27 lines
1.6 KiB
Text
27 lines
1.6 KiB
Text
|
# /etc/exports — NFS export configuration for Proxmox VE host
|
||
|
|
# Managed in git: infra/scripts/pve-nfs-exports
|
||
|
|
# Deploy: scp scripts/pve-nfs-exports root@192.168.1.127:/etc/exports && ssh root@192.168.1.127 exportfs -ra
|
||
|
|
#
|
||
|
|
# CRITICAL NOTES (learned from 2026-04-14 outage [PM-2026-04-14]):
|
||
|
|
# - NEVER add fsid=0 to /srv/nfs or /srv/nfs-ssd exports. fsid=0 designates the
|
||
|
|
# NFSv4 pseudo-root which changes path resolution for ALL subdirectory mounts.
|
||
|
|
# When CSI mounts use paths like /srv/nfs/technitium, fsid=0 makes them resolve
|
||
|
|
# as the root itself, causing ENOENT on all subdirectory mounts.
|
||
|
|
# - fsid=1 is acceptable on /srv/nfs-ssd (unique ID, not root).
|
||
|
|
# - The NFS CSI driver mounts subdirectories — never use fsid=0 on any export
|
||
|
|
# that serves dynamic path mounts.
|
||
|
|
# - NFSv3 is disabled on this host (vers3=n in /etc/nfs.conf) — all k8s mounts
|
||
|
|
# must use nfsvers=4 mount option.
|
||
|
|
#
|
||
|
|
# Mount options explanation:
|
||
|
|
# rw — read/write access (required for PVCs)
|
||
|
|
# async — async writes safe: UPS protects host + Vault Raft replication +
|
||
|
|
# databases on block storage. Only NFS metadata at risk.
|
||
|
|
# no_subtree_check — disable subtree checking for performance and reliability
|
||
|
|
# no_root_squash — k8s CSI driver runs as root; squashing breaks PVC writes
|
||
|
|
# insecure — allow source ports >1024 (required: pfSense VLAN NAT uses
|
||
|
|
# unprivileged ports for VLAN 10 → 192.168.1.x traffic)
|
||
|
|
#
|
||
|
|
/srv/nfs *(rw,async,no_subtree_check,no_root_squash,insecure)
|
||
|
|
/srv/nfs-ssd *(rw,sync,no_subtree_check,no_root_squash,insecure,fsid=1)
|