diff --git a/configuration.nix b/configuration.nix
index d6a73fb..8562165 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -11,6 +11,7 @@ in
     ./borgbackup.nix
 
     ./ftp.nix
+    ./samba.nix
 
     (import ./acme.nix { inherit base-domain; })
     (import ./nginx.nix { inherit base-domain; })
diff --git a/samba.nix b/samba.nix
new file mode 100644
index 0000000..d316a7b
--- /dev/null
+++ b/samba.nix
@@ -0,0 +1,27 @@
+{
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    securityType = "user";
+    extraConfig = ''
+      workgroup = WORKGROUP
+      server string = 005540.xyz
+      netbios name = 005540.xyz
+      security = user
+      hosts allow = 0.0.0.0/0
+      guest account = nobody
+      map to guest = bad user
+      log level = 2
+    '';
+    shares."paperless-upload" = {
+      path = "/var/lib/paperless/consume";
+      browsable = "yes";
+      "read only" = "no";
+      "guest ok" = "no";
+      "write list" = "@paperless-upload";
+      "read list" = "@paperless-upload";
+      "force user" = "paperless-upload";
+      "force group" = "paperless";
+    };
+  };
+}