# /etc/nixos/mount.nix
{ config, pkgs, ... }:

{
  # ============================================================
  # Storage mounts
  # All mounts point to subaccounts of the Hetzner Storage Box.
  # Each subaccount is dedicated to a specific project.
  # Credentials files are located in /etc/nixos/secrets/ (.gitignored)
  #
  # Credentials file format:
  #   username=u547668-subX
  #   password=YOUR_PASSWORD
  # ============================================================

  fileSystems = {

    # ------------------------------------------------------------
    # Nextcloud – CIFS/SMB only (subaccount: u547668-sub7)
    # Samba must be enabled in the Hetzner Robot Panel!
    # Credentials: /etc/nixos/secrets/storagebox-nextcloud-credentials
    # ------------------------------------------------------------
    "/mnt/storagebox-nextcloud" = {
      device = "//u547668-sub7.your-storagebox.de/u547668-sub7";
      fsType = "cifs";
      options = [
        "credentials=/etc/nixos/secrets/storagebox-nextcloud-credentials"
        "file_mode=0770"
        "dir_mode=0770"
        "vers=3.0"
        "_netdev"
        "nofail"
      ];
    };

    # ------------------------------------------------------------
    # Add further subaccount mounts here, e.g.:
    #
    # "/mnt/storagebox-PROJECTNAME" = {
    #   device = "//u547668-subX.your-storagebox.de/u547668-subX";
    #   fsType = "cifs";  # or "fuse.sshfs" if SSH access is enabled
    #   options = [
    #     "credentials=/etc/nixos/secrets/storagebox-PROJECTNAME-credentials"
    #     "uid=USER"
    #     "gid=GROUP"
    #     "file_mode=0770"
    #     "dir_mode=0770"
    #     "vers=3.0"
    #     "x-systemd.automount"
    #     "x-systemd.requires=network-online.target"
    #     "_netdev"
    #     "nofail"
    #   ];
    # };
    # ------------------------------------------------------------

  };

  # Required for CIFS/SMB mounts
  environment.systemPackages = with pkgs; [
    cifs-utils
    sshfs
  ];

  # For SMB connection allowing outgoing 445
  networking.firewall.extraCommands = ''
    iptables -A OUTPUT -p tcp --dport 445 -j ACCEPT
  '';
}