feat: Documents Samba share + WebDAV at docs.zx.dev - #532
Merged
Merged
Conversation
stackptr
force-pushed
the
glyph/samba-documents
branch
from
August 25, 2026 19:00
e0be6c6 to
b9af921
Compare
stackptr
force-pushed
the
glyph/samba-documents
branch
from
August 25, 2026 21:18
44cdcbc to
3ba0a01
Compare
Adds a `partner` system user, a ZFS filesystem at zdata/documents, and a new Documents SMB share owned by that user. The hourly permissions service is updated to keep the mount correctly owned. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Entire-Checkpoint: cfc8816bb650
Serves /mnt/documents over WebDAV via nginx on glyph (port 8185, Tailscale-only), proxied through spore as docs.zx.dev with HTTPS and basic auth. Both Windows and macOS can mount this natively without any client software. Note: hosts/spore/secrets/docs-htpasswd.age must be created with agenix before deploying spore. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Entire-Checkpoint: 1935831ebf09
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Entire-Checkpoint: fd38d04ac1a5
securityType is a NixOS option, not a smb.conf key. The correct key inside settings.global is `security`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Entire-Checkpoint: 8077d9a5bd73
stackptr
force-pushed
the
glyph/samba-documents
branch
from
August 25, 2026 21:40
3ba0a01 to
247cadb
Compare
NixOS nginx service uses ProtectSystem=strict; /mnt/documents must be explicitly listed in ReadWritePaths for MKCOL/PUT to succeed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Entire-Checkpoint: 5559f87c0c42
Finder requires a successful LOCK before allowing write operations. nginx does not implement LOCK/UNLOCK; return minimal valid responses to unblock folder creation and file uploads from macOS clients. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Entire-Checkpoint: 852033c3abec
macOS WebDAVFS checks for DAV: 1, 2 in OPTIONS responses before enabling write operations in Finder. dav_ext_methods only sets DAV: 1; add the level 2 advertisement to match our faked LOCK support. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Entire-Checkpoint: 823a25ea90f9
nginx's dav module rejects MKCOL requests that carry a body, which macOS WebDAVFS sends as extended MKCOL (RFC 5689). Apache mod_dav handles extended MKCOL correctly and has full macOS compatibility. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Entire-Checkpoint: 659245062958
{_} is a single named arg, not a wildcard; NixOS modules need {...}.
Use {lib, ...} to satisfy statix's empty_pattern check.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: fb0c6aa19e44
Finder sends Destination: https://docs.zx.dev/... but Apache on glyph sees itself as http://docs.zx.dev:8185, causing a 502 on MOVE. Rewrite the Destination header to the internal URL before proxying. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Entire-Checkpoint: 31842058822b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DocumentsSamba share on glyph (/mnt/documents,zdata/documentsZFS dataset) owned by a newpartnersystem user — accessible over Tailscale via SMBdocs.zx.dev) proxied through spore with HTTPS + basic auth, so the share is accessible from Windows/macOS without any client softwareChanges
hosts/glyph/default.nix— ZFS filesystem mount forzdata/documents,partnersystem userhosts/glyph/services/samba.nix—Documentsshare withforce user = partner, hourly chownhosts/glyph/services/webdav.nix— nginx WebDAV server on port 8185 (Tailscale-only)hosts/spore/services/web/default.nix—docs.zx.devvhost proxying to glyph with basic authlib/secrets/spore.nix— registersdocs-htpasswd.agefor spore + Rhizome keysDeploy steps
Prerequisites — run from Rhizome (or spore) before deploying:
Create the ZFS dataset on glyph:
Generate an htpasswd entry and encrypt it as an agenix secret:
Set the Samba password for the
partneruser on glyph (used for SMB access over Tailscale):Deploy glyph:
Deploy spore (after the htpasswd secret is committed):
Connecting
WebDAV (no client required — remote or local):
https://docs.zx.dev→ usernamepartnerhttps://docs.zx.dev→ usernamepartnerSMB over Tailscale (if Tailscale is installed):
smb://glyph/Documents\\glyph\Documents🤖 Generated with Claude Code