{ config, ... }:
{
  # cockpit-file-sharing expects a live Samba stack: /etc/samba/smb.conf, smbd, and
  # `include = registry` in [global] for net registry share management.
  services.samba = {
    enable = true;
    openFirewall = true;
    winbindd.enable = false;
    settings.global = {
      workgroup = "WORKGROUP";
      "server string" = config.networking.hostName;
      include = "registry";
    };
  };

  services.nfs.server = {
    enable = true;
    mountdPort = 4000;
    lockdPort = 4001;
    statdPort = 4002;
  };

  networking.firewall.allowedTCPPorts = [
    111
    2049
    4000
    4001
    4002
  ];
  networking.firewall.allowedUDPPorts = [
    111
    2049
    4000
    4001
    4002
  ];
}