Run SMB dev connector as non-root

dev/connectors/smb/entrypoint.sh

@@ -3,21 +3,42 @@ set -eu
 
 share_name="${SMB_SHARE_NAME:-files}"
 user_name="${SMB_USER:-govoplan}"
-password="${SMB_PASSWORD:-govoplan-smb}"
-uid="${SMB_UID:-1000}"
-gid="${SMB_GID:-1000}"
+smb_port="${SMB_PORT:-1445}"
+runtime_user="$(id -un)"
+runtime_group="$(id -gn)"
 
-mkdir -p /storage /var/lib/samba/private /run/samba
+case "$share_name" in
+  "" | *[!A-Za-z0-9_.-]*)
+    printf 'SMB_SHARE_NAME must contain only letters, numbers, dot, dash, or underscore.\n' >&2
+    exit 1
+    ;;
+esac
 
-if ! getent group "$user_name" >/dev/null 2>&1; then
-  addgroup -g "$gid" "$user_name"
+case "$user_name" in
+  "" | *[!A-Za-z0-9_.-]*)
+    printf 'SMB_USER must contain only letters, numbers, dot, dash, or underscore.\n' >&2
+    exit 1
+    ;;
+esac
+
+case "$smb_port" in
+  "" | *[!0-9]*)
+    printf 'SMB_PORT must be numeric.\n' >&2
+    exit 1
+    ;;
+esac
+
+if [ "$smb_port" -lt 1024 ]; then
+  printf 'SMB_PORT must be >= 1024 because the dev Samba container runs as a non-root user.\n' >&2
+  exit 1
 fi
 
-if ! id "$user_name" >/dev/null 2>&1; then
-  adduser -D -H -s /sbin/nologin -u "$uid" -G "$user_name" "$user_name"
+if [ "$user_name" != "$runtime_user" ]; then
+  printf 'SMB_USER=%s is not supported by the non-root dev image; use %s or rebuild the image with a matching user.\n' "$user_name" "$runtime_user" >&2
+  exit 1
 fi
 
-chown -R "$user_name:$user_name" /storage
+mkdir -p /storage /var/lib/samba/private /var/cache/samba /run/samba /etc/samba
 
 cat > /etc/samba/smb.conf <<EOF
 [global]
@@ -25,12 +46,20 @@ cat > /etc/samba/smb.conf <<EOF
    workgroup = WORKGROUP
    security = user
    map to guest = Never
+   guest account = $runtime_user
    server min protocol = SMB2
+   server signing = mandatory
+   smb ports = $smb_port
    load printers = no
    printing = bsd
    disable spoolss = yes
    log level = 1
    passdb backend = tdbsam
+   private dir = /var/lib/samba/private
+   lock directory = /run/samba
+   state directory = /var/lib/samba
+   cache directory = /var/cache/samba
+   pid directory = /run/samba
 
 [$share_name]
    path = /storage
@@ -38,13 +67,16 @@ cat > /etc/samba/smb.conf <<EOF
    read only = no
    guest ok = no
    valid users = $user_name
-   force user = $user_name
-   force group = $user_name
+   force user = $runtime_user
+   force group = $runtime_group
    create mask = 0664
    directory mask = 0775
 EOF
 
-printf '%s\n%s\n' "$password" "$password" | smbpasswd -s -a "$user_name" >/dev/null
-smbpasswd -e "$user_name" >/dev/null
+if ! pdbedit -L -u "$user_name" >/dev/null 2>&1; then
+  printf 'Samba user %s is missing from passdb. Rebuild the smb image so the non-root passdb is seeded.\n' "$user_name" >&2
+  printf 'Run: docker compose build --no-cache smb && docker compose up -d smb\n' >&2
+  exit 1
+fi
 
-exec smbd --foreground --no-process-group --debug-stdout
+exec smbd --foreground --no-process-group --debug-stdout -p "$smb_port"