nfs-ganesha

clusters/base/apps/nfs-ganesha/configmap.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nfs-ganesha-config
+  namespace: nfs
+data:
+  ganesha.conf: |
+    NFS_Core_Param {
+    	NFS_Port = 2049;
+    	Protocols = NFSv4;
+    	Fsid_Device = true;
+    }
+
+    NFSV4 {
+    	RecoveryBackend = fs_ng;
+    	RecoveryRoot = /recovery;
+    	Lease_Lifetime = 40;
+    	Grace_Period = 50;
+    }
+
+    VFS {
+    	Link_Support = true;
+    	Symlink_Support = true;
+    	CanSetTime = true;
+    	umask = 0000;
+    }
+
+    EXPORT {
+    	Export_Id = 1;
+
+    	Path = /export;
+    	Pseudo = /exports/shared/documents;
+
+    	SecType = sys;
+    	Protocols = NFSv4;
+
+    	FSAL {
+    		Name = VFS;
+    	}
+
+    	CLIENT {
+    		Clients = *;
+    		Access_Type = RW;
+    		Squash = No_Root_Squash;
+    		Protocols = NFSv4;
+    	}
+    }
+
+    LOG {
+    	Default_Log_Level = INFO;
+    }

clusters/base/apps/nfs-ganesha/helmrelease.yaml

@@ -0,0 +1,114 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nfs-ganesha
+  namespace: nfs
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: nfs-ganesha
+  values:
+    controllers:
+      app:
+        strategy: Recreate
+        podDisruptionBudget:
+          maxUnavailable: "0"
+        initContainers:
+          mtab-setup:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+            command:
+              - sh
+              - -c
+              - cat /proc/self/mounts > /mtab-vol/mtab
+        containers:
+          app:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+            securityContext:
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
+                add:
+                  - CHOWN
+                  - DAC_OVERRIDE
+                  - DAC_READ_SEARCH
+                  - FOWNER
+                  - FSETID
+                  - SETGID
+                  - SETUID
+                  - SYS_RESOURCE
+            probes:
+              liveness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 2
+                  periodSeconds: 10
+                  timeoutSeconds: 2
+                  failureThreshold: 3
+              readiness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 1
+                  periodSeconds: 2
+                  timeoutSeconds: 1
+                  failureThreshold: 2
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+
+    service:
+      app:
+        controller: app
+        type: LoadBalancer
+        labels:
+          loadBalancerPool: nfs
+        ports:
+          nfs:
+            port: 2049
+            protocol: TCP
+
+    persistence:
+      config:
+        type: configMap
+        name: nfs-ganesha-config
+        globalMounts:
+          - path: /etc/ganesha/ganesha.conf
+            subPath: ganesha.conf
+            readOnly: true
+      export:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 30Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /export
+      run:
+        type: emptyDir
+        globalMounts:
+          - path: /run
+      tmp:
+        type: emptyDir
+        globalMounts:
+          - path: /tmp
+      recovery:
+        type: emptyDir
+        globalMounts:
+          - path: /recovery
+      etc-mtab:
+        type: emptyDir
+        advancedMounts:
+          app:
+            app:
+              - path: /etc/mtab
+                subPath: mtab
+            mtab-setup:
+              - path: /mtab-vol

clusters/base/apps/nfs-ganesha/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: nfs-ganesha
+  namespace: nfs
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/nfs-ganesha/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - helmrelease.yaml

clusters/base/infra/metallb/config.yaml

@@ -6,7 +6,8 @@ metadata:
   namespace: metallb-system
 spec:
   addresses:
-    - 10.0.64.5-10.0.64.6
+    # exclude 10.0.64.5, its in nfs-pool
+    - 10.0.64.6
     # exclude 10.0.64.7, its in dmz-pool
     # exclude 10.0.64.8, its in mqtt-pool
     - 10.0.64.9-10.0.64.19
@@ -16,6 +17,21 @@ spec:
       - matchLabels:
           loadBalancerPool: default
 ---
+# NFS ip
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: dmz-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.64.5/32
+  autoAssign: true
+  serviceAllocation:
+    serviceSelectors:
+      - matchLabels:
+          loadBalancerPool: nfs
+---
 # DMZ (not really, just for clarity) ip, will have ports forwarded from WAN router
 apiVersion: metallb.io/v1beta1
 kind: IPAddressPool

clusters/base/namespaces/nfs.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nfs

clusters/home/apps/kustomization.yaml

@@ -9,4 +9,4 @@ resources:
   - homeassistant.yaml
   - openwebui.yaml
   - markdown-vault-mcp.yaml
-  - webdav.yaml
+  - nfs-ganesha.yaml

clusters/home/apps/nfs-ganesha.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: nfs-ganesha
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/nfs-ganesha
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s

clusters/home/namespaces/kustomization.yaml

@@ -11,3 +11,4 @@ resources:
   - ../../base/namespaces/homeassistant.yaml
   - ../../base/namespaces/ai.yaml
   - ../../base/namespaces/mcp.yaml
+  - ../../base/namespaces/nfs.yaml