diff --git a/helios/permissions-nextcloud.sh b/helios/permissions-nextcloud.sh
new file mode 100644
index 0000000..126caf3
--- /dev/null
+++ b/helios/permissions-nextcloud.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+find /var/www/ -type f -print0 | xargs -0 chmod 0640
+find /var/www/ -type d -print0 | xargs -0 chmod 0750
+
+chown -R acmeuser:ssl-cert /etc/ssl/private
+chown root:ssl-cert /etc/ssl/private/ssl-cert-snakeoil.key
+chmod -R 750 /etc/ssl/private
+find /etc/ssl/private/ -type f -print0 | xargs -0 chmod 0640
+
+chown -R www-data:www-data /var/www
+chown -R www-data:www-data /mnt/storage/nc_data
+chmod 0644 /var/www/nextcloud/.htaccess
+chmod 0644 /var/www/nextcloud/.user.ini
+exit 0
diff --git a/helios/permissions-storage.sh b/helios/permissions-storage.sh
new file mode 100644
index 0000000..618361a
--- /dev/null
+++ b/helios/permissions-storage.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+find /mnt/storage/backuphdd -type f -print0 | xargs -0 chmod 0640
+find /mnt/storage/backuphdd -type d -print0 | xargs -0 chmod 0750
+chown -R root:root /mnt/storage/backuphdd
+exit 0
diff --git a/helios/sambasetup.sh b/helios/sambasetup.sh
new file mode 100644
index 0000000..f9341c1
--- /dev/null
+++ b/helios/sambasetup.sh
@@ -0,0 +1,62 @@
+  # CHECKS
+  ################################
+  DATADIR=$( sudo -u www-data php /var/www/nextcloud/occ config:system:get datadirectory ) || {
+    echo -e "Error reading data directory. Is NextCloud running and configured?"; 
+  }
+  [ -d "$DATADIR" ] || { echo -e "data directory $DATADIR not found"   ; }
+
+  # CONFIG
+  ################################
+  # remove files from this line to the end
+  sed -i '/# NextCloudPi automatically/,/\$/d' /etc/samba/smb.conf
+
+  # restore this line
+  cat >> /etc/samba/smb.conf <<EOF
+# NextCloudPi automatically generated from here. Do not remove this comment
+EOF
+
+  # create a share per Nextcloud user
+  USERS=()
+  while read -r path; do 
+    USERS+=( "$( basename $( dirname "$path" ) )" )
+  done < <( ls -d "$DATADIR"/*/files )
+
+  for user in ${USERS[@]}; do
+    # Exclude users not matching group filter (if enabled)
+    if [[ -n "$FILTER_BY_GROUP" ]] \
+    && [[ -z "$(ncc user:info "$user" --output=json | jq ".groups[] | select( . == \"${FILTER_BY_GROUP}\" )")" ]]
+    then
+      echo "Omitting user $user (not in group ${FILTER_BY_GROUP})...";
+      continue;
+    fi
+
+    echo "adding SAMBA share for user $user"
+    DIR="$DATADIR/$user/files"
+    [ -d "$DIR" ] || { echo -e "INFO: directory $DIR does not exist."; }
+
+    cat >> /etc/samba/smb.conf <<EOF
+[ncp-$user]
+    path = $DIR
+    writeable = yes
+;	browseable = yes
+    valid users = $user
+    force user = www-data
+    force group = www-data
+    create mask = 0770
+    directory mask = 0771
+    force create mode = 0660
+    force directory mode = 0770
+EOF
+
+    ## create user with no login if it doesn't exist
+    id "$user" &>/dev/null || adduser --disabled-password --force-badname --gecos "" "$user"
+    echo -e "$PWD\n$PWD" | smbpasswd -s -a $user
+
+    usermod -aG www-data $user
+    sudo chmod g+w $DIR
+  done
+
+  systemctl enable --now smbd
+  systemctl enable --now nmbd
+
+  echo "SMB enabled"
diff --git a/helios/upgrade-nextcloud.sh b/helios/upgrade-nextcloud.sh
new file mode 100644
index 0000000..7948ed2
--- /dev/null
+++ b/helios/upgrade-nextcloud.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --on
+sudo -u www-data php /var/www/nextcloud/updater/updater.phar
+sudo -u www-data php /var/www/nextcloud/occ status
+sudo -u www-data php /var/www/nextcloud/occ -V
+sudo -u www-data php /var/www/nextcloud/occ db:add-missing-primary-keys
+sudo -u www-data php /var/www/nextcloud/occ db:add-missing-indices
+sudo -u www-data php /var/www/nextcloud/occ db:add-missing-columns
+sudo -u www-data php /var/www/nextcloud/occ db:convert-filecache-bigint
+sed -i "s/output_buffering=.*/output_buffering=0/" /var/www/nextcloud/.user.ini
+chown -R www-data:www-data /var/www/nextcloud
+redis-cli -s /var/run/redis/redis-server.sock <<EOF
+FLUSHALL
+quit
+EOF
+sudo -u www-data php /var/www/nextcloud/occ files:scan --all
+sudo -u www-data php /var/www/nextcloud/occ files:scan-app-data
+sudo -u www-data php /var/www/nextcloud/occ app:update --all
+sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off
+systemctl restart php7.3-fpm
+systemctl restart nginx
+exit 0