Archived
beatzaplentyandClaude Sonnet 4.6
b65736c0dc
Proxmox LXC containers block the sunrpc filesystem (rpc_pipefs) via AppArmor unless the container has `features: mount=nfs` set. NFSv4 requires rpc_pipefs for client state management, so the mount fails outright in a default LXC. Two fixes for the LXC case (config.boot.isContainer): - Switch from nfsvers=4.2 to nfsvers=3,proto=tcp,nolock,nofail: NFSv3 doesn't need rpc_pipefs at the protocol level, and nofail keeps boot clean if the NFS server is unreachable. - Add ConditionVirtualization=!container to var-lib-nfs-rpc_pipefs.mount via systemd drop-in: NixOS pulls this unit into nfs-client.target for any NFS fileSystems entry. With the condition, systemd skips (not fails) the unit in containers, keeping nfs-client.target green and activation reporting clean. Proxmox VM hosts (not isContainer) continue to use nfsvers=4.2 with x-systemd.automount unchanged. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
43 lines
1.8 KiB
Nix
43 lines
1.8 KiB
Nix
{ config, lib, vars, ... }:
|
|
|
|
let
|
|
# Use the same FQDN approach as docker/mount-data.nix — a bare hostname is
|
|
# unreliable: systemd-resolved only tries LLMNR for single-label names, and
|
|
# a global search domain causes it to skip the interface-scoped LAN DNS.
|
|
nfsServer = "${vars.nfsServerHost}.${vars.homeDomain}";
|
|
in
|
|
{
|
|
fileSystems.${vars.nfsShares.proxmoxPxeImages.mountpoint} = {
|
|
device = "${nfsServer}:${vars.storageRoot}/${vars.nfsShares.proxmoxPxeImages.subpath}";
|
|
fsType = "nfs";
|
|
options = [
|
|
"_netdev"
|
|
"noatime"
|
|
] ++ (if config.boot.isContainer
|
|
# NFSv4 requires rpc_pipefs (sunrpc filesystem), which Proxmox LXC
|
|
# containers block unless `features: mount=nfs` is set. Use NFSv3+nolock
|
|
# instead: no rpc_pipefs dependency at the protocol level, and rpcbind
|
|
# on the server handles port resolution without needing client-side
|
|
# sunrpc infrastructure. nofail keeps boot clean if server is unreachable.
|
|
then [ "nfsvers=3" "proto=tcp" "nolock" "nofail" ]
|
|
else [ "nfsvers=4.2" "x-systemd.automount" ]);
|
|
};
|
|
|
|
# NixOS pulls var-lib-nfs-rpc_pipefs.mount (the sunrpc filesystem) into
|
|
# nfs-client.target for any nfs fileSystems entry. In LXC containers the
|
|
# sunrpc mount is blocked by Proxmox's AppArmor profile, causing it to fail
|
|
# and the activation to report an error even though our mount uses nofail.
|
|
# Add ConditionVirtualization=!container via drop-in so systemd skips the
|
|
# unit entirely in containers (skip = inactive, not failed), which keeps
|
|
# nfs-client.target green and activation clean.
|
|
systemd.units = lib.mkIf config.boot.isContainer {
|
|
"var-lib-nfs-rpc_pipefs.mount" = {
|
|
overrideStrategy = "asDropin";
|
|
text = ''
|
|
[Unit]
|
|
ConditionVirtualization=!container
|
|
'';
|
|
};
|
|
};
|
|
}
|