#!/bin/bash
set -e
exit 1

# assumes alpine, tested on 3.11
# assumes server ip 192.168.56.175


##
## setup folders to share

mkdir -p /export/rw

# optionally bindmount these to a bigger disk
# (if yes, remember to make this automatic on boot)
mount --bind /mnt/bigdisk/pub /export
mount --bind /mnt/bigdisk/inc /export/rw


##
## optional: restrict permissions for sftp users

cat >>/etc/ssh/sshd_config <<'EOF'
PermitRootLogin no
PasswordAuthentication no
Subsystem sftp internal-sftp

Match group sftpw
	ChrootDirectory /export/rw
	ForceCommand internal-sftp
	PermitTTY no
	GatewayPorts no
	X11Forwarding no
	AllowTcpForwarding no
	AllowStreamLocalForwarding no
	DisableForwarding yes
	AuthorizedKeysFile /root/.ssh/sftp_write

Match group sftpr
	ChrootDirectory /export
	ForceCommand internal-sftp -R
	PermitTTY no
	GatewayPorts no
	X11Forwarding no
	AllowTcpForwarding no
	AllowStreamLocalForwarding no
	DisableForwarding yes
	AuthorizedKeysFile /root/.ssh/sftp_read
EOF


##
## setup samba server
## note: /etc/exports defines the samba shares too, not just NFS

apk add samba
mv -nv /etc/samba/smb.conf{,.alp-stock}
cat >/etc/samba/smb.conf <<'EOF'
[global]
   workgroup = WORKGROUP
   server string = NFS Proxy
   server role = standalone server
   hosts allow = 192.168.56. 127.
   force user = ed
   force group = ed
   log level = 1 auth_audit:3

[nasro]
   comment = NAS RO
   path = /export
   public = yes
   writable = no

[nasrw]
   comment = NAS RW
   path = /export/rw
   public = yes
   writable = yes
EOF

adduser -SDHs /sbin/nologin nfsmb
smbpasswd -a nfsmb
service samba start


##
## setup nfs server

apk add nfs-utils 
mv -nv /etc/exports{,.alp-stock}

# note: 'insecure' allows osx which uses ports >1024
# note: SMB will also share these folders, in addition to those in /etc/samba/smb.conf
#   ...but you may have to add fsid=0 to the toplevel mount to always permit this? TODO
# note: 'crossmnt' allows bind-mounts within the export, but this requires
#   no_subtree_check which disables protection against filehandle attacks
cat >/etc/exports <<'EOF'
/export    192.168.56.0/24(ro,sync,insecure,subtree_check,all_squash,anonuid=1000,anongid=1000)
/export/rw 192.168.56.0/24(rw,sync,insecure,subtree_check,all_squash,anonuid=1000,anongid=1000)
EOF

exportfs -arv
service nfs start


##
## setup webdav share (alternative 1)

apk add lighttpd{,-mod_webdav,-mod_auth}

cat >/dev/shm/lighttpd.webdav.cfg <<'EOF'
server.port = 3179
server.modules = ("mod_webdav", "mod_auth", "mod_authn_file")
server.document-root = "/export"
webdav.activate = "enable"
webdav.is-readonly = "enable"
dir-listing.activate = "enable"
webdav.opts = ("unsafe-propfind-follow-symlink" => "enable")  # requires readonly
auth.backend = "plain"
auth.backend.plain.userfile = "/dev/shm/lighttpd.webdav.auth"
auth.require = ("" => (
  "method" => "basic",
  "realm" => "webdav",
  "require" => "valid-user"
))
EOF

echo nasmb:hunter2 >/dev/shm/lighttpd.webdav.auth

lighttpd -Df /dev/shm/lighttpd.webdav.cfg


##
## setup webdav share (alternative 2)

apk add rclone
rclone serve webdav /export --read-only --addr :3179 --user nasmb --pass hunter2



#######################################################################
#######################################################################
###
###  end of server setup
###
#######################################################################
#######################################################################


## example:
## connect to NFS from a linux client

service nfsmount start
showmount -e 192.168.56.175
mkdir -p /mnt/nas/ro; mount -t nfs4 -o proto=tcp,port=2049 192.168.56.175:/export/ro /mnt/nas/ro
mkdir -p /mnt/nas/rw; mount -t nfs4 -o proto=tcp,port=2049 192.168.56.175:/export/rw /mnt/nas/rw
mount | grep /nas/


## example:
## connect to NFS from a macos client
## -- macos does nfs better than smb (mojibake files go missing on smb)

option 1:
  CMD-K in finder (Go -> Connect to Server...)
  nfs://192.168.56.175/export/ro
  nfs://192.168.56.175/export/rw

  will mount to /Volumes/{ro,rw} as nfs3:
  nfsstat -m

option 2:
  mkdir /Volumes/nas-ro; mount -t nfs -o vers=4,proto=tcp,port=2049 192.168.56.175:/export/ro /Volumes/nas-ro
  mkdir /Volumes/nas-rw; mount -t nfs -o vers=4,proto=tcp,port=2049 192.168.56.175:/export/rw /Volumes/nas-rw


## example:
## connect to SMB from a windows client

win+e » rightclick [This PC] » map network drive
 folder: \\192.168.56.175\nasrw
   user: nfsmb
   pass: hunter2

alternatively, if that fails to prompt for credentials
(including the password is optional, can be left out for security)
  net use k: \\192.168.56.175\nasrw /user:nfsmb hunter2 /persistent:no
  net use k: /del


## example:
## connect to webdav from a linux client
## note: doesn't seem to support random-access; will download full files
## note: windows cannot read files above 4GiB, and also fails to access some folders (mojibake? TODO)

apk add davfs2
echo 'http://192.168.56.175:3179/ nasmb hunter2' >> /etc/davfs2/secrets
mount -t davfs http://192.168.56.175:3179/ /mnt/nas

