---
# roles/container_isolation/tasks/nfs_client.yml
#
# Configures NFSv4 idmapping on Docker hosts so that UID/GID resolution
# works correctly across the NFS mount. Without this, all_squash or
# domain mismatches cause UIDs to resolve to nobody (65534) regardless
# of what /etc/exports says.
#
# Three things needed:
# 1. Set idmapd domain explicitly to match the NFS server (lan)
# 2. Remove the BindsTo=nfs-server.service dependency from the idmapd
#    unit (client hosts don't run nfs-server, so the unit fails to start)
# 3. Enable and start nfs-idmapd

- name: Set NFSv4 idmapd domain to lan
  ansible.builtin.lineinfile:
    path: /etc/idmapd.conf
    regexp: '^#?\s*Domain\s*='
    line: 'Domain = lan'
    state: present
  notify: restart nfs-idmapd

- name: Deploy fixed nfs-idmapd unit file (removes BindsTo=nfs-server.service)
  ansible.builtin.copy:
    dest: /etc/systemd/system/nfs-idmapd.service
    owner: root
    group: root
    mode: '0644'
    content: |
      [Unit]
      Description=NFSv4 ID-name mapping service
      DefaultDependencies=no
      Requires=rpc_pipefs.target
      After=rpc_pipefs.target local-fs.target network-online.target

      [Service]
      Type=forking
      ExecStart=/usr/sbin/rpc.idmapd
  notify:
    - systemd daemon reload
    - restart nfs-idmapd

- name: Enable and start nfs-idmapd
  ansible.builtin.systemd:
    name: nfs-idmapd
    enabled: true
    state: started
    daemon_reload: true

- name: Flush NFSv4 idmap cache
  ansible.builtin.command: nfsidmap -c
  changed_when: false