# locker.pet.tuwien.ac.at

# Fileserver Setup Guide

*Updated: 2025-04-28*

---

# 1. System Overview

- **OS:** Debian 12
- **Boot:** UEFI
- **Root Filesystem:** Encrypted with LUKS
- **Data Disks:** Encrypted with LUKS, combined into a ZFS RAIDZ1 pool
- **Remote Unlock:** Early-boot SSH access via Dropbear
- **Additional Service:** Samba fileserver

---

# 2. Partitioning and Encryption

## 2.1 Partition Layout

- `/boot` — Unencrypted ext4 (~1 GiB)
- `crypto_root` — LUKS container for root filesystem
- Additional disks (`/dev/sdX`, `/dev/sdY`, `/dev/sdZ`) — Encrypted individually with LUKS for ZFS

## 2.2 Encrypt Root Partition

```bash
cryptsetup luksFormat /dev/nvme0n1p3
cryptsetup open /dev/nvme0n1p3 cryptroot
mkfs.ext4 /dev/mapper/cryptroot
mount /dev/mapper/cryptroot /mnt
```

Add to `/etc/crypttab`:

```plaintext
sdd3_crypt UUID=9f9cbbf6-7a9a-4385-921a-a19ac82e5e98 none luks,discard
```

Update initramfs:

```bash
update-initramfs -u -k all
```

---

# 3. ZFS on Encrypted Data Disks

## 3.1 Install ZFS

```bash
apt install zfs-dkms zfsutils-linux
```

## 3.2 Encrypt and Open Data Disks

```bash
cryptsetup luksFormat /dev/sdX
cryptsetup open /dev/sdX zfs1_crypt
cryptsetup luksFormat /dev/sdY
cryptsetup open /dev/sdY zfs2_crypt
cryptsetup luksFormat /dev/sdZ
cryptsetup open /dev/sdZ zfs3_crypt
```

## 3.3 Create ZFS Pool

```bash
zpool create data raidz1 /dev/mapper/zfs1_crypt /dev/mapper/zfs2_crypt /dev/mapper/zfs3_crypt
```

Create ZFS datasets:

```bash
zfs create data/fileserver
zfs create -o compression=lz4 data/bup
zfs create data/bup/rsnapshot
zfs create data/bup/dumps
zfs create data/TimeMachineBackup
```

ZFS mounts automatically under `/data`.

## 3.4 Automount Encrypted Disks

Edit `/etc/crypttab`:

```plaintext
zfs1_crypt /dev/disk/by-id/ata-ST31500541AS_9XW03AK8 /root/.luks-keyfile luks
zfs2_crypt /dev/disk/by-id/ata-WDC_WD15EARS-00Z5B1_WD-WMAVU2107321 /root/.luks-keyfile luks
zfs3_crypt /dev/disk/by-id/ata-ST31500541AS_9XW03BPY /root/.luks-keyfile luks```

Update initramfs:

```bash
update-initramfs -u -k all
```

---

# 4. Remote Unlock with Dropbear SSH

## 4.1 Install Dropbear

```bash
apt install dropbear-initramfs
```

## 4.2 Configure Static IP

Edit `/etc/default/grub`:

```plaintext
GRUB_CMDLINE_LINUX="ip=128.130.140.134::128.130.140.129:255.255.255.128:locker:eno1:none"
```


Then update GRUB and initramfs:
```plaintext
update-grub
update-initramfs -u
```

## 4.3 Add SSH Key

```bash
echo 'ssh-ed25519 AAAA...' >> /etc/dropbear/initramfs/authorized_keys
```


## 4.4 Regenerate Initramfs

```bash
update-initramfs -u
```

Now you can SSH into the server during early boot and unlock the encrypted disks manually.

---

# 5. Samba Fileserver Setup

## 5.1 Requirements
- Debian Linux
- ZFS dataset mounted at `/data/fileserver`
- Local Unix users with controlled UID/GID
- Public read-only `software` share
- Private authenticated `files` share
- Only Mac clients connecting

---

## 5.2 Install Samba

```bash
sudo apt update
sudo apt install samba
```

---

## 5.3 Prepare ZFS Folders

```bash
sudo mkdir -p /data/fileserver/software
sudo chmod 755 /data/fileserver/software
sudo chown root:root /data/fileserver/software
```

---

## 5.4 Create Minimal Unix Users with UID/GID

Example for user `fileshareuser`. Use UID and GID from LDAP.

```bash
# Create a group first (if needed)
sudo addgroup --gid 2001 filesharegroup

# Create a system user without home directory, no shell login
sudo adduser --uid 2001 --gid 2001 --disabled-login --no-create-home fileshareuser

# Add Samba password
sudo smbpasswd -a fileshareuser
```

---

## 5.5 Create `/etc/samba/smb.conf`

```bash
sudo nano /etc/samba/smb.conf
```

Paste:

```ini
[global]
   workgroup = PET
   server string = PET Samba Server
   netbios name = PETSERVER
   security = user
   map to guest = Bad User
   smb ports = 445
   dns proxy = no

   # macOS optimization
   vfs objects = catia fruit streams_xattr
   fruit:metadata = stream
   fruit:resource = stream
   fruit:locking = none
   fruit:time machine = no

[files]
   path = /data/fileserver
   browseable = yes
   read only = no
   guest ok = no
   create mask = 0660
   directory mask = 0770

[software]
   path = /data/fileserver/software
   browseable = yes
   read only = yes
   guest ok = yes
   guest only = yes
   force user = nobody
   force group = nogroup
   fruit:resource = file
   fruit:metadata = netatalk
   fruit:model = MacSamba
```

---

## 5.6 Enable and Start Samba Services

```bash
sudo systemctl enable --now smbd
sudo systemctl disable --now nmbd
```

## 5.7 Advertise Server to Mac Clients

Install Avahi for Bonjour broadcasting:

```bash
sudo apt install avahi-daemon
```

Your server will now be visible under `Network` in Mac Finder as `PETSERVER.local`.

Scan from Linux:

```bash
avahi-browse -a
avahi-browse -rt _smb._tcp
```

---

---

# 6. Regular Maintenance

## 6.1 Updates

```bash
apt update
apt upgrade
```

## 6.2 ZFS Monitoring

```bash
zpool status
df -hT /data
zfs list
```

Scrub ZFS pools monthly:

```bash
zpool scrub data
```

## 6.3 Backup Critical Configs

```bash
cp /etc/crypttab /etc/fstab /etc/zfs/zpool.cache /root/
cp /etc/samba/smb.conf /root/smb.conf.backup
```

---

# Notes

- The system boots with encrypted root and encrypted ZFS data volumes.
- Manual passphrase unlock is needed for `/`, then data disks are unlocked using stored secrets.
- Early-boot Dropbear SSH access is available for remote unlocking.
- Samba shares are available under `/data/fileserver` for authenticated users.

---

**End of document**