# Shared home directories

Status: **planned**. Tracking doc for moving host home directories onto the NAS
via LDAP-backed autofs, so per-user config (shells, `nvim`, etc.) follows the
user across every host. This is the first slice of host
[auto-provisioning](provisioning.md). Fold the implemented parts into
[identity](identity.md) and [onboarding](onboarding.md) once shipped.

## Goal

Login on any host lands in the same NFS-backed `/Users/<user>`, mounted on
demand from Miquella. The `/Users` path stays (macOS-compatible; Malenia is
macOS), and the map is managed centrally in LDAP.

## Current state

| Aspect          | Today                                                            |
| --------------- | --------------------------------------------------------------- |
| `homeDirectory` | LDAP serves `/Users/<user>` (rfc2307 `posixAccount`).           |
| Home creation   | `pam_mkhomedir` makes `/Users/<user>` **locally, per host**.    |
| Sharing         | None; each host has its own copy. Config does not follow.       |
| `/Users` parent | `drwx------ sys-gitea-runner:charlie-deploy` — traversal bug.   |
| autofs          | `nsswitch automount: sss` set, but autofs not installed/enabled.|
| LDAP automount  | No automount schema loaded; no map objects.                     |
| NAS             | `miquella.lan:/volume1/ubuntu` at `/mnt/nas`; no root_squash.   |
| `users/` share  | `/mnt/nas/users` does not exist yet.                            |

## Target design

```mermaid
flowchart LR
  Login[Login on host] --> Autofs[autofs /Users indirect map]
  Autofs -->|map from| SSSD[SSSD autofs provider]
  SSSD -->|LDAP| Maps[ou=automount]
  Autofs -->|mount on demand| NAS[miquella:/volume1/ubuntu/users/&]
```

| Layer | Change |
| ----- | ------ |
| NAS   | `/volume1/ubuntu/users/` root, per-user `users/<user>` owned by the user, `0700`, seeded from skel. |
| LDAP  | Load automount schema; add `ou=automount` with `auto.master` and `auto.Users` maps. |
| SSSD  | Add `autofs` service and `autofs_provider = ldap` with map attribute mapping. |
| Host  | Install + enable `autofs`; `/etc/auto.master` reads `+auto.master` from SSS; clean local `/Users/<user>` first. |
| PAM   | Drop `pam_mkhomedir` for human users (homes pre-provisioned on NAS). |

## LDAP automount map

| DN | Key | Value |
| -- | --- | ----- |
| `ou=automount,dc=alexandru,dc=macocian,dc=me` | — | container |
| `automountMapName=auto.master,ou=automount,…`  | `/Users` | `auto.Users --timeout=600` |
| `automountMapName=auto.Users,ou=automount,…`   | `*`      | `-fstype=nfs4,rw,soft miquella.lan:/volume1/ubuntu/users/&` |

SSSD map attribute mapping (rfc2307): `automountMap` / `automountMapName` /
`automount` / `automountKey` / `automountInformation`.

## Migration / cutover

1. **Interim fix:** set `/Users` to `root:root 0755` on every host so current
   logins traverse into their home (independent of the rest of this plan).
2. Create `/volume1/ubuntu/users/` on Miquella; provision existing users'
   homes there (owned by user, `0700`, seeded from skel).
3. Load automount schema into OpenLDAP; add the `ou=automount` map objects.
4. Enable autofs in SSSD (`services` + `autofs_provider`); restart SSSD.
5. On one host: install autofs, clean local `/Users/<user>`, enable autofs,
   verify on-demand mount and login. Then roll to the fleet.
6. Remove `pam_mkhomedir` for human users once NAS homes are authoritative.

## Risks & open questions

| Item | Note |
| ---- | ---- |
| Blast radius | NAS or LDAP down ⇒ no homes ⇒ degraded logins. Keep a local break-glass sudoer with a local home; use `--timeout`/soft mounts. |
| Service accounts | `sys-*` (e.g. `sys-gitea-runner`) should **not** be NFS homes. Move their `homeDirectory` off `/Users` so the indirect map owns `/Users` for humans only. |
| macOS (Malenia) | `/Users` is the native local home root; an indirect autofs map there is not a drop-in. Decide whether Malenia uses a different mechanism or is excluded initially. |
| NFS sockets/locks | ssh-agent/gpg sockets belong in `XDG_RUNTIME_DIR` (`/run`); `nvim` swap/undo and lockfiles need NFS-safe paths or local dirs. |
| Provisioning owner | Per-user home creation belongs in the future provisioning tool (or DirectoryAdmin) at account creation; no_root_squash lets a root-run provisioner set correct ownership. |