project-charlie/docs/shared-homes.md

Shared home directories

Status: planned. Tracking doc for moving host home directories onto the NAS via LDAP-backed autofs, so per-user config (shells, nvim, etc.) follows the user across every host. This is the first slice of host auto-provisioning. Fold the implemented parts into identity and onboarding once shipped.

Goal

Login on any host lands in the same NFS-backed /Users/<user>, mounted on demand from Miquella. The /Users path stays (macOS-compatible; Malenia is macOS), and the map is managed centrally in LDAP.

Current state

Aspect	Today
homeDirectory	LDAP serves /Users/<user> (rfc2307 posixAccount).
Home creation	pam_mkhomedir makes /Users/<user> locally, per host.
Sharing	None; each host has its own copy. Config does not follow.
/Users parent	drwx------ sys-gitea-runner:charlie-deploy — traversal bug.
autofs	nsswitch automount: sss set, but autofs not installed/enabled.
LDAP automount	No automount schema loaded; no map objects.
NAS	miquella.lan:/volume1/ubuntu at /mnt/nas; no root_squash.
users/ share	/mnt/nas/users does not exist yet.

Target design

flowchart LR
  Login[Login on host] --> Autofs[autofs /Users indirect map]
  Autofs -->|map from| SSSD[SSSD autofs provider]
  SSSD -->|LDAP| Maps[ou=automount]
  Autofs -->|mount on demand| NAS[miquella:/volume1/ubuntu/users/&]

Layer	Change
NAS	/volume1/ubuntu/users/ root, per-user users/<user> owned by the user, 0700, seeded from skel.
LDAP	Load automount schema; add ou=automount with auto.master and auto.Users maps.
SSSD	Add autofs service and autofs_provider = ldap with map attribute mapping.
Host	Install + enable autofs; /etc/auto.master reads +auto.master from SSS; clean local /Users/<user> first.
PAM	Drop pam_mkhomedir for human users (homes pre-provisioned on NAS).

LDAP automount map

DN	Key	Value
ou=automount,dc=alexandru,dc=macocian,dc=me	—	container
automountMapName=auto.master,ou=automount,…	/Users	auto.Users --timeout=600
automountMapName=auto.Users,ou=automount,…	*	-fstype=nfs4,rw,soft miquella.lan:/volume1/ubuntu/users/&

SSSD map attribute mapping (rfc2307): automountMap / automountMapName / automount / automountKey / automountInformation.

Migration / cutover

1. Interim fix: set /Users to root:root 0755 on every host so current logins traverse into their home (independent of the rest of this plan).
2. Create /volume1/ubuntu/users/ on Miquella; provision existing users' homes there (owned by user, 0700, seeded from skel).
3. Load automount schema into OpenLDAP; add the ou=automount map objects.
4. Enable autofs in SSSD (services + autofs_provider); restart SSSD.
5. On one host: install autofs, clean local /Users/<user>, enable autofs, verify on-demand mount and login. Then roll to the fleet.
6. Remove pam_mkhomedir for human users once NAS homes are authoritative.

Risks & open questions

Item	Note
Blast radius	NAS or LDAP down ⇒ no homes ⇒ degraded logins. Keep a local break-glass sudoer with a local home; use --timeout/soft mounts.
Service accounts	sys-* (e.g. sys-gitea-runner) should not be NFS homes. Move their homeDirectory off /Users so the indirect map owns /Users for humans only.
macOS (Malenia)	/Users is the native local home root; an indirect autofs map there is not a drop-in. Decide whether Malenia uses a different mechanism or is excluded initially.
NFS sockets/locks	ssh-agent/gpg sockets belong in XDG_RUNTIME_DIR (/run); nvim swap/undo and lockfiles need NFS-safe paths or local dirs.
Provisioning owner	Per-user home creation belongs in the future provisioning tool (or DirectoryAdmin) at account creation; no_root_squash lets a root-run provisioner set correct ownership.