new NFS server: kobudai

flake.nix

@@ -392,6 +392,7 @@
             packages =
               # explicitly use pkgs so it doesnt collide with flake inputs
               [
+                disko.packages.${pkgs.stdenv.hostPlatform.system}.disko
                 pkgs.age
                 pkgs.agenix-rekey
                 pkgs.age-plugin-fido2-hmac

hosts/server/kobudai.nix

@@ -0,0 +1,121 @@
+{
+  networking.hostName = "kobudai";
+
+  ocf.network = {
+    enable = true;
+    bond.enable = true;
+    lastOctet = 6;
+  };
+
+  ocf.nfs-export = {
+    enable = true;
+    # https://github.com/ocf/puppet/blob/a081b2210691bd46d585accc8548c985188486a0/modules/ocf_filehost/manifests/init.pp#L10-L16
+    exports."/opt/homes" = [
+      {
+        hosts = [
+          "admin"
+          "www"
+          "ssh"
+          "apphost"
+          "adenine"
+          "guanine"
+          "cytosine"
+          "thymine"
+          "tsunami"
+          "supernova"
+        ];
+        options = [
+          "rw"
+          "fsid=0"
+          "no_subtree_check"
+          "no_root_squash"
+        ];
+      }
+      {
+        hosts = [ "*.ocf.berkeley.edu" ];
+        options = [
+          "rw"
+          "fsid=0"
+          "no_subtree_check"
+          "root_squash"
+          "sec=krb5p"
+        ];
+      }
+    ];
+  };
+
+  # FIXME remove and make sure it still boots
+  hardware.enableAllHardware = true;
+
+  disko.devices = {
+    disk = {
+      main = {
+        device = "/dev/disk/by-id/ata-Samsung_SSD_850_PRO_1TB_S252NXAGA05227F";
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "1G";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = [ "umask=0077" ];
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+
+  boot.swraid = {
+    enable = true;
+    mdadmConf = ''
+      MAILADDR root@ocf.berkeley.edu
+      ARRAY /dev/md/nfs metadata=1.2 UUID=46b10914:9f84099b:dd54304a:917d7898
+    '';
+  };
+
+  fileSystems = {
+    "/opt/homes" = {
+      device = "/dev/md/nfs";
+      fsType = "ext4";
+      options = [
+        "noatime"
+        "nodev"
+        "usrquota"
+      ];
+    };
+
+    # Bind mount /opt/homes/home to /home. This allows running
+    #     mount kobudai:/home /home
+    # In fact, since home is CNAMEd to filehost is CNAMEd to kobudai, even
+    #     mount homes:/home /home
+    # works and that's what the Puppet config in modules/ocf/manifests/nfs.pp does.
+    "/home" = {
+      device = "/opt/homes/home";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+    "/services" = {
+      device = "/opt/homes/services";
+      fsType = "none";
+      options = [ "bind" ];
+    };
+  };
+
+  nixpkgs.hostPlatform = "x86_64-linux";
+
+  system.stateVersion = "25.11";
+}

modules/managed-deployment.nix

@@ -25,6 +25,7 @@ let
     "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIPs3+fHihwZSBQVtoXffCtSSmBBDb/0NY+BPDIo+FKh9AAAABHNzaDo=" # blakeh backup hardware token
     "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1zLZffea+7TdFSQOhNBmT1hftFwPzAEK2c8siFeS/7AAAABHNzaDo=" # ericgu hardware token
     "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKtH02NTIoDXgcD5UJoxWWBu5EhHoYaP6NZQKZSIWmadAAAABHNzaDo=" # ericgu backup hardware token
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF6TAvD4mDHB7BRgCgG50IOc0417lgpYxG8qZ2d7DesV" # dotlambda
   ];
 in
 {

modules/nfs-export.nix

@@ -0,0 +1,65 @@
+{ config, lib, ... }:
+
+let
+  inherit (lib)
+    concatMapAttrsStringSep
+    concatMapStringsSep
+    concatStringsSep
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
+  cfg = config.ocf.nfs-export;
+in
+{
+  options.ocf.nfs-export = {
+    enable = mkEnableOption "NFS exports";
+    exports = mkOption {
+      type = types.attrsOf (
+        types.nonEmptyListOf (
+          types.submodule {
+            options = {
+              hosts = mkOption {
+                description = "Hosts with which the export is shared";
+                example = [
+                  "192.168.0.0/28"
+                  "*.ocf.io"
+                ];
+                type = with types; nonEmptyListOf str;
+              };
+              options = mkOption {
+                default = [ ];
+                description = "NFS options applied to the hosts";
+                example = [ "rw" ];
+                type = with types; listOf str;
+              };
+            };
+          }
+        )
+      );
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # nfs server should not be mounting nfs from itself
+    ocf.nfs.enable = lib.mkForce false;
+
+    services.nfs.server = {
+      enable = true;
+      # https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/5/html/deployment_guide/s1-nfs-server-config-exports
+      exports = concatMapAttrsStringSep "" (directory: hostsAndOptions: ''
+        ${directory} \
+          ${concatMapStringsSep " \\\n  " (
+            { hosts, options }:
+            concatMapStringsSep " \\\n  " (host: "${host}(${concatStringsSep "," options})") hosts
+          ) hostsAndOptions}
+      '') cfg.exports;
+    };
+
+    networking.firewall.allowedTCPPorts = [
+      # sufficient for NFSv4
+      2049
+    ];
+  };
+}

secrets/host-keys/kobudai.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/0C6BKkMeuHKXXA4ZEWHmXxvTRYx09dCCRMsVr+rHc