up smb protect

docker-compose.yml

@@ -20,16 +20,26 @@ services:
       # tu laisses tout ce que Dokploy met déjà, ET tu ajoutes :
       - traefik.http.middlewares.webdav-allow-methods.headers.accesscontrolallowmethods=GET,PUT,POST,DELETE,PROPFIND,OPTIONS,LOCK,UNLOCK,HEAD
       - traefik.http.middlewares.webdav-allow-methods.headers.accesscontrolallowheaders=Authorization,Depth,Content-Type,If-Modified-Since,User-Agent,Destination,Overwrite
-  smb:
-    image: dperson/samba
+smb:
+    image: dperson/samba:latest
+    container_name: samba
     ports:
-      - "139:139"
-      - "445:445"
-    environment:
-      - USER=admin;password=supersecret
+      - "127.0.0.1:139:139"
+      - "127.0.0.1:445:445"
     volumes:
-      - shelfly_upload:/mount   # <-- on monte le même volume Docker nommé
-    command: "-u 'cangui;GHT30k7!' -s 'media;/mount;yes;no' -p"
+      - shelfly_upload:/mount
+    environment:
+      TZ: Europe/Paris
+    command:
+      - "-u"            # création de l’utilisateur
+      - "cangui;GHT30k7!"
+      - "-s"            # partage “media” protégé
+      - "media;/mount;yes;no;no;cangui"
+      - "-g"            # signature SMB obligatoire
+      - "server signing = mandatory"
+      - "-g"            # chiffrement SMB requis
+      - "smb encrypt = required"
+      - "-p"            # ajuste les permissions filesystem
 
 volumes:
   shelfly_upload: