add samba SMB share container on macvlan network

- New dperson/samba service at 192.168.1.247 via macvlan_lan network
- Avoids port 445 conflict with existing timemachine container
- Shares /home/padriano/share as authenticated [Share] over SMB2/3
- Avahi service file for Finder sidebar discovery

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -14,3 +14,8 @@ TM_GROUPNAME=timemachine
 TM_USERNAME=timemachine
 TIMEMACHINE_PASSWORD=replace-with-your-timemachine-password
 TIMEMACHINE_VOLUME_LIMIT=500G
+
+SAMBA_UID=1000
+SAMBA_GID=1000
+SAMBA_USERNAME=samba
+SAMBA_PASSWORD=replace-with-your-samba-password

README.md

@@ -7,6 +7,7 @@
 | `duckdns` | `lscr.io/linuxserver/duckdns` | Dynamic DNS — keeps `*.duckdns.org` pointed at the home IP |
 | `homeassistant` | `homeassistant/home-assistant` | Home automation, reachable at `:8123` |
 | `timemachine` | `mbentley/timemachine:smb` | Time Machine backup server over SMB |
+| `samba` | `dperson/samba` | General SMB file share for Mac and Linux clients |
 | `forgejo` | `codeberg.org/forgejo/forgejo` | Self-hosted Git server, web UI at `:3000`, SSH at `:2222` |
 
 ## Initial Setup
@@ -18,10 +19,11 @@
    nano .env
    ```
 
-2. Create the Forgejo data directory if it doesn't exist:
+2. Create the required host directories if they don't exist:
 
    ```bash
    mkdir -p /home/padriano/projects/forgejo
+   mkdir -p /home/padriano/share
    ```
 
 3. Bring the full stack up:
@@ -123,6 +125,16 @@ docker inspect forgejo
 - Uses `network_mode: host` and a fixed `hostname: timemachine` — the stable hostname prevents macOS from losing the backup destination after container restarts
 - On your Mac: **System Settings → General → Time Machine → Add Backup Disk**
 
+### samba
+
+- Shared directory on the host: `/home/padriano/share`
+- Uses a macvlan network with static IP `192.168.1.247` — avoids port 445 conflict with the `timemachine` container
+- Config stored at `samba/smb.conf`; the `[Share]` section is the only exported share
+- Avahi service file at `samba/avahi-smb.service` advertises the share for Finder sidebar discovery (installed to `/etc/avahi/services/samba.service` on the host)
+- **Connecting from a Mac**: open Finder → Go → Connect to Server → `smb://192.168.1.247/Share`
+- **Connecting from Linux**: `smbclient //192.168.1.247/Share -U samba` or mount with `mount -t cifs //192.168.1.247/Share /mnt/share -o username=samba`
+- Username and password are set via `SAMBA_USERNAME` / `SAMBA_PASSWORD` in `.env`
+
 ### forgejo
 
 - All data (repos, config, SQLite DB) stored at `/home/padriano/projects/forgejo`
@@ -185,4 +197,5 @@ du -sh /home/padriano/projects/* /home/padriano/backup/*
 | `duckdns` | `/home/padriano/projects/duckdns/config` | Token cache, not critical |
 | `homeassistant` | `/home/padriano/projects/ha/config` | All HA config and automations |
 | `timemachine` | `/home/padriano/backup/timemachine` | Mac backup sparsebundles |
+| `samba` | `/home/padriano/share` | General file share — back up as needed |
 | `forgejo` | `/home/padriano/projects/forgejo` | All repos, DB, config |

docker-compose.yml

@@ -48,6 +48,24 @@ services:
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
 
+  samba:
+    image: dperson/samba:latest
+    container_name: samba
+    hostname: samba
+    restart: unless-stopped
+    networks:
+      macvlan_lan:
+        ipv4_address: 192.168.1.247
+    environment:
+      - USERID=${SAMBA_UID}
+      - GROUPID=${SAMBA_GID}
+      - TZ=${TZ}
+    command: >
+      -u "${SAMBA_USERNAME};${SAMBA_PASSWORD}"
+    volumes:
+      - /home/padriano/share:/share
+      - /home/padriano/projects/composer/samba/smb.conf:/etc/samba/smb.conf:ro
+
   timemachine:
     image: mbentley/timemachine:smb-20260503
     container_name: timemachine
@@ -73,3 +91,7 @@ services:
       - /home/padriano/backup/timemachine:/opt/timemachine
       - /home/padriano/projects/composer/timemachine/avahi-daemon.conf:/etc/avahi/avahi-daemon.conf:ro
       - /home/padriano/projects/composer/timemachine/smb.conf:/etc/samba/smb.conf:ro
+
+networks:
+  macvlan_lan:
+    external: true

samba/avahi-smb.service

@@ -0,0 +1,14 @@
+<?xml version="1.0" standalone='no'?>
+<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
+<service-group>
+  <name replace-wildcards="yes">samba</name>
+  <service>
+    <type>_smb._tcp</type>
+    <port>445</port>
+  </service>
+  <service>
+    <type>_device-info._tcp</type>
+    <port>0</port>
+    <txt-record>model=RackMac</txt-record>
+  </service>
+</service-group>

samba/smb.conf

@@ -0,0 +1,47 @@
+[global]
+  workgroup = WORKGROUP
+  server role = standalone server
+  security = user
+  ntlm auth = no
+
+  server min protocol = SMB2_10
+  server max protocol = SMB3
+
+  server signing = auto
+  smb encrypt = desired
+
+  load printers = no
+  printing = bsd
+  printcap name = /dev/null
+  disable spoolss = yes
+  show add printer wizard = no
+
+  logging = file
+  log file = /var/log/samba/log.%m
+  max log size = 1000
+  log level = 1 auth:3 vfs:1
+
+  smb ports = 445
+
+  vfs objects = catia fruit streams_xattr
+
+  fruit:aapl = yes
+  fruit:nfs_aces = no
+  fruit:copyfile = no
+  fruit:metadata = stream
+  fruit:veto_appledouble = no
+  fruit:posix_rename = yes
+  fruit:zero_file_id = yes
+  fruit:wipe_intentionally_left_blank_rfork = yes
+  fruit:delete_empty_adfiles = yes
+
+  spotlight backend = noindex
+
+[Share]
+  path = /share
+  browseable = yes
+  read only = no
+  create mask = 0664
+  directory mask = 0775
+  inherit permissions = no
+  valid users = samba