From e882d1128dfa1081d42b641f98d61f005eb9aab9 Mon Sep 17 00:00:00 2001 From: paspo Date: Sun, 22 May 2016 12:37:56 +0200 Subject: [PATCH] NFS server support (home directory only) --- roles/client-install/meta/main.yml | 1 + roles/nfs-server/files/access.ldif | 9 +++++ roles/nfs-server/files/nfsd.conf | 1 + roles/nfs-server/tasks/main.yml | 3 ++ roles/nfs-server/tasks/nfs-server.yml | 54 +++++++++++++++++++++++++++ roles/nfs-server/templates/exports | 1 + 6 files changed, 69 insertions(+) create mode 100644 roles/nfs-server/files/access.ldif create mode 100644 roles/nfs-server/files/nfsd.conf create mode 100644 roles/nfs-server/tasks/main.yml create mode 100644 roles/nfs-server/tasks/nfs-server.yml create mode 100644 roles/nfs-server/templates/exports diff --git a/roles/client-install/meta/main.yml b/roles/client-install/meta/main.yml index ca23720..3fff349 100644 --- a/roles/client-install/meta/main.yml +++ b/roles/client-install/meta/main.yml @@ -7,3 +7,4 @@ dependencies: - { role: doraemon, tags: [ 'client-install' ] } - { role: npm, tags: [ 'client-install' ] } - { role: git-daemon, tags: [ 'client-install' ] } + - { role: nfs-server, tags: [ 'client-install' ] } diff --git a/roles/nfs-server/files/access.ldif b/roles/nfs-server/files/access.ldif new file mode 100644 index 0000000..06bc71b --- /dev/null +++ b/roles/nfs-server/files/access.ldif @@ -0,0 +1,9 @@ +dn: olcDatabase={2}bdb,cn=config +changetype: modify +replace: olcAccess +olcAccess: {0}to attrs=sambaNTPassword by dn.exact="gidNumber=0+uidNumber=0,cn + =peercred,cn=external,cn=auth" manage by dn.exact="cn=samba,dc=directory,dc=n + h" peername.ip="127.0.0.1" write by self write by * none +olcAccess:: ezF9dG8gYXR0cnM9dXNlclBhc3N3b3JkIA0KIGJ5IGRuLmV4YWN0PSJnaWROdW1iZXI9MCt1aWROdW1iZXI9MCxjbj1wZWVyY3JlZCxjbj1leHRlcm5hbCxjbj1hdXRoIiBtYW5hZ2UNCiBieSBkbi5leGFjdD0iY249cGFtLGRjPWRpcmVjdG9yeSxkYz1uaCIgcGVlcm5hbWUucGF0aD0iL3Zhci9ydW4vbGRhcGkiIHdyaXRlIA0KIGJ5IGRuLmV4YWN0PSJjbj1saWJ1c2VyLGRjPWRpcmVjdG9yeSxkYz1uaCIgcGVlcm5hbWUuaXA9IjEyNy4wLjAuMSIgd3JpdGUNCiBieSBhbm9ueW1vdXMgYXV0aCANCiBieSBzZWxmIHdyaXRlIA0KIGJ5ICogbm9uZQ== +olcAccess:: ezJ9dG8gZG4uYmFzZT0iIg0KIGJ5ICogcmVhZA== +olcAccess:: ezN9dG8gKg0KIGJ5IHNlbGYgd3JpdGUNCiBieSBkbi5leGFjdD0iZ2lkTnVtYmVyPTArdWlkTnVtYmVyPTAsY249cGVlcmNyZWQsY249ZXh0ZXJuYWwsY249YXV0aCIgbWFuYWdlDQogYnkgZG4uZXhhY3Q9ImNuPXNhbWJhLGRjPWRpcmVjdG9yeSxkYz1uaCIgcGVlcm5hbWUuaXA9IjEyNy4wLjAuMSIgd3JpdGUgDQogYnkgZG4uZXhhY3Q9ImNuPXBhbSxkYz1kaXJlY3RvcnksZGM9bmgiIHBlZXJuYW1lLnBhdGg9Ii92YXIvcnVuL2xkYXBpIiB3cml0ZSANCiBieSBkbi5leGFjdD0iY249bGlidXNlcixkYz1kaXJlY3RvcnksZGM9bmgiIHBlZXJuYW1lLmlwPSIxMjcuMC4wLjEiIHdyaXRlIA0KIGJ5IHVzZXJzIHNzZj03MSByZWFkIA0KIGJ5ICogcmVhZA== diff --git a/roles/nfs-server/files/nfsd.conf b/roles/nfs-server/files/nfsd.conf new file mode 100644 index 0000000..b0ffc3d --- /dev/null +++ b/roles/nfs-server/files/nfsd.conf @@ -0,0 +1 @@ +options nfsd nfs4_disable_idmapping=1 diff --git a/roles/nfs-server/tasks/main.yml b/roles/nfs-server/tasks/main.yml new file mode 100644 index 0000000..a7ff2d5 --- /dev/null +++ b/roles/nfs-server/tasks/main.yml @@ -0,0 +1,3 @@ +--- +- include: nfs-server.yml + tags: nfs-server diff --git a/roles/nfs-server/tasks/nfs-server.yml b/roles/nfs-server/tasks/nfs-server.yml new file mode 100644 index 0000000..636e591 --- /dev/null +++ b/roles/nfs-server/tasks/nfs-server.yml @@ -0,0 +1,54 @@ +--- +# Install and configure nfs server + +- name: Installing nfs-utils + yum: pkg=nfs-utils state=present + become: yes + +- name: Activating NFS at boot + shell: /sbin/chkconfig nfs on + become: yes + +- name: Configuring exports + template: src='preseed/exports' dest='/etc/exports' + become: yes + +- name: Copy LDIF access file + copy: src=files/access.ldif dest=/tmp/access.ldif + become: yes + +- name: Enable LDAP external access + shell: /usr/bin/ldapmodify -Y EXTERNAL -f /tmp/access.ldif + become: yes + +- name: Remove LDIF access file + shell: /bin/rm /tmp/access.ldif + become: yes + +## TODO: (maybe) add port 111? (rpcbind) +- name: Configuring firewall service for NFS + shell: /sbin/e-smith/db configuration set nfs service TCPPort 2049 UDPPort 2049 status enabled access private + become: yes + +- name: Reloading firewall configuration + shell: /sbin/e-smith/signal-event firewall-adjust + become: yes + +- name: Reloading runlevel configuration + shell: /sbin/e-smith/signal-event runlevel-adjust + become: yes + +- name: Disable NFS4 id mapping at boot + copy: src=files/nfsd.conf dest=/etc/modules.d/nfsd.conf + become: yes + +- name: Disable NFS4 id mapping + shell: /bin/echo Y > /sys/module/nfsd/parameters/nfs4_disable_idmapping + +- name: Reloading NFS exports + shell: /usr/sbin/exportfs -ra + become: yes + +- name: Restarting NFS server + shell: /sbin/service nfs restart + become: yes diff --git a/roles/nfs-server/templates/exports b/roles/nfs-server/templates/exports new file mode 100644 index 0000000..9c61ff5 --- /dev/null +++ b/roles/nfs-server/templates/exports @@ -0,0 +1 @@ +/var/lib/nethserver/home {{ ansible_local.domain.servernet }}/{{ ansible_local.domain.servernetmask }}(rw,no_root_squash,sync,no_subtree_check)