Archived
beatzaplentyandClaude Sonnet 4.6
3c28d48bc7
Check NixOS configurations / eval-hosts (push) Successful in 10m32s
vip-storage (192.168.20.229) now serves NFS as well as iSCSI, firewalled to haClientCidr (192.168.20.0/24) only. This allows docker and future swarm nodes to NFS-mount shared volumes from the storage network rather than the LAN, keeping storage traffic off vmbr0. LAN NFS (vip-lan 192.168.2.229) remains for pxe-boot and other LAN clients. Protocol and subnet boundaries enforced by firewall on both nodes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2
55 lines
2.3 KiB
Nix
55 lines
2.3 KiB
Nix
# HA file server build type: DRBD + XFS + LIO iSCSI + NFS, managed by
|
|
# Corosync + Pacemaker. Both ha-server-1 and ha-server-2 use this type.
|
|
#
|
|
# NFS start/stop:
|
|
# services.nfs.server.enable = true configures /etc/exports, wires up
|
|
# rpcbind, and loads kernel modules — but nfs-server.service.wantedBy is
|
|
# force-cleared so systemd does NOT auto-start it at boot. Pacemaker's
|
|
# ha-group resource group (configured by scripts/ha/cluster-init.sh)
|
|
# starts and stops nfs-server as part of the failover sequence after the
|
|
# XFS mount and iSCSI target are brought up on the new Active node.
|
|
#
|
|
# Beszel agent:
|
|
# Enabled here via enable-agent.nix. The agent KEY (used to pair with
|
|
# the Beszel hub) is not set yet — add it to hosts/ha-server-{1,2}/host.nix
|
|
# under services.beszel.agent.environment.KEY once the hub accepts the
|
|
# new agents, following the pattern in hosts/server/host.nix.
|
|
{ lib, pkgs, vars, ... }:
|
|
|
|
let
|
|
# Generates /etc/exports lines for all nfsShares data entries.
|
|
# LAN (VLAN 2): NFS via vip-lan (192.168.2.229) for pxe-boot and other LAN clients.
|
|
# Storage-client (VLAN 20): NFS via vip-storage (192.168.20.229) for docker and
|
|
# future swarm nodes; firewall restricts these ports to haClientCidr only.
|
|
mkNfsExports = storageRoot:
|
|
lib.concatMapStrings
|
|
(share:
|
|
" ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n" +
|
|
" ${storageRoot}/${share.subpath} ${vars.haClientCidr}${vars.nfsShares.options}\n")
|
|
(lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares));
|
|
in
|
|
{
|
|
imports = [
|
|
../ha/pacemaker-stack.nix
|
|
../ha/iscsi-target.nix
|
|
../ha/cluster-config.nix
|
|
../beszel/enable-agent.nix
|
|
];
|
|
|
|
# xfsprogs: mkfs.xfs/xfs_info needed by cluster-init.sh.
|
|
# openiscsi: iscsiadm needed by acceptance-tests.sh T4 (iSCSI discovery check).
|
|
environment.systemPackages = [ pkgs.xfsprogs pkgs.openiscsi ];
|
|
|
|
services.nfs.server = {
|
|
enable = true;
|
|
exports = mkNfsExports vars.haStorageRoot;
|
|
};
|
|
|
|
# Pacemaker controls nfs-server — prevent systemd from starting it at boot
|
|
# on both nodes (only the Active node should be serving NFS).
|
|
systemd.services.nfs-server.wantedBy = lib.mkForce [ ];
|
|
|
|
# Same reason as server.nix: exports use standard auth, not Kerberos.
|
|
systemd.services.rpc-svcgssd.enable = false;
|
|
}
|