From 38be6c13f76e893cf47636257071b440dec0c5b2 Mon Sep 17 00:00:00 2001
From: Robert Günzler <r@gnzler.io>
Date: Sun, 7 Sep 2025 17:32:13 +0200
Subject: initial commit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Robert Günzler <r@gnzler.io>
---
 bundles/nfs/files/exports    |  5 +++++
 bundles/nfs/files/fstab      | 17 +++++++++++++++++
 bundles/nfs/files/nfs.conf.d | 38 +++++++++++++++++++++++++++++++++++++
 bundles/nfs/items.py         | 45 ++++++++++++++++++++++++++++++++++++++++++++
 bundles/nfs/metadata.py      |  7 +++++++
 5 files changed, 112 insertions(+)
 create mode 100644 bundles/nfs/files/exports
 create mode 100644 bundles/nfs/files/fstab
 create mode 100644 bundles/nfs/files/nfs.conf.d
 create mode 100644 bundles/nfs/items.py
 create mode 100644 bundles/nfs/metadata.py

(limited to 'bundles/nfs')

diff --git a/bundles/nfs/files/exports b/bundles/nfs/files/exports
new file mode 100644
index 0000000..faa7da1
--- /dev/null
+++ b/bundles/nfs/files/exports
@@ -0,0 +1,5 @@
+/var/nfs 		100.64.0.0/10(ro,sync,insecure,no_root_squash,no_subtree_check,fsid=0)
+/var/nfs/bigdump 	*(rw,sync,insecure,no_root_squash,no_subtree_check,hide)
+/var/nfs/home-robert	*(rw,sync,insecure,all_squash,no_subtree_check,hide)
+/var/nfs/media 		*(rw,sync,insecure,no_root_squash,no_subtree_check,nohide)
+/var/nfs/public		*(ro,sync,insecure,all_squash,no_subtree_check,hide)
diff --git a/bundles/nfs/files/fstab b/bundles/nfs/files/fstab
new file mode 100644
index 0000000..0da4f54
--- /dev/null
+++ b/bundles/nfs/files/fstab
@@ -0,0 +1,17 @@
+#UUID=02214da4-00c9-4fa9-b456-59d36525ed7c	/	f2fs	rw,lazytime,relatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,alloc_mode=default,checkpoint_merge,fsync_mode=posix,discard_unit=block 0 0
+UUID=02214da4-00c9-4fa9-b456-59d36525ed7c	/	f2fs	defaults,rw	0 0
+UUID=879E-1462	/boot/efi	vfat	rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=utf8,shortname=mixed,errors=remount-ro 0 2
+UUID=f602a804-51db-4712-b01e-565ae476143c	swap	swap	defaults	0 0
+/dev/cdrom	/media/cdrom	iso9660	noauto,ro 0 0
+#/dev/usbdisk	/media/usb	vfat	noauto	0 0
+
+tmpfs /tmp tmpfs size=500G 0 0
+                                                                                                                                                             
+UUID=ef037f7d-a271-4d62-b60b-0b7bb72952ca       /media/hayasui  btrfs defaults 0 0
+UUID=9d94e642-0ed3-4b80-915c-c154daee870c       /media/bigdump  btrfs defaults 0 0
+
+UUID=5699-A10B	/media/usb	exfat defaults,uid=1000,gid=1000 0 0
+
+# nfs shares
+/media/hayasui/media    /var/nfs/media          none rbind 0 0
+/media/bigdump          /var/nfs/bigdump        none rbind 0 0
diff --git a/bundles/nfs/files/nfs.conf.d b/bundles/nfs/files/nfs.conf.d
new file mode 100644
index 0000000..f077bfc
--- /dev/null
+++ b/bundles/nfs/files/nfs.conf.d
@@ -0,0 +1,38 @@
+# /etc/conf.d/nfs
+
+# If you wish to set the port numbers for lockd,
+# please see /etc/sysctl.conf
+
+# Optional services to include in default `/etc/init.d/nfs start`
+# For NFSv4 users, you'll want to add "rpc.idmapd" here.
+NFS_NEEDED_SERVICES="rpc.idmapd"
+
+# Options to pass to rpc.nfsd
+OPTS_RPC_NFSD="--no-nfs-version 3 --nfs-version 4 8"
+
+# Options to pass to rpc.mountd
+# ex. OPTS_RPC_MOUNTD="-p 32767"
+OPTS_RPC_MOUNTD="--no-nfs-version 3 --nfs-version 4"
+
+# Options to pass to rpc.statd
+# ex. OPTS_RPC_STATD="-p 32765 -o 32766"
+OPTS_RPC_STATD=""
+
+# Options to pass to rpc.idmapd
+OPTS_RPC_IDMAPD=""
+
+# Options to pass to rpc.gssd
+OPTS_RPC_GSSD=""
+
+# Options to pass to rpc.svcgssd
+OPTS_RPC_SVCGSSD=""
+
+# Options to pass to rpc.rquotad (requires sys-fs/quota)
+OPTS_RPC_RQUOTAD=""
+
+# Timeout (in seconds) for exportfs
+EXPORTFS_TIMEOUT=30
+
+# Options to set in the nfsd filesystem (/proc/fs/nfsd/).
+# Format is <option>=<value>.  Multiple options are allowed.
+#OPTS_NFSD="nfsv4leasetime=30 max_block_size=4096"
diff --git a/bundles/nfs/items.py b/bundles/nfs/items.py
new file mode 100644
index 0000000..369dad6
--- /dev/null
+++ b/bundles/nfs/items.py
@@ -0,0 +1,45 @@
+if node.os != "alpine":
+    raise BundleError(f"{node.name}: OS {node.os} is not supported.")
+
+svc_openrc = {
+    "nfs": {
+        "enabled": True,
+        "running": True,
+        "needs": {
+            "pkg_apk:nfs-utils",
+        },
+    }
+}
+
+actions = {
+    "reload_exportfs": {
+        "command": "exportfs -afv",
+        "triggered": True,
+    },
+}
+
+directories = {
+    "/var/nfs": {},
+}
+
+files = {
+    "/etc/exports": {
+        "triggers": {
+            "svc_openrc:nfs:restart",
+            "action:reload_exportfs",
+        },
+    },
+    # "/etc/nftables.d/61-nfs.nft": {
+    #     "source": "nfs.nft",
+    #     "triggers": {"svc_openrc:nftables:restart"},
+    # }
+}
+
+# TODO:
+# https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/storage_administration_guide/s1-nfs-security#s2-nfs-security-files
+# https://overflow.adminforge.de/exchange/serverfault.com/questions/1131152/setup-sso-openldap-kerberos-nfstruenas
+# https://wiki.gentoo.org/wiki/Nfs-utils
+# https://ariq.nauf.al/blog/securely-sharing-storage-with-nfs-and-tailscale/
+# need to configure nfs service to include rpc.idmapd ?
+# https://dhole.github.io/post/nfs_wireguard/
+# https://github.com/xetdata/nfsserve ?
diff --git a/bundles/nfs/metadata.py b/bundles/nfs/metadata.py
new file mode 100644
index 0000000..26a026e
--- /dev/null
+++ b/bundles/nfs/metadata.py
@@ -0,0 +1,7 @@
+defaults = {
+    "apk": {
+        "packages": {
+            "nfs-utils": {},
+        },
+    },
+}
-- 
cgit 1.4.1