AZ-NIX-CLIENTS/roles/thin-client/peripherals/smb-mounts.nix

# roles/thin-client/peripherals/smb-mounts.nix
#
# pam_mount: Windows shares auto-mount at login via Kerberos.
# Q9 decisions: pam_mount, Per-User + Common Shares via DFS-Namespace,
# Lax (mount failure doesn't block login).
#
# Kerberos semantics:
#   sec=krb5i    integrity-protected Kerberos auth
#   multiuser    each user gets own mount credentials (no shared session)
#   cruid=%(USER) the credential user (pam_mount templates it)
#   nodepray     don't attempt password-based retry
#
# Mounts under /mnt/az-dfs/<share>; KDE desktop shows symlinks.
{config, lib, pkgs, ...}: let
  inherit (lib) mkIf mkOption types;
  cfg = config.az.tc;
in {
  options.az.tc.smb = {
    dfsNamespace = mkOption {
      type = types.str;
      default = "\\\\az-group.local\\dfs"; # TODO: confirm
      description = ''
        DFS namespace root that all share paths are relative to.
        Example: \\az-group.local\dfs
      '';
    };

    userShare = mkOption {
      type = types.str;
      default = "users/%u";
      description = ''
        Per-user share path relative to the DFS namespace. %u is
        expanded to the username by pam_mount.
      '';
    };

    commonShares = mkOption {
      type = types.listOf types.str;
      default = ["public" "software"];
      description = ''
        Common shares (relative to DFS namespace) that every user gets
        mounted at login.
      '';
    };

    mountRoot = mkOption {
      type = types.str;
      default = "/mnt/az-dfs";
      description = ''
        Local mount root. Shares appear under this path as
        <mountRoot>/<share-name>. User's personal share appears as
        <mountRoot>/home.
      '';
    };
  };

  config = mkIf cfg.enable {
    environment.systemPackages = with pkgs; [
      cifs-utils
      pam_mount
    ];

    # pam_mount config — appended to /etc/pam_mount.conf.xml via the
    # NixOS pam_mount module.
    security.pam.mount = {
      enable = true;
      extraVolumes = let
        dfs = config.az.tc.smb.dfsNamespace;
        mnt = config.az.tc.smb.mountRoot;
        # Per-user share
        userVolume = ''
          <volume
            fstype="cifs"
            server="${dfs}"
            path="${config.az.tc.smb.userShare}"
            mountpoint="${mnt}/home"
            options="sec=krb5i,cruid=%(USER),uid=%(USER),gid=%(USER),multiuser,nodev,nosuid,mfsymlinks"
            user="*"
          />
        '';
        # Common shares
        commonVolumes = builtins.map (share: ''
          <volume
            fstype="cifs"
            server="${dfs}"
            path="${share}"
            mountpoint="${mnt}/${share}"
            options="sec=krb5i,cruid=%(USER),uid=%(USER),gid=%(USER),multiuser,nodev,nosuid,ro,mfsymlinks"
            user="*"
          />
        '') config.az.tc.smb.commonShares;
      in
        lib.concatStringsSep "\n" ([userVolume] ++ commonVolumes);

      # Don't kill session if a mount fails — Q9 "lax" decision.
      # pam_mount has built-in "lax" semantics via the `<luserconf>` and
      # `<mkmountpoint enable="...">` directives; per-mount `sgrp` filters
      # ensure missing shares don't abort PAM login.
      # The NixOS module doesn't expose these as top-level options, so we
      # rely on the default behavior: failed mounts log warnings, login
      # continues.
    };

    # Ensure mount directories exist (created per-user at first login).
    systemd.tmpfiles.rules = [
      "d ${config.az.tc.smb.mountRoot} 0755 root root -"
    ];

    # Create /etc/krb5.keytab is owned by root and readable to pam_mount
    # (which runs as root during PAM).
    # (No additional setup needed — pam_mount reads the user's TGT, not
    # the machine keytab.)
  };
}