_: {
  users = {
    users = let
      shareUser = {
        isSystemUser = true;
        group = "share";
      };
    in {
      min = shareUser;
      # other ppls
      u2-1 = shareUser;
      u3-1 = shareUser;
    };
    groups."share" = {};
  };

  systemd.tmpfiles.rules = [
    "d /terra/terrarium   0775 root share - -"
    "d /terra/lostlibrary 0775 root share - -"
  ];

  services.samba = {
    enable = true;
    openFirewall = true;

    settings = {
      global = {
        "security" = "user";
        "smb encrypt" = "required";

        "browseable" = true;
        "guest ok" = false;
        "create mask" = "0664";
        "directory mask" = "0775";
      };

      terrarium = {
        "path" = "/terra/terrarium";
        "read only" = false;
        "valid users" = "min";
      };

      lostlibrary = {
        "path" = "/terra/lostlibrary";
        "read only" = false;
        "valid users" = "min u2-1 u3-1";
      };
    };
  };
}