{
  services.samba = {
    enable = true;
    securityType = "user";
    openFirewall = true;
    ## Switch to structured config with NixOS 24.11
    # settings = {
    #   global = {
    #     "workgroup" = "WORKGROUP";
    #     "hosts allow" = "192.168.";
    #     "hosts deny" = "0.0.0.0/0";
    #     "guest account" = "nobody";
    #     "map to guest" = "bad user";
    #   };
    #   "public" = {
    #     "path" = "/nas/chandler/Public";
    #     "browseable" = "yes";
    #     "read only" = "yes";
    #     "guest ok" = "yes"; # aka "public = yes"
    #   };
    #   # "private" = {
    #   #   "path" = "/mnt/Shares/Private";
    #   #   "browseable" = "yes";
    #   #   "read only" = "no";
    #   #   "guest ok" = "no";
    #   #   "create mask" = "0644";
    #   #   "directory mask" = "0755";
    #   #   "force user" = "username";
    #   #   "force group" = "groupname";
    #   # };
    # };
    extraConfig = ''
      workgroup = WORKGROUP
      hosts allow = 192.168.
      hosts deny = 0.0.0.0/0
      guest account = nobody
      map to guest = bad user
    '';
    shares = {
      "public" = {
        "path" = "/nas/chandler/public";
        "browseable" = "yes";
        "read only" = "yes";
        "guest ok" = "yes"; # aka "public = yes"
      };
    };
  };
}