mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
ryan4yin | 二花
3acb5d4ee5
* fix(nfs): restrict the golden export to its real clients * fix(libvirt): bind VNC consoles to loopback * fix(firewall): drop VNC ports on every host * docs(security): record the NFS and VNC boundaries
44 lines
1.5 KiB
Nix
44 lines
1.5 KiB
Nix
{
|
|
myvars,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
# Shared golden-image store for the VM cluster. It is exported over NFSv4 so
|
|
# the cluster's NFS CSI driver can hand out RWX volumes to every node, and VM
|
|
# disks are cloned from it into local-path.
|
|
#
|
|
# It lives on the encrypted btrfs pool (/persistent), which has plenty of
|
|
# free space on this host.
|
|
goldenDir = "/persistent/nfs/golden";
|
|
|
|
# Only the hosts that actually mount the export may reach it: every k3s node
|
|
# runs the NFS CSI node plugin, and the VM hosts clone golden disks by hand.
|
|
# The rest of the LAN is not a client.
|
|
k3sNodes = lib.filterAttrs (name: _: lib.hasPrefix "k3s-test-1-" name) myvars.networking.hostsAddr;
|
|
clients = [
|
|
myvars.networking.hostsAddr.shoryu.ipv4
|
|
myvars.networking.hostsAddr.shushou.ipv4
|
|
myvars.networking.hostsAddr.youko.ipv4
|
|
]
|
|
++ lib.mapAttrsToList (_: v: v.ipv4) k3sNodes;
|
|
|
|
exportOpts = "rw,sync,no_subtree_check,fsid=0,no_root_squash";
|
|
in
|
|
{
|
|
# Make sure the export directory exists before the NFS server starts.
|
|
systemd.tmpfiles.rules = [
|
|
"d ${goldenDir} 0755 root root -"
|
|
];
|
|
|
|
services.nfs.server.enable = true;
|
|
services.nfs.server.exports = lib.concatStringsSep "\n" (
|
|
map (client: "${goldenDir} ${client}(${exportOpts})") clients
|
|
);
|
|
|
|
# NFSv4 only needs 2049/tcp (no rpcbind/mountd/statd). The export is limited
|
|
# to the hosts above, not the whole LAN. `no_root_squash` stays until the
|
|
# existing root-owned PVC subdirectories are migrated for `root_squash`; see
|
|
# SECURITY.md.
|
|
}
|