Document SMB/NFS share settings in README

Explains valid users, folder permissions, force user/group, guest ok,
no_root_squash, all_squash with use cases and recipes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -90,6 +90,60 @@ All routes require a login session. Go to `http://<lxc-ip>:5000` — you will be
 
 ---
 
+## Share settings reference
+
+### SMB share settings
+
+**Valid Users** — who is allowed to connect to the share. Checked by Samba before the OS even looks at folder permissions. Separate multiple entries with a space or comma. Prefix with `@` for a whole group.
+
+```
+alice bob          → only alice and bob can connect
+@family            → everyone in the 'family' group
+alice @family      → alice plus everyone in family
+```
+
+**Folder Permissions (Owner / Group / Mode)** — the actual Linux filesystem permissions on the shared folder. Applied by `chown`/`chmod` on the server. Valid Users controls the door; folder permissions control what's inside.
+
+| Mode | Meaning |
+|------|---------|
+| `770` | Owner and group have full read/write. Everyone else: nothing. |
+| `750` | Owner: read/write. Group: read-only. Others: nothing. |
+| `755` | Owner: read/write. Group + others: read-only. |
+
+**Force Group** — every file written through this share gets assigned to this group, regardless of who the connecting user is. Solves the mixed-ownership problem on shared folders: Alice writes a file, it belongs to group `family`, Bob (also in `family`) can edit it.
+
+Typical shared folder recipe:
+1. Create group `family` in the Users tab, add all users to it
+2. Share: Valid Users → `@family`, Force Group → `family`
+3. Folder: Group → `family`, Mode → `770`
+
+**Force User** — more extreme version: all writes appear as one specific user. Useful when a service (Plex, Jellyfin, etc.) needs to own everything in a media folder.
+
+**Guest OK** — allows connecting without any username or password. Anyone on the network can access the share. Good for a public read-only share (combine with a `755` folder mode so guests can read but not write). For a writable guest share, set mode `777` — but only do this on a fully trusted LAN.
+
+---
+
+### NFS export settings
+
+NFS has no username/password concept — access is controlled by IP/hostname only (the Clients field). Once connected, the client's UID/GID is passed to the server and Linux file permissions apply normally.
+
+**Clients** — who can mount the export. Use an IP, subnet, or `*` for everyone.
+
+```
+*                   → anyone
+192.168.1.0/24      → one subnet
+192.168.1.10        → one specific host
+192.168.1.0/24 10.0.0.0/8   → two networks (space-separated)
+```
+
+**Read only** — mount is read-only for the client, regardless of folder permissions.
+
+**no_root_squash** — by default, NFS maps root on the client (`uid 0`) to the anonymous `nobody` user on the server (root squashing). This prevents a compromised client from owning all server files as root. `no_root_squash` disables that mapping — root on the client stays root on the server. Useful when you manage both machines and need to run `chown`/`chmod` on mounted shares.
+
+**all_squash** — maps every client user to the anonymous `nobody` user (or a custom `anonuid`). Nobody can impersonate their UID from the client. Simple for single-user setups where you just want consistent ownership on the server side.
+
+---
+
 ## Mounting shares on a Linux client
 
 Replace `<nas-ip>` with your LXC's IP address throughout.