From 3c28d48bc75b5c9ac131440f1d57398af7ddc7bc Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Wed, 29 Jul 2026 18:55:25 +1000 Subject: [PATCH] feat(ha): add NFS exports on storage-client network (VLAN 20) vip-storage (192.168.20.229) now serves NFS as well as iSCSI, firewalled to haClientCidr (192.168.20.0/24) only. This allows docker and future swarm nodes to NFS-mount shared volumes from the storage network rather than the LAN, keeping storage traffic off vmbr0. LAN NFS (vip-lan 192.168.2.229) remains for pxe-boot and other LAN clients. Protocol and subnet boundaries enforced by firewall on both nodes. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2 --- modules/build-types/ha-server.nix | 7 +++++-- modules/ha/cluster-config.nix | 7 +++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/modules/build-types/ha-server.nix b/modules/build-types/ha-server.nix index 5af6c51..2bdca39 100644 --- a/modules/build-types/ha-server.nix +++ b/modules/build-types/ha-server.nix @@ -18,11 +18,14 @@ let # Generates /etc/exports lines for all nfsShares data entries. - # NFS is LAN-only (VLAN 2). Storage-client subnet (VLAN 20) uses iSCSI only. + # LAN (VLAN 2): NFS via vip-lan (192.168.2.229) for pxe-boot and other LAN clients. + # Storage-client (VLAN 20): NFS via vip-storage (192.168.20.229) for docker and + # future swarm nodes; firewall restricts these ports to haClientCidr only. mkNfsExports = storageRoot: lib.concatMapStrings (share: - " ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n") + " ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n" + + " ${storageRoot}/${share.subpath} ${vars.haClientCidr}${vars.nfsShares.options}\n") (lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares)); in { diff --git a/modules/ha/cluster-config.nix b/modules/ha/cluster-config.nix index e7a6003..7fe7823 100644 --- a/modules/ha/cluster-config.nix +++ b/modules/ha/cluster-config.nix @@ -156,6 +156,13 @@ in iptables -A nixos-fw -p udp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept iptables -A nixos-fw -p tcp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept iptables -A nixos-fw -p udp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept + + iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsRpcbind} -j nixos-fw-accept + iptables -A nixos-fw -p udp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsRpcbind} -j nixos-fw-accept + iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept + iptables -A nixos-fw -p udp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept + iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept + iptables -A nixos-fw -p udp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept ''; }; }