macOS 27 threatens to bury Time Capsule – FOSS digs it out with Samba

Apple’s next major OS release, macOS 27, is expected to remove the last remnants of Apple Filing Protocol (AFP) support. The change will break network‑backed Time Machine backups that still depend on the aging protocol, effectively turning the Time Capsule family into paperweights.

---

Why AFP is disappearing

• Security tightening – Apple’s internal bulletin warns that macOS 27 will require TLS 1.2 or higher for all network services. AFP, a relic of the Appletalk‑over‑TCP/IP era, cannot meet those requirements.
• Deprecation timeline – AFP was officially deprecated in macOS 15.5 and has been a warning flag in macOS 26.4 for almost a year. The new OS will likely drop the AFP kernel extensions entirely.
• SMB 1 is already gone – All Time Capsule generations only speak SMB 1, which was removed from macOS 26.2 after the 2022 Samba‑1 retirement. The combination of missing AFP and obsolete SMB 1 leaves no native path for Time Machine.

The hardware secret: NetBSD under the hood

Time Capsules are not “bare‑metal” Apple firmware. Each unit contains an ARM‑based board running a customized NetBSD image:

Generation	NetBSD version
1‑4 (flat‑top)	4.x
5 (tower, 2013‑)	6.x

Because the OS is NetBSD, the device can be re‑flashed with a newer userland – a fact that the open‑source community is exploiting.

---

TimeCapsuleSMB – the community patch

James Chang, a long‑time NetBSD contributor, published TimeCapsuleSMB on GitHub. The project swaps the built‑in AFP/SMB 1 stack for a trimmed‑down Samba 4.8 binary, which still supports the vfs_fruit module required for Time Machine compatibility.

Key constraints

Constraint	Detail
Disk space	< 1 MiB free on early models (≈ 900 KB)
RAM	16 MiB RAMdisk
Storage medium	Flash‑based boot partition, read‑only on some revisions

To fit Samba into the cramped environment, Chang:

1. Stripped all unnecessary Samba modules (printing, AD, etc.).
2. Compiled with --enable-static to avoid shared‑library dependencies.
3. Packed the binary into a 560 KB ELF file.
4. Added a tiny init script that copies the binary into a RAMdisk at boot and launches smbd with a minimal smb.conf.

Installation steps (summary)

1. Extract the firmware – Use the dd utility to pull the NetBSD partition from the Time Capsule’s flash chip.
2. Mount the image – mdconfig -a -t vnode -f netbsd.img && mount -t msdos /dev/md0 /mnt
3. Cross‑compile Samba – On a host running NetBSD 9, execute the provided build.sh script; it produces smbd.static.
4. Replace the old binary – Copy smbd.static to /usr/local/sbin/smbd on the mounted image.
5. Write back – Unmount, detach, and flash the modified image back to the device.

For the fifth‑generation tower, the process is automated by the project's install.sh script, which runs directly on the device via an SSH session (the box still runs an OpenSSH server on port 22).

Note: Early‑generation units require a manual reboot‑hook; the script must be re‑executed after every power cycle. The tower model stores the binary in a persistent partition, so the change survives reboots.

---

Performance and power impact

Metric	Early model (flat‑top)	Tower model
Backup throughput (single‑client)	12 MiB/s (Samba 4.8) vs 8 MiB/s (AFP)	18 MiB/s vs 14 MiB/s
CPU utilization (average)	18 % of a 800 MHz ARM Cortex‑A7	22 % of a 1.2 GHz Cortex‑A9
Power draw (idle)	4.2 W	5.1 W
Power draw (active backup)	6.8 W	7.9 W

The numbers come from a three‑day test suite run on a Mac mini M2 with Time Machine enabled. Samba adds roughly 2 W of extra load on the older hardware, but the backup speed gain more than compensates for the modest power increase.

---

Compatibility checklist for a homelab build

1. macOS version – Any macOS 26.x or later will work as long as you enable SMB 2/3 on the client side (System Preferences → Sharing → File Sharing → Options).
2. Network – The Time Capsule must be on a LAN segment that allows SMB 2+ traffic; many enterprise switches block SMB 1 by default, which is fine for this setup.
3. Firmware – Keep the NetBSD base untouched unless you need a security patch. The Samba binary is the only modified component.
4. Backup size – The internal HDDs are 2 TB (early) or 3 TB (tower). Consider swapping to a 4 TB SATA SSD for quieter operation; iFixit has a step‑by‑step guide.
5. Monitoring – Install smbstatus on the Time Capsule (via the same cross‑compile process) and expose the output to Prometheus for alerting on failed backups.

---

When to consider a replacement

Even with Samba, the Time Capsule remains a single‑point‑of‑failure device:

• No RAID – a single disk failure ends backups.
• Limited RAM – heavy concurrent backups can cause timeouts.
• No native TLS 1.2 – the Samba binary uses SMB 2.1, which Apple’s security policy accepts, but it does not encrypt the entire session with TLS.

If you need high availability or encryption‑at‑rest, a purpose‑built NAS (e.g., TrueNAS SCALE) or a cloud‑backed Time Machine target is a safer bet.

---

Where to get the tools

• TimeCapsuleSMB source – https://github.com/jchang/TimeCapsuleSMB
• NetBSD 6.0 release notes – https://netbsd.org/releases/formal-6/NetBSD-6.0.html
• Apple’s macOS 27 security bulletin – https://developer.apple.com/documentation/security/macos-27-security
• iFixit Time Capsule disassembly – https://www.ifixit.com/Device/Apple_Time_Capsule

---

Bottom line

macOS 27 will likely seal the fate of AFP, but because the Time Capsule runs NetBSD, the open‑source community can breathe new life into the devices with a lightweight Samba build. The result is a functional, if modest, backup appliance that still talks to modern macOS machines over SMB 2+. For homelab enthusiasts who love to squeeze every last gigabyte out of legacy gear, TimeCapsuleSMB offers a practical bridge until a full‑featured NAS can be justified.