feat(ha): add NFS exports on storage-client network (VLAN 20)

vip-storage (192.168.20.229) now serves NFS as well as iSCSI, firewalled
to haClientCidr (192.168.20.0/24) only. This allows docker and future
swarm nodes to NFS-mount shared volumes from the storage network rather
than the LAN, keeping storage traffic off vmbr0.

LAN NFS (vip-lan 192.168.2.229) remains for pxe-boot and other LAN
clients. Protocol and subnet boundaries enforced by firewall on both nodes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2

modules/build-types/ha-server.nix

@@ -18,11 +18,14 @@
 
 let
   # Generates /etc/exports lines for all nfsShares data entries.
-  # NFS is LAN-only (VLAN 2). Storage-client subnet (VLAN 20) uses iSCSI only.
+  # LAN (VLAN 2): NFS via vip-lan (192.168.2.229) for pxe-boot and other LAN clients.
+  # Storage-client (VLAN 20): NFS via vip-storage (192.168.20.229) for docker and
+  # future swarm nodes; firewall restricts these ports to haClientCidr only.
   mkNfsExports = storageRoot:
     lib.concatMapStrings
       (share:
-        "  ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n")
+        "  ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n" +
+        "  ${storageRoot}/${share.subpath} ${vars.haClientCidr}${vars.nfsShares.options}\n")
       (lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares));
 in
 {

modules/ha/cluster-config.nix

@@ -156,6 +156,13 @@ in
       iptables -A nixos-fw -p udp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept
       iptables -A nixos-fw -p tcp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
       iptables -A nixos-fw -p udp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
+
+      iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsRpcbind} -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsRpcbind} -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s ${vars.haClientCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
     '';
   };
 }