global = {
          interfaces = "lo ${config.xored.ipv6.prefix}:28::${config.xored.hosts.nas.networking.interfaceId}/64 fe80::105f:89ff:fe1f:bc3%thunderbolt0/64";
          "bind interfaces only" = "yes";
          "disable netbios" = "yes";
          "workgroup" = "HOMELAB";
          "server string" = "fs";
          "netbios name" = "fs";
          "security" = "user";
          "guest account" = "nobody";
          "map to guest" = "bad user";
          "acl_xattr:ignore system acls" = "no";
          "acl_xattr:default" = "yes";
          # Enable Windows ACL (acl_xattr) and Mac (catia fruit streams_xattr) support
          "vfs objects" = "acl_xattr catia fruit streams_xattr";
        };
        "tm_share" = {
          "path" = "/tank/backups/tm_share";
          "valid users" = "xored";
          "public" = "no";
          "writeable" = "yes";
          "force user" = "xored";
          "fruit:aapl" = "yes";
          "fruit:time machine" = "yes";
        };
      };

  fileSystems."/timemachine" = {
    device = "data/timemachine";
    fsType = "zfs";
  };

  users.groups.timemachine.members = [ "sam" ];
  
  services.samba = {
    enable = true;
    smbd.enable = true;
    nmbd.enable = false;
    winbindd.enable = false;
    usershares.enable = false;
    nsswins = false;

    settings = {
      global = {
        "vfs objects" = "catia fruit streams_xattr";

        # time machine/apple compatibility options
        "fruit:aapl" = true;
        "fruit:nfs_aces" = false;
        "fruit:copyfile" = false;
        # Run `plutil -p /System/Library/CoreServices/CoreTypes.bundle/Contents/Info.plist` and grep for RackMac3,1
        # Any model like that seems to be valid?
        # Icons in `/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/`
        "fruit:model" = "RackMac3,1";

        # assorted other samba options
        "panic action" = '' ${lib.getExe pkgs.curl} cliff/send -d \"title=Samba crashed\" '';
      };
      timemachine = {
        # time machine/apple compat
        "fruit:resource" = "xattr";
        "fruit:time machine" = true;
        # "fruit:time machine max size" = "10T"; # impacts how many backups are kept (logic on time machine side)
        "fruit:metadata" = "netatalk";
        "fruit:encoding" = "native";

        # samba options
        path = "/timemachine";
        preexec = '' ${lib.getExe pkgs.curl} cliff/send -d \"title=Samba connection initiated\" -d \"body=%u connected to %S from %m (%I)\" '';
        writeable = true;
        "valid users" = "sam";
      };
    };
  };

  services.avahi = {
    enable = true;
    extraServiceFiles.samba = ''
      <?xml version="1.0" standalone='no'?>
      <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
      <service-group>
        <name replace-wildcards="yes">%h</name>
        <service>
          <type>_smb._tcp</type>
          <port>445</port>
        </service>
        <service>
          <type>_device-info._tcp</type>
          <port>0</port>
          <txt-record>model=RackMac3,1</txt-record>
        </service>
        <service>
          <type>_adisk._tcp</type>
          <txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
          <txt-record>sys=waMa=0,adVF=0x100</txt-record>
        </service>
      </service-group>
    '';
  };