From 40cdf724b44c1c42a0b1ca4ca1a2ae5d7f2aee55 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Wed, 29 Jul 2026 12:51:50 +1000 Subject: [PATCH] fix(nfs): mask rpc-svcgssd on server and ha-server build types nfs-utils changed ConditionPathExists from !/etc/krb5.keytab to /etc/krb5.keytab, so on IPA-joined hosts the service now starts instead of skipping. Exports use standard auth (no sec=krb5) so the nfs/ Kerberos principal is never provisioned and the service fails. enable = false masks the unit so nfs-server's Wants= can't pull it in. Co-Authored-By: Claude Sonnet 4.6 --- modules/build-types/ha-server.nix | 3 +++ modules/build-types/server.nix | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/modules/build-types/ha-server.nix b/modules/build-types/ha-server.nix index b4ed7b0..079298c 100644 --- a/modules/build-types/ha-server.nix +++ b/modules/build-types/ha-server.nix @@ -45,4 +45,7 @@ in # Pacemaker controls nfs-server — prevent systemd from starting it at boot # on both nodes (only the Active node should be serving NFS). systemd.services.nfs-server.wantedBy = lib.mkForce [ ]; + + # Same reason as server.nix: exports use standard auth, not Kerberos. + systemd.services.rpc-svcgssd.enable = false; } diff --git a/modules/build-types/server.nix b/modules/build-types/server.nix index 2bdd522..1a5d4b1 100644 --- a/modules/build-types/server.nix +++ b/modules/build-types/server.nix @@ -102,6 +102,12 @@ in requires = [ "zfs-mount.service" ]; }; + # rpc-svcgssd handles Kerberos/GSS-API for NFS. Not needed: exports use + # standard auth, not sec=krb5. On IPA-joined hosts the keytab exists (host/ + # principal only) but has no nfs/ principal, causing spurious failure. + # Mask it so nfs-server's Wants= can't pull it in. + systemd.services.rpc-svcgssd.enable = false; + services.nfs.server = { enable = true; exports = mkNfsExports vars.storageRoot; -- 2.54.0