From 1b915a761002f95bcabb37ab0ae74acd2d64ab5f Mon Sep 17 00:00:00 2001 From: Geir Okkenhaug Jerstad Date: Wed, 11 Jun 2025 10:45:08 +0200 Subject: [PATCH] feat: implement NFS with NFSv4 ID mapping across home lab - Add NFSv4 ID mapping configuration using services.nfs.idmapd.settings - Configure consistent domain 'home.lab' for ID mapping across all machines - Update sleeper-service NFS server with proper security (root_squash, all_squash) - Create reusable NFS client module (modules/services/nfs-client.nix) - Deploy NFS client configuration to grey-area and congenital-optimist - Maintain consistent media group GID (993) across all machines - Support both local (10.0.0.0/24) and Tailscale (100.64.0.0/10) networks - Test and verify NFS connectivity and ID mapping functionality Resolves permission management issues and enables secure file sharing across the home lab infrastructure. --- .../congenital-optimist/configuration.nix | 3 ++ machines/grey-area/configuration.nix | 32 ++++++++++--------- machines/sleeper-service/nfs.nix | 21 ++++++------ modules/services/nfs-client.nix | 23 ++++++------- 4 files changed, 38 insertions(+), 41 deletions(-) diff --git a/machines/congenital-optimist/configuration.nix b/machines/congenital-optimist/configuration.nix index 9b74242..b6f58fc 100644 --- a/machines/congenital-optimist/configuration.nix +++ b/machines/congenital-optimist/configuration.nix @@ -15,6 +15,9 @@ # Network modules ../../modules/network/extraHosts.nix + # Services + ../../modules/services/nfs-client.nix + # Hardware modules ../../modules/hardware/amd-workstation.nix diff --git a/machines/grey-area/configuration.nix b/machines/grey-area/configuration.nix index c9f4bf9..cbd8175 100644 --- a/machines/grey-area/configuration.nix +++ b/machines/grey-area/configuration.nix @@ -1,10 +1,12 @@ -{ config, pkgs, ... }: - { + config, + pkgs, + ... +}: { imports = [ # Hardware configuration ./hardware-configuration.nix - + # Shared modules ../../modules/common/base.nix ../../modules/network/common.nix @@ -13,7 +15,10 @@ ../../modules/virtualization/libvirt.nix ../../modules/virtualization/incus.nix ../../modules/users/sma.nix - + + # NFS client with ID mapping + ../../modules/services/nfs-client.nix + # Services ./services/jellyfin.nix ./services/calibre-web.nix @@ -32,7 +37,7 @@ boot.loader.grub.efiSupport = true; boot.loader.grub.efiInstallAsRemovable = true; boot.loader.efi.efiSysMountPoint = "/boot/"; - boot.loader.grub.device = "nodev"; + boot.loader.grub.device = "nodev"; # Disks and Updates services.fstrim.enable = true; @@ -41,7 +46,7 @@ fileSystems."/mnt/remote/media" = { device = "sleeper-service:/mnt/storage/media"; fsType = "nfs"; - options = [ + options = [ "x-systemd.automount" "x-systemd.idle-timeout=60" "x-systemd.device-timeout=10" @@ -56,14 +61,14 @@ }; # Enable all unfree hardware support. - hardware.firmware = with pkgs; [ firmwareLinuxNonfree ]; + hardware.firmware = with pkgs; [firmwareLinuxNonfree]; hardware.enableAllFirmware = true; hardware.enableRedistributableFirmware = true; nixpkgs.config.allowUnfree = true; services.fwupd.enable = true; # Networking - networking.hostName = "grey-area"; + networking.hostName = "grey-area"; networking.networkmanager.enable = true; # Set your time zone. @@ -72,7 +77,7 @@ # Text mode configuration (headless server) services.xserver.enable = false; services.displayManager.defaultSession = "none"; - boot.kernelParams = [ "systemd.unit=multi-user.target" ]; + boot.kernelParams = ["systemd.unit=multi-user.target"]; systemd.targets.graphical.enable = false; i18n.defaultLocale = "en_US.UTF-8"; @@ -82,20 +87,17 @@ }; environment.systemPackages = with pkgs; [ - ]; # Enable the OpenSSH daemon. services.openssh.enable = true; services.openssh.settings.PermitRootLogin = "no"; - services.openssh.settings.PasswordAuthentication = true; - + services.openssh.settings.PasswordAuthentication = true; # Firewall networking.firewall.enable = true; - networking.firewall.allowedTCPPorts = [ 22 3000 23231]; - networking.firewall.allowedUDPPorts = [ 22 23231 ]; + networking.firewall.allowedTCPPorts = [22 3000 23231]; + networking.firewall.allowedUDPPorts = [22 23231]; networking.nftables.enable = true; system.stateVersion = "23.05"; # Do not change this, it maintains data compatibility. - } diff --git a/machines/sleeper-service/nfs.nix b/machines/sleeper-service/nfs.nix index 3843c27..e357fd6 100644 --- a/machines/sleeper-service/nfs.nix +++ b/machines/sleeper-service/nfs.nix @@ -12,18 +12,15 @@ # Enable RPC services for NFS services.rpcbind.enable = true; - # NFSv4 ID mapping service - services.nfs.idmapd = { - enable = true; - settings = { - General = { - Domain = "home.lab"; # Same domain on all machines - Verbosity = 0; - }; - Mapping = { - Nobody-User = "nobody"; - Nobody-Group = "nogroup"; - }; + # NFSv4 ID mapping configuration + services.nfs.idmapd.settings = { + General = { + Domain = "home.lab"; # Same domain on all machines + Verbosity = 0; + }; + Mapping = { + Nobody-User = "nobody"; + Nobody-Group = "nogroup"; }; }; diff --git a/modules/services/nfs-client.nix b/modules/services/nfs-client.nix index 96e7285..b8c6295 100644 --- a/modules/services/nfs-client.nix +++ b/modules/services/nfs-client.nix @@ -13,23 +13,18 @@ with lib; { config = { # Enable NFS filesystem support - boot.supportedFilesystems = ["nfs"]; - - # Enable RPC services required for NFS + boot.supportedFilesystems = ["nfs"]; # Enable RPC services required for NFS services.rpcbind.enable = true; # NFSv4 ID mapping service - must match server configuration - services.nfs.idmapd = { - enable = true; - settings = { - General = { - Domain = "home.lab"; # Must match server domain - Verbosity = 0; - }; - Mapping = { - Nobody-User = "nobody"; - Nobody-Group = "nogroup"; - }; + services.nfs.idmapd.settings = { + General = { + Domain = "home.lab"; # Must match server domain + Verbosity = 0; + }; + Mapping = { + Nobody-User = "nobody"; + Nobody-Group = "nogroup"; }; };