Daaamn NFS is a pain

config/host-config/limina.nix

@@ -134,7 +134,7 @@ in {
       "L /root/.ssh/known_hosts - - - - /state/root/ssh/known_hosts"
     ];
 
-    security.acme.certs."sea-camera.fudo.link".email = "niten@fudo.org";
+    # security.acme.certs."sea-camera.fudo.link".email = "niten@fudo.org";
 
     networking.firewall.allowedTCPPorts = [ 80 443 ];
 

config/host-config/nostromo.nix

@@ -19,23 +19,8 @@ in {
     };
   };
 
-  # fudo = {
-  #   secrets."backplane-client-${hostname}-passwd" = {
-  #     source-file = toPath "/srv/secrets/backplane-client/${hostname}.passwd";
-  #     target-file = "/srv/backplane/dns/client.passwd";
-  #     target-host = "${hostname}";
-  #     user = config.fudo.client.dns.user;
-  #   };
-
-  #   client.dns = {
-  #     enable = true;
-  #     ipv4 = false;
-  #     ipv6 = true;
-  #     user = "fudo-client";
-  #     external-interface = "extif0";
-  #     password-file = secrets."backplane-client-${hostname}-passwd".target-file;
-  #   };
-  # };
+  # Hopefully this'll help with NFS...
+  boot.kernelModules = [ "rpcsec_gss_krb5" ];
 
   fudo.hosts.nostromo.encrypted-filesystems.sea-store = {
     encrypted-device = "/dev/nostromo-store/locked";
@@ -43,15 +28,42 @@ in {
     filesystem-type = "btrfs";
     options = [ "noatime" "nodiratime" "compress=zstd" "noexec" ];
     mountpoints = {
-      "/export/downloads" = {
-        options = [ "subvol=@downloads" ];
-      };
       "/export/documents" = {
         options = [ "subvol=@documents" ];
+        group = "sea-documents";
+        users = [ "niten" ];
+      };
+      "/export/downloads" = {
+        options = [ "subvol=@downloads" ];
+        group = "sea-downloads";
+        users = [ "niten" ];
       };
     };
   };
 
+  services.nfs = {
+    # See lib/fudo/users.nix for the user@REALM -> user mapping
+    server = {
+      enable = true;
+      createMountPoints = false;
+      exports = let
+        exportList = [
+          "/export/documents 10.0.0.0/24 (rw,sync,root_squash,no_subtree_check,fsid=10,sec=krb5p)"
+          "/export/downloads 10.0.0.0/24 (rw,sync,root_squash,no_subtree_check,fsid=11,sec=krb5i)"
+        ];
+      in ''
+        ${concatStringsSep "\n" exportList}
+      '';
+    };
+  };
+
+  systemd.services.nfs-server = {
+    # Don't start in on boot
+    wantedBy = mkForce [ "sea-store.target" ];
+    # Only start after filesystem mounts are available
+    after = [ "export-documents.mount" "export-downloads.mount" ];
+  };
+
   fudo.ipfs = {
     enable = true;
     users = [ "niten" ];

config/networks/sea.fudo.org.nix

@@ -2,17 +2,18 @@ let local-domain = "sea.fudo.org";
 in {
   aliases = {
     deploy = "socrates";
+    dns-hole = "limina";
     gateway = "limina";
+    hole = "limina";
+    ipfs = "nostromo";
     # kadmin = "nostromo";
     # kdc = "nostromo";
-    photo = "doraemon";
     music = "doraemon";
     panopticon = "lambda";
     panopticon-od = "lambda";
-    ipfs = "nostromo";
-    hole = "limina";
+    photo = "doraemon";
     pihole = "limina";
-    dns-hole = "limina";
+    sea-store = "nostromo";
   };
 
   srv-records = {

config/site-config/seattle.nix

@@ -37,6 +37,58 @@ in {
       fsType = "nfs4";
       options = [ "comment=systemd.automount" ];
     };
+    # "/net/documents" = {
+    #   device = "sea-store.${local-domain}:/export/documents";
+    #   fsType = "nfs";
+    #   options = [
+    #     "nfsvers=4.2"
+    #     "comment=systemd.automount"
+    #     "sec=krb5p"
+    #     # "noauto" ?
+    #   ];
+    # };
+    # "/net/downloads" = {
+    #   device = "sea-store.${local-domain}:/export/downloads";
+    #   fsType = "nfs";
+    #   options = [
+    #     "nfsvers=4.2"
+    #     "comment=systemd.automount"
+    #     "sec=krb5i"
+    #     # "noauto" ?
+    #   ];
+    # };
+  };
+
+  systemd.mounts = [
+    {
+      what = "sea-store.sea.fudo.org:/export/documents";
+      where = "/net/documents";
+      type = "nfs4";
+      options = "sec=krb5p";
+      description = "sea-store documents on encrypted filesysem.";
+    }
+    {
+      what = "sea-store.sea.fudo.org:/export/downloads";
+      where = "/net/downloads";
+      type = "nfs4";
+      options = "sec=krb5i";
+      description = "sea-store downloads on encrypted filesysem.";
+    }
+  ];
+
+  krb5 = {
+    domain_realm = {
+      "fudo.org" = "FUDO.ORG";
+      ".fudo.org" = "FUDO.ORG";
+      "sea.fudo.org" = "FUDO.ORG";
+      ".sea.fudo.org" = "FUDO.ORG";
+    };
+    realms = {
+      "FUDO.ORG" = {
+        admin_server = "france.fudo.org";
+        kdc = [ "france.fudo.org" ];
+      };
+    };
   };
 
   services.printing = {