From bdd2e4e2a5f27be70ffed17a15f2110c73b91047 Mon Sep 17 00:00:00 2001
From: alexz <me@alexzaw.dev>
Date: Sun, 26 Apr 2026 06:03:10 +0000
Subject: [PATCH] nas-samba: fix home dir ownership and permissions for Samba
 access

---
 apps/nas-samba/source/app/server.js | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/apps/nas-samba/source/app/server.js b/apps/nas-samba/source/app/server.js
index 88e6fd4..2c568ff 100644
--- a/apps/nas-samba/source/app/server.js
+++ b/apps/nas-samba/source/app/server.js
@@ -175,7 +175,8 @@ function createSystemUser(username, password) {
   execSync(`id -u "${username}" >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin "${username}"`);
   const homeDir = path.join(HOME_BASE, username);
   fs.mkdirSync(homeDir, { recursive: true });
-  execSync(`chown "${username}":nogroup "${homeDir}"`);
+  execSync(`chown -R "${username}":"${username}" "${homeDir}"`);
+  execSync(`chmod 0700 "${homeDir}"`);
   const escaped = password.replace(/'/g, "'\\''");
   execSync(`printf '%s\\n%s\\n' '${escaped}' '${escaped}' | smbpasswd -a -s "${username}"`);
 }
@@ -1682,7 +1683,8 @@ function main() {
       fs.mkdirSync(homeDir, { recursive: true });
       try {
         execSync(`id -u "${u.username}" >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin "${u.username}"`);
-        execSync(`chown "${u.username}":nogroup "${homeDir}"`);
+        execSync(`chown -R "${u.username}":"${u.username}" "${homeDir}"`);
+        execSync(`chmod 0700 "${homeDir}"`);
         // Set Samba password only if user not already in TDB (first run or migration)
         try {
           execSync(`pdbedit -u "${u.username}" >/dev/null 2>&1`);