_: {
  users = {
    users = let
      shareUser = {
        isSystemUser = true;
        group = "share";
      };
    in {
      min = shareUser;
    };
    groups."share" = {};
  };

  systemd.tmpfiles.rules = [
    "d /terra/terrarium 0775 root share - -"
  ];

  services.samba = {
    enable = true;
    openFirewall = true;

    settings = {
      global = {
        "security" = "user";
        "browseable" = true;
        "smb encrypt" = "required";

        "valid users" = "@share";
      };

      terrarium = {
        "path" = "/terra/terrarium";
        "browseable" = true;
        "read only" = false;
        "guest ok" = false;
        "create mask" = "0664";
        "directory mask" = "0775";
      };
    };
  };
}