{
  pkgs,
  config,
  lib,
  ...
}:
# define smb shares
let
  cfg = config.holocron.smb;
  smb_shares = {
    global = {
      # time machine specifc config, must be global
      "fruit:aapl" = "yes";
      "fruit:nfs_aces" = "no";
      "fruit:metadata" = "stream";
      "fruit:model" = "TimeCapsule";
      "fruit:posix_rename" = "yes";
      "fruit:veto_appledouble" = "no";
      "fruit:wipe_intentionally_left_blank_rfork" = "yes";
      "fruit:delete_empty_adfiles" = "yes";
      "vfs objects" = "catia fruit streams_xattr";
      "ea support" = "yes";
      "spotlight" = "no";
      "multicast dns register" = "no";
      "min protocol" = "SMB2";
    };
    archives = {
      path = "/holocron/archives";
      browseable = true;
      writable = true;
      guestOk = false;
      "create mask" = "0775";
      "directory mask" = "0775";
    };
    timemachine = {
      browseable = true;
      "path" = "/holocron/timemachine";
      "valid users" = "blake";
      "public" = "no";
      "writeable" = "yes";
      "force user" = "blake";
      # time machine specifc config
      "fruit:time machine" = "yes";
      "fruit:time machine max size" = "5T";
      "case sensitive" = "yes";
      "default case" = "lower";
      "preserve case" = "no";
      "short preserve case" = "no";
      "create mask" = "0660";
      "directory mask" = "0770";
      "force group" = "blake";
    };
    users = {
      path = "/holocron/users";
      browseable = true;
      writable = true;
      guestOk = false;
      "create mask" = "0660";
      "directory mask" = "0770";
    };
    media = {
      path = "/holocron/media";
      browseable = true;
      writable = true;
      guestOk = false;
      "create mask" = "0775";
      "directory mask" = "0775";
    };
    nvr = {
      path = "/holocron/nvr";
      browseable = true;
      writable = true;
      guestOk = false;
      "public" = "no";
      "writeable" = "yes";
      # time machine specifc config
      "case sensitive" = "yes";
      "default case" = "lower";
      "preserve case" = "no";
      "short preserve case" = "no";
      "create mask" = "0660";
      "directory mask" = "0770";
    };
  };
in {
  options.holocron.smb = {
    enable = lib.mkEnableOption "enables smb";
  };

  config = lib.mkIf cfg.enable {
    # enable smb with all shares
    services.samba = {
      enable = true;
      package = pkgs.sambaFull;
      settings = smb_shares;
    };

    # ensure time machine can discover the share without `tmutil`
    services.avahi = {
      enable = true;
      openFirewall = true;
      nssmdns4 = true;
      publish.enable = true;
      publish.userServices = true;
      extraServiceFiles = {
        timemachine = ''
          <?xml version="1.0" standalone='no'?>
          <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
          <service-group>
            <name replace-wildcards="yes">%h</name>
            <service>
              <type>_smb._tcp</type>
              <port>445</port>
            </service>
              <service>
              <type>_device-info._tcp</type>
              <port>0</port>
              <txt-record>model=TimeCapsule8,119</txt-record>
            </service>
            <service>
              <type>_adisk._tcp</type>
              <port>0</port>
              <txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
              <txt-record>sys=waMa=0,adVF=0x100</txt-record>
            </service>
          </service-group>
        '';
      };
    };
  };
}