Archived
beatzaplenty
6847a7a6f4
Two compounding bugs, confirmed live on the running lxc-docker
container (vmid 102 on pve.sweet.home):
1. x-systemd.automount never works inside any Linux container --
systemd logs "Starting of <unit>.automount unsupported" for every
share and never mounts them. modules/docker/mount-data.nix and
modules/raspi/mount-data.nix now key off config.boot.isContainer
(set true by nixpkgs' proxmox-lxc.nix) to mount eagerly with
`nofail` there instead, while VM-based docker targets keep automount
unchanged.
2. The container's Proxmox `features` never included `mount=nfs`, so
AppArmor blanket-denies the nfs/rpc_pipefs mount syscalls NFS
needs ("permission denied"). scripts/env.sh's
PROXMOX_DEFAULT_LXC_FEATURES now includes mount=nfs;nfs4 for future
lxc-* containers -- the semicolon required quoting the --features
value in create-proxmox-resource.sh's remote pct-create command,
since it's sent as a raw string for the remote shell to parse and an
unquoted `;` would be read as a command separator.
The already-running container needs a matching `pct set --features`
plus a restart to pick this up -- that's an operator step outside this
repo.
71 lines
2.0 KiB
Nix
71 lines
2.0 KiB
Nix
{ config, lib, pkgs, vars, ... }:
|
|
|
|
let
|
|
# `x-systemd.automount` never works inside a Linux container (LXC
|
|
# included, regardless of privilege) -- confirmed live on lxc-docker:
|
|
# systemd logs "Starting of <unit>.automount unsupported" for every
|
|
# share and never mounts them. Mount eagerly there instead, with
|
|
# `nofail` so a boot with the NFS server unreachable doesn't hang
|
|
# (the VM platforms rely on automount itself to get that same
|
|
# non-blocking behavior, so they don't need `nofail` too).
|
|
automountOpts = if config.boot.isContainer then [ "nofail" ] else [ "x-systemd.automount" ];
|
|
in
|
|
{
|
|
fileSystems = {
|
|
${vars.nfsShares.dockerConfig.mountpoint} = {
|
|
device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerConfig.subpath}";
|
|
fsType = "nfs";
|
|
|
|
options = [
|
|
"nfsvers=4.2"
|
|
"_netdev"
|
|
"noatime"
|
|
] ++ automountOpts;
|
|
};
|
|
|
|
${vars.nfsShares.dockerDatabases.mountpoint} = {
|
|
device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerDatabases.subpath}";
|
|
fsType = "nfs";
|
|
|
|
options = [
|
|
"nfsvers=4.2"
|
|
"_netdev"
|
|
"noatime"
|
|
] ++ automountOpts;
|
|
};
|
|
|
|
${vars.nfsShares.dockerVolumes.mountpoint} = {
|
|
device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.dockerVolumes.subpath}";
|
|
fsType = "nfs";
|
|
|
|
options = [
|
|
"nfsvers=4.2"
|
|
"_netdev"
|
|
"noatime"
|
|
] ++ automountOpts;
|
|
};
|
|
|
|
${vars.nfsShares.nextcloudData.mountpoint} = {
|
|
device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.nextcloudData.subpath}";
|
|
fsType = "nfs";
|
|
|
|
options = [
|
|
"nfsvers=4.2"
|
|
"_netdev"
|
|
"noatime"
|
|
] ++ automountOpts;
|
|
};
|
|
|
|
${vars.nfsShares.raspiVolumes.mountpoint} = {
|
|
device = "${vars.nfsServerHost}:${vars.storageRoot}/${vars.nfsShares.raspiVolumes.subpath}";
|
|
fsType = "nfs";
|
|
|
|
options = [
|
|
"nfsvers=4.2"
|
|
"_netdev"
|
|
"noatime"
|
|
] ++ automountOpts;
|
|
};
|
|
};
|
|
}
|