add user/samba restore script + yireh and isaac smb shares

RUNBOOK.md

@@ -75,7 +75,7 @@ git clone /mnt/backup/argento/docker/gitea/data/git/repositories/timothykim/arge
 
 Clone first -- ZFS datasets will mount into this directory tree in the next step.
 
-## 7. ZFS pools + data restore
+## 7. ZFS pools
 
 **If ZFS disks are intact (OS drive failure only)** -- the common case:
 
@@ -88,15 +88,12 @@ zpool import threeteras
 # Verify mountpoints (update if the old /opt/docker/ paths are still set):
 zfs set mountpoint=/opt/argento/docker/nextcloud/data nextcloud/data
 zfs set mountpoint=/opt/argento/smb/media threeteras/media
+zfs set mountpoint=/opt/argento/smb/yireh threeteras/yireh
+zfs set mountpoint=/opt/argento/smb/isaac threeteras/isaac
 zfs set mountpoint=/opt/argento/docker/garage/data threeteras/garage
 zfs set mountpoint=/opt/argento/docker/immich/library threeteras/immich
 
 zpool status  # verify pools are ONLINE
-
-# Restore non-ZFS app data (Gitea, Minecraft, Jellyfin config) from USB:
-rsync -a --exclude='docker/nextcloud/data/' --exclude='docker/garage/data/' \
-    --exclude='docker/immich/library/' --exclude='smb/' \
-    /mnt/backup/argento/ /opt/argento/
 ```
 
 **If ZFS disks are lost (full rebuild):**
@@ -116,12 +113,66 @@ zfs create -o mountpoint=/opt/argento/docker/nextcloud/data nextcloud/data
 zpool create threeteras raidz2 /dev/disk/by-id/<disk3> ... /dev/disk/by-id/<disk8>
 zfs set compression=lz4 threeteras
 zfs create -o mountpoint=/opt/argento/smb/media threeteras/media
+zfs create -o mountpoint=/opt/argento/smb/yireh -o quota=1T threeteras/yireh
+zfs create -o mountpoint=/opt/argento/smb/isaac -o quota=1T threeteras/isaac
 zfs create -o mountpoint=/opt/argento/docker/garage/data threeteras/garage
 zfs create -o mountpoint=/opt/argento/docker/immich/library threeteras/immich
 
 zpool status  # verify pools are ONLINE
 
-# Restore everything from USB (ZFS mountpoints are set, data lands in the right place):
+# Per-user SMB share dirs need ownership + setgid (rsync in step 7c will
+# preserve these if a USB backup exists, but freshly-created datasets are
+# root-owned and need this fixup).
+for u in yireh isaac; do
+    chown "$u":sambagroup "/opt/argento/smb/$u"
+    chmod 2770 "/opt/argento/smb/$u"
+done
+```
+
+## 7b. Restore users
+
+System users and the samba passdb are not part of the OS install or the
+`/opt/argento/` rsync. Recreate them now, BEFORE the data rsync in step 7c,
+so file ownership lands on the correct UIDs.
+
+```bash
+/opt/argento/scripts/restore-users.sh
+```
+
+This recreates timothykim, yireh, isaac, and the sambagroup group with
+their original UIDs/GIDs, then restores the samba password hashes from
+`/mnt/backup/samba-private/` if present.
+
+If the samba passdb backup is missing, set passwords manually:
+
+```bash
+for u in timothykim yireh isaac; do
+    smbpasswd -a "$u"
+    smbpasswd -e "$u"
+done
+```
+
+Set timothykim's Linux login password (not in any backup):
+
+```bash
+passwd timothykim
+```
+
+## 7c. Restore data from USB
+
+**If ZFS disks were intact:**
+
+```bash
+# Skip the big ZFS-backed dirs — that data is already on disk
+rsync -a --exclude='docker/nextcloud/data/' --exclude='docker/garage/data/' \
+    --exclude='docker/immich/library/' --exclude='smb/' \
+    /mnt/backup/argento/ /opt/argento/
+```
+
+**If ZFS was rebuilt from scratch:**
+
+```bash
+# Restore everything (ZFS mountpoints are set, data lands in the right place)
 rsync -a /mnt/backup/argento/ /opt/argento/
 ```