Merge pull request 'fix(lxc-pxe-boot): make privileged so NFS mounts work' (#78) from worktree-debian-pxe into main

Reviewed-on: #78

modules/platforms/lxc.nix

@@ -63,23 +63,22 @@ in
     # back to decide `pct create`'s --unprivileged flag, so the two stay
     # in sync).
     #
-    # lxc-docker is the one exception: the kernel's NFS client doesn't set
-    # FS_USERNS_MOUNT, so mounting NFS from inside *any* non-init user
-    # namespace -- which is exactly what an unprivileged container's
-    # UID-mapped root runs in -- is rejected at the VFS layer with EPERM,
-    # no matter what Proxmox's own `mount=nfs;nfs4` container feature
-    # allows at the AppArmor layer (confirmed live: TCP to the NFS server
-    # succeeds, the server's export table matches the container's IP, and
-    # `mount.nfs: Operation not permitted` still fires immediately with no
-    # corresponding denial anywhere in the server's logs -- a kernel-level
-    # rejection, not a network or export-permission one). Keying off
-    # hostName rather than something docker-build-type-specific because
-    # modules/build-types/docker.nix is also composed for linode-docker/
-    # proxmox-docker, which don't import proxmox-lxc.nix at all --setting
-    # this option there would break their eval with "option does not
-    # exist" regardless of any mkIf guard, since mkIf only makes a value
-    # conditional, not whether the option needs to exist somewhere.
-    privileged = config.networking.hostName == "docker";
+    # Any lxc-* host with an NFS fileSystem must be privileged: the kernel's
+    # NFS client doesn't set FS_USERNS_MOUNT, so mounting NFS from inside
+    # *any* non-init user namespace -- which is exactly what an unprivileged
+    # container's UID-mapped root runs in -- is rejected at the VFS layer
+    # with EPERM, no matter what Proxmox's own `mount=nfs;nfs4` container
+    # feature allows at the AppArmor layer (confirmed live: TCP to the NFS
+    # server succeeds, the server's export table matches the container's IP,
+    # and `mount.nfs: Operation not permitted` still fires immediately with
+    # no corresponding denial anywhere in the server's logs -- a kernel-level
+    # rejection, not a network or export-permission one). Deriving this from
+    # fileSystems rather than a per-host override keeps it self-consistent:
+    # any new lxc-* host that declares an NFS mount automatically gets the
+    # privilege level it needs without a separate manual flag.
+    privileged = builtins.any
+      (fs: fs.fsType == "nfs" || fs.fsType == "nfs4")
+      (builtins.attrValues config.fileSystems);
   };
 
   boot.loader = {