Skip to content

Runbook 12 — Client enrollment + per-user NFS share automount

Goal: enroll Linux workstations/laptops into FreeIPA (SSO, consistent UID/GID) and give each user their fileserver home data on demand — as an on-access autofs share at /var/mnt/shares/<user>, over NFSv4 (sec=sys). /home stays local (offline-safe) — the workstation role's deliberate design (see §3).

Prereqs: runbooks 10 + 11 validated.

1. Enroll a client into FreeIPA (identity only)

On each Linux client (Fedora/Rocky/Ubuntu/Debian — package names vary): 

# RHEL-family
dnf -y install ipa-client nfs-utils autofs oddjob-mkhomedir
# Debian/Ubuntu
apt -y install freeipa-client nfs-common autofs libpam-mkhomedir sssd

# point DNS at Unbound (which forwards the IPA zone) BEFORE enrolling
# then:
ipa-client-install \
  --domain=${ipa_domain} \
  --realm=${realm} \
  --server=ipa.${ipa_domain} \
  --mkhomedir \
  --no-sshd \
  --enable-dns-updates
--mkhomedir wires PAM oddjob-mkhomedir so the local home dir is created on first login. --no-sshd leaves sshd alone — the workstation role (§3) owns SSH-CA host/user trust on these boxes, not SSSD/IPA's sshd config. Test SSO: id operator, then su - operator / SSH in with the IPA password → gets a Kerberos ticket (klist).

2. NFSv4 idmap domain (must match the NFS server)

/etc/idmapd.conf: 

[General]
Domain = ${ipa_domain}
Restart: systemctl restart nfs-idmapd (or rpc.idmapd). Mismatch here = files show as nobody:nobody.

3. Per-user NFS share — the workstation role (local /home, share at /var/mnt/shares/<user>)

Workstations are managed by the OS-agnostic workstation role (playbooks/workstations.yml), which layers SSH-CA host/user trust + a cert-expiry metric + the data share + a myos clone auto-pull on top of the IPA enrollment from §1. The auto-pull (myos-autopull.timer, daily 06:37 + post-boot) does a fetch and ff-only merge of the interactive user's ~/src/myos — it never touches local work (a dirty or diverged tree refuses harmlessly and stays put), and only a fetch failure fails the unit (surfaced by the fleet unit-failed alerting). Added after two stale-clone incidents on 2026-07-25/26 (a 3-week-old yubikey-tool.sh missing admin-hv; an agent session fixing a live issue on a pre-audit base). Vars: workstation_myos_autopull{,_user,_repo}; a host without the clone is a clean no-op.

cd ansible && ansible-playbook -i inventory.ini playbooks/workstations.yml -l <host>

The share, not /home:

  • /home stays LOCAL on workstations — a laptop/desktop must log in and work when the fileserver blips or it's off-LAN. Full NFS /home is deliberately not used here (rejected alternative below).
  • Each user's fileserver home is mounted on access at /var/mnt/shares/<user> → fileserver:/supernas/home/<user> (-fstype=nfs4,rw,soft,_netdev,vers=4.2), and unmounted when idle — so NFS down stalls only /var/mnt/shares, never login. Symlink ~/Documents etc. into it; keep ~/.config/~/.cache local (dotfiles via chezmoi). /var/mnt/shares is the one canonical mount path on every box (idiomatic on immutable/ostree, where all writable state lives under /var).
  • Mutable hosts (Ubuntu/Fedora) get an autofs indirect map (/etc/auto.master.d/lab-shares.autofs → /etc/auto.lab-shares); ostree (Fedora Atomic) hosts use a native systemd .automount at the same path.
  • The IPA auto.home overmount guard. FreeIPA ships a default auto.home indirect map at /home; with automount: sss in nsswitch, autofs would import it via the +auto.master line and overmount /home, shadowing the local home dirs. The role's workstation_autofs_skip_ipa_maps: true comments out that +auto.master import, so autofs manages only /shares (via +dir:/etc/auto.master.d) and the local /home is left intact.

Rejected alternative — centralized /home over NFS (server clients only). A fully centralized /home (FreeIPA's auto.home map at /home, so /home/<user> is the NFS mount) is the classic pattern, but it makes login depend on the fileserver being up — unacceptable for roaming/interactive workstations. If you ever want it on a non-workstation always-on server client, set workstation_autofs_skip_ipa_maps: false (consume IPA's SSS maps), or publish the map centrally: 

# on FreeIPA:
ipa automountlocation-add default
ipa automountmap-add default auto.home
ipa automountkey-add default auto.home --key='*' \
  --info='-fstype=nfs4,sec=sys,rw fileserver.${ipa_domain}:/supernas/home/&'
ipa automountkey-add default auto.master --key='/home' --info='auto.home'

4. Login flow check

On login as operator: PAM (oddjob-mkhomedir) ensures the local /home/operator and a Kerberos TGT. Accessing /var/mnt/shares/operator triggers autofs to mount fileserver:/supernas/home/operator with sec=sys → files owned by operator; going idle unmounts it. /home itself is never an NFS mount.

Validation

  • [ ] id operator shows the IPA UID/GID on every enrolled client (identical everywhere).
  • [ ] Login as operator → /home/operator is a local dir (mount | grep ' /home ' shows no NFS); the box logs in even with the fileserver down.
  • [ ] Accessing /var/mnt/shares/operator mounts the fileserver share (mount | grep shares shows nfs4 ... sec=sys), files owned by operator; it unmounts when idle.
  • [ ] /etc/auto.master shows the +auto.master import commented out (IPA auto.home did not overmount /home).
  • [ ] Same user on a second workstation sees the same share data.

Then → runbook 13 (Authelia SSO).