On Tue, Dec 17, 2024 at 03:11:12PM -0600, John W. Himpel via server wrote:
The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another way to solve the problem is to use Kerberos for NFS authentication. Fedora Server already has FreeIPA role, providing kerberos services. FreeIPA is certainly usable in home environment, I'm using it to manage DNS, have the same users on all home computers and to provide ACME certificates for my services.