{...}: {
  users = {
    users.min = {
      isSystemUser = true;
      group = "samba";
    };
    groups."samba" = {};
  };

  services.samba = {
    enable = true;
    openFirewall = true;

    securityType = "user";

    extraConfig = ''
      browseable = yes
      smb encrypt = required

      valid users = @samba
    '';

    shares = {
      terra = {
        "path" = "/terra";
        "browseable" = "yes";
        "read only" = "no";
        "guest ok" = "no";
        "create mask" = "0644";
        "directory mask" = "0755";
      };
    };
  };
}