diff --git a/ansible/files/smb.conf b/ansible/files/smb.conf
index 5c1d791..1f3dcf8 100644
--- a/ansible/files/smb.conf
+++ b/ansible/files/smb.conf
@@ -22,6 +22,8 @@
 #======================= Global Settings =======================
 
 [global]
+smb ports = 4445
+client min protocol = SMB3_11
 
 ## Browsing/Identification ###
 
@@ -34,7 +36,7 @@
 # This can be either the interface name or an IP address/netmask;
 # interface names are normally preferred
 ;   interfaces = 127.0.0.0/8 eth0
-interfaces = 2601:5c0:c280:8e30::/64 10.42.0.0/24 eno1
+interfaces = 64.112.38.10/30 eno1
 
 # Only bind to the named interfaces and/or networks; you must use the
 # 'interfaces' option above to use this.
@@ -172,9 +174,9 @@ interfaces = 2601:5c0:c280:8e30::/64 10.42.0.0/24 eno1
    browseable = yes
    path = /bigdata/archive/photos
    guest ok = no
-   read only = no
-   create mask = 0700
-   directory mask = 0700
+   read only = yes
+   create mask = 0644
+   directory mask = 0755
    valid users = paul
 
 [incoming-photos]
@@ -183,8 +185,8 @@ interfaces = 2601:5c0:c280:8e30::/64 10.42.0.0/24 eno1
    path = /bigdata/tmp/incoming-photos
    guest ok = no
    read only = no
-   create mask = 0700
-   directory mask = 0700
+   create mask = 0644
+   directory mask = 0755
    valid users = paul
 
 # Un-comment the following and create the netlogon directory for Domain Logons
diff --git a/fogcutter/docker/nginx.sh b/fogcutter/docker/nginx.sh
index 6d5165c..d0a2b12 100755
--- a/fogcutter/docker/nginx.sh
+++ b/fogcutter/docker/nginx.sh
@@ -17,8 +17,8 @@ up () {
     --env URL=seaturtle.pw \
     --env VALIDATION=http \
     --env EMAIL=paulsw.pw@gmail.com \
-    --env SUBDOMAINS=cave,ff,git,jf,mp,nc,plex \
-    --env EXTRA_DOMAINS=paul.walko.org,tile.bigcavemaps.com \
+    --env SUBDOMAINS=cave,ff,git,jf,nc,plex \
+    --env EXTRA_DOMAINS=paul.walko.org,mp.bigcavemaps.com,tile.bigcavemaps.com \
     --volume /bigdata/k8s-config/nginx/nginx.conf:/config/nginx/nginx.conf:ro \
     --volume /bigdata/files:/files:ro \
     --volume /bigdata/k8s-config/nginx/config:/config:rw \