# HA file server build type: DRBD + XFS + LIO iSCSI + NFS, managed by
# Corosync + Pacemaker.  Both ha-server-1 and ha-server-2 use this type.
#
# NFS start/stop:
#   services.nfs.server.enable = true configures /etc/exports, wires up
#   rpcbind, and loads kernel modules — but nfs-server.service.wantedBy is
#   force-cleared so systemd does NOT auto-start it at boot.  Pacemaker's
#   ha-group resource group (configured by scripts/ha/cluster-init.sh)
#   starts and stops nfs-server as part of the failover sequence after the
#   XFS mount and iSCSI target are brought up on the new Active node.
#
# Beszel agent:
#   Enabled here via enable-agent.nix.  The agent KEY (used to pair with
#   the Beszel hub) is not set yet — add it to hosts/ha-server-{1,2}/host.nix
#   under services.beszel.agent.environment.KEY once the hub accepts the
#   new agents, following the pattern in hosts/server/host.nix.
{ lib, pkgs, vars, ... }:

let
  # Generates /etc/exports lines for all nfsShares data entries.
  # NFS is LAN-only (VLAN 2). Storage-client subnet (VLAN 20) uses iSCSI only.
  mkNfsExports = storageRoot:
    lib.concatMapStrings
      (share:
        "  ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n")
      (lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares));
in
{
  imports = [
    ../ha/pacemaker-stack.nix
    ../ha/iscsi-target.nix
    ../ha/cluster-config.nix
    ../beszel/enable-agent.nix
  ];

  # xfsprogs: mkfs.xfs/xfs_info needed by cluster-init.sh.
  # openiscsi: iscsiadm needed by acceptance-tests.sh T4 (iSCSI discovery check).
  environment.systemPackages = [ pkgs.xfsprogs pkgs.openiscsi ];

  services.nfs.server = {
    enable = true;
    exports = mkNfsExports vars.haStorageRoot;
  };

  # Pacemaker controls nfs-server — prevent systemd from starting it at boot
  # on both nodes (only the Active node should be serving NFS).
  systemd.services.nfs-server.wantedBy = lib.mkForce [ ];

  # Same reason as server.nix: exports use standard auth, not Kerberos.
  systemd.services.rpc-svcgssd.enable = false;
}