From 85e65417c31f73d84395df28a3c7aaf8820e857a Mon Sep 17 00:00:00 2001
From: cangui <canguijc@gmail.com>
Date: Sun, 22 Jun 2025 11:58:16 +0200
Subject: [PATCH] up smb protect

---
 docker-compose.yml | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index e388f49..c637677 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,16 +20,26 @@ services:
       # tu laisses tout ce que Dokploy met déjà, ET tu ajoutes :
       - traefik.http.middlewares.webdav-allow-methods.headers.accesscontrolallowmethods=GET,PUT,POST,DELETE,PROPFIND,OPTIONS,LOCK,UNLOCK,HEAD
       - traefik.http.middlewares.webdav-allow-methods.headers.accesscontrolallowheaders=Authorization,Depth,Content-Type,If-Modified-Since,User-Agent,Destination,Overwrite
-  smb:
-    image: dperson/samba
+smb:
+    image: dperson/samba:latest
+    container_name: samba
     ports:
-      - "139:139"
-      - "445:445"
-    environment:
-      - USER=admin;password=supersecret
+      - "127.0.0.1:139:139"
+      - "127.0.0.1:445:445"
     volumes:
-      - shelfly_upload:/mount   # <-- on monte le même volume Docker nommé
-    command: "-u 'cangui;GHT30k7!' -s 'media;/mount;yes;no' -p"
+      - shelfly_upload:/mount
+    environment:
+      TZ: Europe/Paris
+    command:
+      - "-u"            # création de l’utilisateur
+      - "cangui;GHT30k7!"
+      - "-s"            # partage “media” protégé
+      - "media;/mount;yes;no;no;cangui"
+      - "-g"            # signature SMB obligatoire
+      - "server signing = mandatory"
+      - "-g"            # chiffrement SMB requis
+      - "smb encrypt = required"
+      - "-p"            # ajuste les permissions filesystem
 
 volumes:
   shelfly_upload: