nfs-server and mounts: share one folder at a time over the private network, mount it on demand (hq ADR 0263) #136

Merged

mesh-admin merged 9 commits from feat/mounts-module into main 2026-10-08 19:12:21 +00:00

Conversation 6 Commits 9 Files Changed 35

+7645

9 Commits

Author	SHA1	Message	Date
jochen	b8e04acfaf	Let nfs-server's tests see their folders as the library owner's, so the root refusal is tested and not tripped when the build seat runs them as root	2026-10-08 21:05:52 +02:00
jochen	29ac6ee16a	Say that the modules' own checks are the only line before root, since sudo grants the account everything	2026-10-08 20:21:28 +02:00
jochen	53cc303440	Mount a share at the access the server gave this machine, and not at all when it does not export it here	2026-10-08 20:21:17 +02:00
jochen	e50978ca45	Keep a clean look below a share for an hour, so the backup check does not walk the library every 30 s	2026-10-08 20:20:05 +02:00
jochen	8738c02d00	nfs-server: export a share only to the nodes granted and wanting it, and never root's, a symlinked or nested backup, or an unmounted dataset ... The review of #136 found a share could squash every client to root, be judged at a symlink's name rather than its folder, sit inside or above a backup repository deeper than one level, export an unmounted dataset's empty folder, go to every address in the private network's range, and stay exported after the module left. Each is now refused or closed, with a test that reproduced it first: - a folder owned by uid or gid 0 is refused; - the path is resolved through symlinks and every check runs on the real folder, which the export line names; - a share inside a backup repository (any parent) or holding one within four levels is refused, and a look cut short by its bound refuses; - every line carries mp, or mp=<its filesystem's mount point>; - a share goes only to the nodes this machine's grants setting names and whose mounts module wants it on the bus, at the lower access, at the roster's address inside the range; nothing without wants; - the process is declared before its config, so on unassignment it finds the config gone, removes its export file and lets the shares go; - confirm accepts the seat's string "true".	2026-10-08 20:20:05 +02:00
jochen	d5adc1d525	Make mounts refuse what it could break: data the mesh keeps, a busy or non-empty mount point, its own share, and a mount that is not its source; say each node's wants so the server exports only to them (review of #136)	2026-10-08 20:16:27 +02:00
jochen	48fba44471	Add the nfs-server module: a node shares a folder with the mesh's machines only, every client mapped to the folder's owner (hq ADR 0263)	2026-10-08 18:36:01 +02:00
jochen	2b1b9b0235	Let mounts write each share's mount and automount, so no node depends on a hand-written fstab line (hq ADR 0263) ... A machine mounts what its assignment names: a node's share from the provision nfs-share, whose path it reads from nfs-server's state on the bus, and occasional sources (an SMB device, a disk) whose absence is a state, not a fault. apply writes and arms the unit pairs as root; watch tries each source and judges the health; the operator's fstab lines are taken over only through adopt, on their word, once the replacement is armed. SMB logins are an outside party's secret, given with secret accept.	2026-10-08 18:36:01 +02:00
jochen	3251758340	Add a read-only mounts module: no tool could read a machine's fstab, mount units or exports	2026-10-08 18:36:01 +02:00