# Samba 4.22 on OpenBSD/FFS2.
[global]
   server role = standalone server
   workgroup = WORKGROUP
   security = user
   passdb backend = tdbsam

   ntlm auth = ntlmv2-only
   map to guest = never
   guest ok = no

   usershare max shares = 0

   # Enumerate only shares accessible to the authenticated user.
   access based share enum = yes

   disable netbios = yes
   smb ports = 445
   server min protocol = SMB3_00
   server max protocol = SMB3_11

   # Per-share encryption; sign unencrypted traffic.
   server smb encrypt = desired
   server signing = mandatory

   unix charset = UTF-8
   case sensitive = auto

   # No experimental SMB3 POSIX extensions.
   smb3 unix extensions = no

   wide links = no
   getwd cache = yes

   # Parent permissions override creation masks.
   inherit permissions = yes

   delete readonly = yes

   dos filemode = yes
   dos filetimes = yes

   # Directory leases require userspace oplocks and imply strict rename.
   oplocks = yes
   level2 oplocks = yes
   kernel oplocks = no
   smb2 leases = yes
   smb3 directory leases = yes

   # POSIX lock interoperability; disables durable handles.
   kernel share modes = no
   posix locking = yes

   strict locking = auto

   aio read size = 1
   aio write size = 1

   # Honour flushes without fsync on every write.
   strict sync = yes
   sync always = no

   # Avoid FFS2 preallocation overhead.
   strict allocate = no

   # Unsupported on OpenBSD.
   server multi channel support = no
   use sendfile = no

   # OpenBSD mkdir workaround (Samba bug 15801).
   vfs mkdir use tmp name = no

   # No native FFS2 xattrs; preserve existing ADS/EA backends and paths.
   vfs objects = streams_depot xattr_tdb
   ea support = yes
   store dos attributes = yes
   streams_depot:directory = /storage/samba/.streams_depot
   xattr_tdb:file = /storage/var/db/samba/xattr.tdb

   # Retain displaced streams as lost-* instead of deleting.
   streams_depot:delete_lost = no

   multicast dns register = no

   load printers = no
   disable spoolss = yes
   printcap name = /dev/null

   logging = file
   log level = 0
   max log size = 1000


[share]
   path = /storage/samba/share
   read only = no

   valid users = fileshare
   force user = fileshare
   force group = smbusers

   server smb encrypt = desired


[work]
   # Note: This share optimised for Windows clients
   path = /storage/samba/work
   read only = no

   valid users = filework
   force user = filework
   force group = smbusers

   # Avoid depot/TDB overhead; no ADS or persistent DOS attributes.
   vfs objects =
   ea support = no
   store dos attributes = no

   # Do not map DOS flags onto Unix modes.
   map archive = no
   map hidden = no
   map system = no
   map readonly = no


[private]
   path = /storage/samba/private
   read only = no

   valid users = fileprivate
   force user = fileprivate
   force group = smbusers

   server smb encrypt = required