Alexandru Macocian
78 lines
4.3 KiB
Markdown
78 lines
4.3 KiB
Markdown
# Shared home directories
|
|
|
|
Status: **planned**. Tracking doc for moving host home directories onto the NAS
|
|
via LDAP-backed autofs, so per-user config (shells, `nvim`, etc.) follows the
|
|
user across every host. This is the first slice of host
|
|
[auto-provisioning](provisioning.md). Fold the implemented parts into
|
|
[identity](identity.md) and [onboarding](onboarding.md) once shipped.
|
|
|
|
## Goal
|
|
|
|
Login on any host lands in the same NFS-backed `/Users/<user>`, mounted on
|
|
demand from Miquella. The `/Users` path stays (macOS-compatible; Malenia is
|
|
macOS), and the map is managed centrally in LDAP.
|
|
|
|
## Current state
|
|
|
|
| Aspect | Today |
|
|
| --------------- | --------------------------------------------------------------- |
|
|
| `homeDirectory` | LDAP serves `/Users/<user>` (rfc2307 `posixAccount`). |
|
|
| Home creation | `pam_mkhomedir` makes `/Users/<user>` **locally, per host**. |
|
|
| Sharing | None; each host has its own copy. Config does not follow. |
|
|
| `/Users` parent | `drwx------ sys-gitea-runner:charlie-deploy` — traversal bug. |
|
|
| autofs | `nsswitch automount: sss` set, but autofs not installed/enabled.|
|
|
| LDAP automount | No automount schema loaded; no map objects. |
|
|
| NAS | `miquella.lan:/volume1/ubuntu` at `/mnt/nas`; no root_squash. |
|
|
| `users/` share | `/mnt/nas/users` does not exist yet. |
|
|
|
|
## Target design
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
Login[Login on host] --> Autofs[autofs /Users indirect map]
|
|
Autofs -->|map from| SSSD[SSSD autofs provider]
|
|
SSSD -->|LDAP| Maps[ou=automount]
|
|
Autofs -->|mount on demand| NAS[miquella:/volume1/ubuntu/users/&]
|
|
```
|
|
|
|
| Layer | Change |
|
|
| ----- | ------ |
|
|
| NAS | `/volume1/ubuntu/users/` root, per-user `users/<user>` owned by the user, `0700`, seeded from skel. |
|
|
| LDAP | Load automount schema; add `ou=automount` with `auto.master` and `auto.Users` maps. |
|
|
| SSSD | Add `autofs` service and `autofs_provider = ldap` with map attribute mapping. |
|
|
| Host | Install + enable `autofs`; `/etc/auto.master` reads `+auto.master` from SSS; clean local `/Users/<user>` first. |
|
|
| PAM | Drop `pam_mkhomedir` for human users (homes pre-provisioned on NAS). |
|
|
|
|
## LDAP automount map
|
|
|
|
| DN | Key | Value |
|
|
| -- | --- | ----- |
|
|
| `ou=automount,dc=alexandru,dc=macocian,dc=me` | — | container |
|
|
| `automountMapName=auto.master,ou=automount,…` | `/Users` | `auto.Users --timeout=600` |
|
|
| `automountMapName=auto.Users,ou=automount,…` | `*` | `-fstype=nfs4,rw,soft miquella.lan:/volume1/ubuntu/users/&` |
|
|
|
|
SSSD map attribute mapping (rfc2307): `automountMap` / `automountMapName` /
|
|
`automount` / `automountKey` / `automountInformation`.
|
|
|
|
## Migration / cutover
|
|
|
|
1. **Interim fix:** set `/Users` to `root:root 0755` on every host so current
|
|
logins traverse into their home (independent of the rest of this plan).
|
|
2. Create `/volume1/ubuntu/users/` on Miquella; provision existing users'
|
|
homes there (owned by user, `0700`, seeded from skel).
|
|
3. Load automount schema into OpenLDAP; add the `ou=automount` map objects.
|
|
4. Enable autofs in SSSD (`services` + `autofs_provider`); restart SSSD.
|
|
5. On one host: install autofs, clean local `/Users/<user>`, enable autofs,
|
|
verify on-demand mount and login. Then roll to the fleet.
|
|
6. Remove `pam_mkhomedir` for human users once NAS homes are authoritative.
|
|
|
|
## Risks & open questions
|
|
|
|
| Item | Note |
|
|
| ---- | ---- |
|
|
| Blast radius | NAS or LDAP down ⇒ no homes ⇒ degraded logins. Keep a local break-glass sudoer with a local home; use `--timeout`/soft mounts. |
|
|
| Service accounts | `sys-*` (e.g. `sys-gitea-runner`) should **not** be NFS homes. Move their `homeDirectory` off `/Users` so the indirect map owns `/Users` for humans only. |
|
|
| macOS (Malenia) | `/Users` is the native local home root; an indirect autofs map there is not a drop-in. Decide whether Malenia uses a different mechanism or is excluded initially. |
|
|
| NFS sockets/locks | ssh-agent/gpg sockets belong in `XDG_RUNTIME_DIR` (`/run`); `nvim` swap/undo and lockfiles need NFS-safe paths or local dirs. |
|
|
| Provisioning owner | Per-user home creation belongs in the future provisioning tool (or DirectoryAdmin) at account creation; no_root_squash lets a root-run provisioner set correct ownership. |
|