| Mode | Meaning | +|------|---------| +| `770` | Owner and group have full read/write. Everyone else: nothing. | +| `750` | Owner: read/write. Group: read-only. Others: nothing. | +| `755` | Owner: read/write. Group + others: read-only. | + +**Force Group** — every file written through this share gets assigned to this group, regardless of who the connecting user is. Solves the mixed-ownership problem on shared folders: Alice writes a file, it belongs to group `family`, Bob (also in `family`) can edit it. + +Typical shared folder recipe: +1. Create group `family` in the Users tab, add all users to it +2. Share: Valid Users → `@family`, Force Group → `family` +3. Folder: Group → `family`, Mode → `770` + +**Force User** — more extreme version: all writes appear as one specific user. Useful when a service (Plex, Jellyfin, etc.) needs to own everything in a media folder. + +**Guest OK** — allows connecting without any username or password. Anyone on the network can access the share. Good for a public read-only share (combine with a `755` folder mode so guests can read but not write). For a writable guest share, set mode `777` — but only do this on a fully trusted LAN. + +--- + +### NFS export settings + +NFS has no username/password concept — access is controlled by IP/hostname only (the Clients field). Once connected, the client's UID/GID is passed to the server and Linux file permissions apply normally. + +**Clients** — who can mount the export. Use an IP, subnet, or `*` for everyone. + +``` +* → anyone +192.168.1.0/24 → one subnet +192.168.1.10 → one specific host +192.168.1.0/24 10.0.0.0/8 → two networks (space-separated) +``` + +**Read only** — mount is read-only for the client, regardless of folder permissions. + +**no_root_squash** — by default, NFS maps root on the client (`uid 0`) to the anonymous `nobody` user on the server (root squashing). This prevents a compromised client from owning all server files as root. `no_root_squash` disables that mapping — root on the client stays root on the server. Useful when you manage both machines and need to run `chown`/`chmod` on mounted shares. + +**all_squash** — maps every client user to the anonymous `nobody` user (or a custom `anonuid`). Nobody can impersonate their UID from the client. Simple for single-user setups where you just want consistent ownership on the server side. + +--- + ## Mounting shares on a Linux client Replace `` with your LXC's IP address throughout.