Archived
beatzaplentyandClaude Sonnet 4.6
cded77919d
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s
- variables.nix: switch to rec {}, extract giteaDomain/giteaRepoPath,
extraAdminSshKeys, haLanNfsFqdn, tailscaleResolverIp, ports.dhcp,
ports.dns; ipaServer now derives from homeDomain ref; section headers
- modules: use new vars throughout (pxe-boot, ts-dns-forwarder,
cluster-config, configuration.nix, mount-pxe-images) — eval unchanged
- docs: delete ephemeral planning docs (AUDIT_REPORT, ha-network-audit,
network-cutover); add docs/ha.md; drop migration reference table from
ip-addressing.md; remove stale server example from beszel.md
- CLAUDE.md/README.md/AGENTS.md: fix build types (tailscale-router,
ha-server, drop server); document scripts/ha/, scripts/ipa/, and
all previously undocumented top-level and lib scripts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
43 lines
1.7 KiB
Nix
43 lines
1.7 KiB
Nix
{ config, lib, vars, ... }:
|
|
|
|
let
|
|
# FQDN of the LAN NFS VIP (Pacemaker vip-lan, 192.168.2.229). Defined in
|
|
# variables.nix as haLanNfsFqdn; using the FQDN avoids systemd-resolved
|
|
# LLMNR quirks and survives a future VIP renumber via a DNS-only update.
|
|
nfsServer = vars.haLanNfsFqdn;
|
|
in
|
|
{
|
|
fileSystems.${vars.nfsShares.pxebootImages.mountpoint} = {
|
|
device = "${nfsServer}:${vars.haStorageRoot}/${vars.nfsShares.pxebootImages.subpath}";
|
|
fsType = "nfs";
|
|
options = [
|
|
"_netdev"
|
|
"noatime"
|
|
] ++ (if config.boot.isContainer
|
|
# NFSv4 requires rpc_pipefs (sunrpc filesystem), which Proxmox LXC
|
|
# containers block unless `features: mount=nfs` is set. Use NFSv3+nolock
|
|
# instead: no rpc_pipefs dependency at the protocol level, and rpcbind
|
|
# on the server handles port resolution without needing client-side
|
|
# sunrpc infrastructure. nofail keeps boot clean if server is unreachable.
|
|
then [ "nfsvers=3" "proto=tcp" "nolock" "nofail" ]
|
|
else [ "nfsvers=4.2" "x-systemd.automount" ]);
|
|
};
|
|
|
|
# NixOS pulls var-lib-nfs-rpc_pipefs.mount (the sunrpc filesystem) into
|
|
# nfs-client.target for any nfs fileSystems entry. In LXC containers the
|
|
# sunrpc mount is blocked by Proxmox's AppArmor profile, causing it to fail
|
|
# and the activation to report an error even though our mount uses nofail.
|
|
# Add ConditionVirtualization=!container via drop-in so systemd skips the
|
|
# unit entirely in containers (skip = inactive, not failed), which keeps
|
|
# nfs-client.target green and activation clean.
|
|
systemd.units = lib.mkIf config.boot.isContainer {
|
|
"var-lib-nfs-rpc_pipefs.mount" = {
|
|
overrideStrategy = "asDropin";
|
|
text = ''
|
|
[Unit]
|
|
ConditionVirtualization=!container
|
|
'';
|
|
};
|
|
};
|
|
}
|