[global]
    workgroup = WORKGROUP
    server string = Canon SMB bridge
    netbios name = MDOCK-CANON
    security = user
    map to guest = Never
    log file = /var/log/samba/log.%m
    log level = 1
    max log size = 1000

    # Old-school SMB1 + NTLMv1 — required by Canon MAXIFY MB5100 (2014, SMB1 only).
    # LAN-only, no encryption — see infra/samba-canon/README.md.
    server min protocol = NT1
    server max protocol = SMB3
    client min protocol = NT1
    client max protocol = SMB3
    ntlm auth = ntlmv1-permitted
    lanman auth = yes
    client lanman auth = yes
    client plaintext auth = no
    server signing = disabled
    smb encrypt = disabled
    server multi channel support = no

    # Performance / sanity for a single-share LAN bridge
    load printers = no
    printing = bsd
    printcap name = /dev/null
    disable spoolss = yes
    dns proxy = no
    usershare allow guests = no
    panic action = /bin/sh -c 'echo "smbd panic at $(date)" >&2'

[inbox]
    comment = Canon scan inbox (writes to /mnt/mdms/inbox on TrueNAS via NFS)
    path = /inbox
    browseable = yes
    writable = yes
    read only = no
    guest ok = no
    valid users = canon
    force user = canon
    force group = canon
    create mask = 0664
    directory mask = 0775
    force create mode = 0664
    force directory mode = 0775
    # The Canon writes single PDFs; vfs full_audit is overkill.
    vfs objects =