53 lines
1.5 KiB
YAML
53 lines
1.5 KiB
YAML
---
|
|
# roles/container_isolation/tasks/nfs_client.yml
|
|
#
|
|
# Configures NFSv4 idmapping on Docker hosts so that UID/GID resolution
|
|
# works correctly across the NFS mount. Without this, all_squash or
|
|
# domain mismatches cause UIDs to resolve to nobody (65534) regardless
|
|
# of what /etc/exports says.
|
|
#
|
|
# Three things needed:
|
|
# 1. Set idmapd domain explicitly to match the NFS server (lan)
|
|
# 2. Remove the BindsTo=nfs-server.service dependency from the idmapd
|
|
# unit (client hosts don't run nfs-server, so the unit fails to start)
|
|
# 3. Enable and start nfs-idmapd
|
|
|
|
- name: Set NFSv4 idmapd domain to lan
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/idmapd.conf
|
|
regexp: '^#?\s*Domain\s*='
|
|
line: 'Domain = lan'
|
|
state: present
|
|
notify: restart nfs-idmapd
|
|
|
|
- name: Deploy fixed nfs-idmapd unit file (removes BindsTo=nfs-server.service)
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/nfs-idmapd.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
content: |
|
|
[Unit]
|
|
Description=NFSv4 ID-name mapping service
|
|
DefaultDependencies=no
|
|
Requires=rpc_pipefs.target
|
|
After=rpc_pipefs.target local-fs.target network-online.target
|
|
|
|
[Service]
|
|
Type=forking
|
|
ExecStart=/usr/sbin/rpc.idmapd
|
|
notify:
|
|
- systemd daemon reload
|
|
- restart nfs-idmapd
|
|
|
|
- name: Enable and start nfs-idmapd
|
|
ansible.builtin.systemd:
|
|
name: nfs-idmapd
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
- name: Flush NFSv4 idmap cache
|
|
ansible.builtin.command: nfsidmap -c
|
|
changed_when: false
|