feat(nfs): configure local nfs

infra/nixos/flake.nix

@@ -2,13 +2,13 @@
   description = "A simple NixOS flake";
 
   inputs = {
-    # NixOS official package source, using the nixos-24.05 branch here
+    # NixOS official package source, using the nixos-24.11 branch here
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
     # NixOS official package source, using the unstable branch here
     unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     # home-manager, used for managing user configuration
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.05";
+      url = "github:nix-community/home-manager/release-24.11";
       # The `follows` keyword in inputs is used for inheritance.
       # Here, `inputs.nixpkgs` of home-manager is kept consistent with
       # the `inputs.nixpkgs` of the current flake,

infra/nixos/hosts/kube-nas/configuration.nix

@@ -144,5 +144,7 @@
     "d /mnt/volume1/home/alex 0770 alex users"
     "d /mnt/volume1/home/dominik 0770 dominik users"
     "d /mnt/volume1/minio 0755 568 568" # 568 is the minio user
+    "d /mnt/volume1/nfs-csi 0750 root users"
+    "d /mnt/volume1/nfs-csi/kube-nas 0770 kube users"
   ];
 }

infra/nixos/hosts/kube-nas/hardware-configuration.nix

@@ -64,6 +64,11 @@
     options = [ "bind" ];
   };
 
+  fileSystems."/export/nfs-csi" = {
+    device = "/mnt/volume1/nfs-csi";
+    options = [ "bind" ];
+  };
+
 
   swapDevices = [ ];
 

infra/nixos/hosts/kube-nas/nfs.nix

@@ -8,14 +8,15 @@
 
   services.nfs.server.enable = true;
   services.nfs.server.exports = ''
-    /export/home/nils       192.168.1.20(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1000,anongid=100) 192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
-    /export/home/jasmin     192.168.1.20(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1000,anongid=100) 192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
-    /export/backup/nils     192.168.1.20(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1000,anongid=100) 192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
-    /export/backup/jasmin   192.168.1.20(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1000,anongid=100) 192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
-    /export/data/csi        192.168.1.51(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.52(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.53(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.54(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.55(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100)
-    /export/data/downloads  192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.11(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.51(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.52(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.53(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.54(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.55(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534)
-    /export/data/fotos      192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.11(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
-    /export/data/syncthing  192.168.1.51(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.52(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.53(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.54(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.55(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100)
-    /export/data/scans      192.168.1.51(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.52(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.53(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.54(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.55(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100)
+    /export/home/nils         192.168.1.20(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1000,anongid=100) 192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
+    /export/home/jasmin       192.168.1.20(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1000,anongid=100) 192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
+    /export/backup/nils       192.168.1.20(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1000,anongid=100) 192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
+    /export/backup/jasmin     192.168.1.20(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1000,anongid=100) 192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
+    /export/data/csi          192.168.1.51(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.52(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.53(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.54(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.55(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100)
+    /export/data/downloads    192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.11(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.51(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.52(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.53(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.54(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534) 192.168.1.55(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=65534,anongid=65534)
+    /export/data/fotos        192.168.1.10(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.11(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100) 192.168.1.12(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1001,anongid=100)
+    /export/data/syncthing    192.168.1.51(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.52(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.53(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.54(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.55(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100)
+    /export/data/scans        192.168.1.51(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.52(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.53(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.54(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100) 192.168.1.55(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100)
+    /export/nfs-csi/kube-nas  192.168.1.60(rw,async,no_wdelay,nohide,no_subtree_check,insecure,all_squash,insecure_locks,sec=sys,anonuid=1004,anongid=100)
   '';
 }

kubernetes/kube-nas/apps/backup-system/kustomization.yaml

@@ -4,4 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
-  - volsync/flux-sync.yaml
+  - ./snapshot-controller/flux-sync.yaml
+  - ./volsync/flux-sync.yaml

kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app/kustomization.yaml → kubernetes/kube-nas/apps/backup-system/snapshot-controller/app/kustomization.yaml

@@ -3,4 +3,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./helm-release.yaml
+  - helm-release.yaml

kubernetes/kube-nas/apps/kube-tools/snapshot-controller/flux-sync.yaml → kubernetes/kube-nas/apps/backup-system/snapshot-controller/flux-sync.yaml

@@ -8,14 +8,16 @@ metadata:
   labels:
     substitution.flux.home.arpa/enabled: "true"
 spec:
+  targetNamespace: backup-system
   commonMetadata:
     labels:
       app.kubernetes.io/name: *appname
-  targetNamespace: kube-tools
-  interval: 10m
-  path: ./kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app
+  path: ./kubernetes/kube-nas/apps/backup-system/snapshot-controller/app
   prune: true
   sourceRef:
     kind: GitRepository
     name: home-ops
   wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

kubernetes/kube-nas/apps/kube-system/csi-driver-nfs/app/helm-release.yaml

@@ -0,0 +1,35 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: csi-driver-nfs
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: csi-driver-nfs
+      version: v4.10.0
+      sourceRef:
+        kind: HelmRepository
+        name: csi-driver-nfs-charts
+        namespace: flux-system
+  maxHistory: 3
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    # https://artifacthub.io/packages/helm/csi-driver-nfs/csi-driver-nfs?modal=values
+    externalSnapshotter:
+      enabled: false
+    volumeSnapshotClass:
+      create: true
+      name: nfs-snapshot
+      deletionPolicy: Delete

kubernetes/kube-nas/apps/kube-system/csi-driver-nfs/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
+  - storage-class.yaml

kubernetes/kube-nas/apps/kube-system/csi-driver-nfs/app/storage-class.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-local
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.60
+  share: /export/nfs-csi/kube-nas
+reclaimPolicy: Delete
+volumeBindingMode: WaitForFirstConsumer
+allowVolumeExpansion: true
+mountOptions:
+  - nfsvers=4.1
+  - nconnect=8
+  - hard
+  - noatime
+  - tcp
+  - timeo=600
+  - retrans=2

kubernetes/kube-nas/apps/kube-system/csi-driver-nfs/flux-sync.yaml

@@ -0,0 +1,25 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &appname csi-driver-nfs
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *appname
+  path: ./kubernetes/kube-nas/apps/kube-system/csi-driver-nfs/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-ops
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  dependsOn:
+    - name: snapshot-controller

kubernetes/kube-nas/apps/kube-tools/kustomization.yaml

@@ -3,6 +3,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./namespace.yaml
+  - namespace.yaml
   - ./reloader/flux-sync.yaml
-  - ./snapshot-controller/flux-sync.yaml