nfsid changes

roles/container_isolation/handlers/main.yml

@@ -0,0 +1,16 @@
+---
+# roles/container_isolation/handlers/main.yml
+
+- name: systemd daemon reload
+  ansible.builtin.systemd:
+    daemon_reload: true
+
+- name: restart nfs-idmapd
+  ansible.builtin.systemd:
+    name: nfs-idmapd
+    state: restarted
+  notify: flush idmap cache
+
+- name: flush idmap cache
+  ansible.builtin.command: nfsidmap -c
+  changed_when: false

roles/container_isolation/tasks/main.yml

@@ -7,3 +7,6 @@
 - name: Add jerick to every app and shared group (all hosts)
   import_tasks: jerick_access.yml
 
+- name: Configure NFSv4 idmapping (all hosts)
+  import_tasks: nfs_client.yml
+

roles/container_isolation/tasks/nfs_client.yml

@@ -0,0 +1,52 @@
+---
+# roles/container_isolation/tasks/nfs_client.yml
+#
+# Configures NFSv4 idmapping on Docker hosts so that UID/GID resolution
+# works correctly across the NFS mount. Without this, all_squash or
+# domain mismatches cause UIDs to resolve to nobody (65534) regardless
+# of what /etc/exports says.
+#
+# Three things needed:
+# 1. Set idmapd domain explicitly to match the NFS server (lan)
+# 2. Remove the BindsTo=nfs-server.service dependency from the idmapd
+#    unit (client hosts don't run nfs-server, so the unit fails to start)
+# 3. Enable and start nfs-idmapd
+
+- name: Set NFSv4 idmapd domain to lan
+  ansible.builtin.lineinfile:
+    path: /etc/idmapd.conf
+    regexp: '^#?\s*Domain\s*='
+    line: 'Domain = lan'
+    state: present
+  notify: restart nfs-idmapd
+
+- name: Deploy fixed nfs-idmapd unit file (removes BindsTo=nfs-server.service)
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/nfs-idmapd.service
+    owner: root
+    group: root
+    mode: '0644'
+    content: |
+      [Unit]
+      Description=NFSv4 ID-name mapping service
+      DefaultDependencies=no
+      Requires=rpc_pipefs.target
+      After=rpc_pipefs.target local-fs.target network-online.target
+
+      [Service]
+      Type=forking
+      ExecStart=/usr/sbin/rpc.idmapd
+  notify:
+    - systemd daemon reload
+    - restart nfs-idmapd
+
+- name: Enable and start nfs-idmapd
+  ansible.builtin.systemd:
+    name: nfs-idmapd
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Flush NFSv4 idmap cache
+  ansible.builtin.command: nfsidmap -c
+  changed_when: false