46 lines
2.5 KiB
Markdown
46 lines
2.5 KiB
Markdown
# thealmightydrawingtablet/nfs-krb
|
|
|
|
it's an NFS server with kerberos integrated out of the box !
|
|
|
|
## why?
|
|
|
|
because nobody else has made one for some reason ¯\\\_(ツ)\_/¯
|
|
|
|
# usage
|
|
|
|
### sharing directory via env var
|
|
|
|
```bash
|
|
# works for both ubuntu and alpine images
|
|
docker run -d --privileged -v /path/on/host:/container/srv \
|
|
-e SHARED_DIRECTORY=/container/srv -e PERMITTED=10.0.0.0/8 \
|
|
-e NFS_KRB_PRINC=nfs/localhost.local -e NFS_KRB_REALM=LOCALHOST.LOCAL -e NFS_KRB_PWD='unguessable!'
|
|
```
|
|
|
|
### bring your own `/etc/exports`
|
|
|
|
```bash
|
|
# ubuntu
|
|
docker run -d --privileged -v /path/on/host:/container/srv -v ./exports:/etc/exports \
|
|
-e PERMITTED=10.0.0.0/8 \
|
|
-e NFS_KRB_PRINC=nfs/localhost.local -e NFS_KRB_REALM=LOCALHOST.LOCAL -e NFS_KRB_PWD='unguessable!'
|
|
|
|
# alpine
|
|
docker run -d --privileged -v /path/on/host:/container/srv/folder-1 -v /another/thing:/container/srv/folder-2 -v ./exports:/etc/exports.mnt \
|
|
-e PERMITTED=10.0.0.0/8 \
|
|
-e NFS_KRB_PRINC=nfs/localhost.local -e NFS_KRB_REALM=LOCALHOST.LOCAL -e NFS_KRB_PWD='unguessable!'
|
|
```
|
|
|
|
## recognized configuration environment variables
|
|
|
|
| Variable | Default | Required | Alpine | Ubuntu | Description |
|
|
| ------------------ | ------------------ | -------- | ------ | ------ | ------------------------------------------------------------------------------- |
|
|
| `NFS_KRB_REALM` | - | yes | ✅ | ✅ | Kerberos realm to authenticate with. |
|
|
| `NFS_KRB_PRINC` | - | yes | ✅ | ✅ | the service principal which will be added to the keytab. |
|
|
| `NFS_KRB_PWD` | - | yes | ✅ | ✅ | kerberos database master password, as well as the password for `NFS_KRB_PRINC`. |
|
|
| `RW_MODE` | `rw` | no | ✅ | ✅ | controls NFS export read/write mode and the per-share option string. |
|
|
| `SRV_TZ` | `America/New_York` | no | ✅ | ❌ | overrides the system timezone. |
|
|
| `SHARED_DIRECTORY` | - | no | ✅ | ✅ | determines whether to configure a singular export. |
|
|
| `PERMITTED` | `*` | no | ✅ | ✅ | provides the allowed client list for a single exported directory. |
|
|
|