NAS Share Management

ssh nas-01

# 1. Create DSM share (synoshare creates /volume1/<name> automatically)
sudo synoshare --add <name> "<description>" /volume1/<name> "" administrators "" 1 1

# 2. Create subdirectories AFTER share exists
sudo mkdir -p /volume1/<name>/{subdir1,subdir2}

# 3. Add NFS export
echo '/volume1/<name>    10.50.1.0/24(rw,async,no_wdelay,no_root_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)' | sudo tee -a /etc/exports

# 4. Reload NFS
sudo exportfs -ra

# 5. Verify
sudo synoshare --enum ALL | grep <name>
sudo exportfs -v | grep <name>

ssh <client-host>
sudo mkdir -p /mnt/test
sudo mount -t nfs nas-01:/volume1/<name> /mnt/test
ls -la /mnt/test
sudo umount /mnt/test && sudo rmdir /mnt/test

synoshare --add <name> <desc> <path> <na> <rw> <ro> <browsable> <adv_privilege>

# List all shares
sudo synoshare --enum ALL

# Get share details
sudo synoshare --get <sharename>

# Delete share (TRUE = delete data, FALSE = keep data)
sudo synoshare --del FALSE <sharename>

# Rename share
sudo synoshare --rename <old_name> <new_name>

nas-01 (Synology)
├── /volume1/VMs      ──► kvm-01:/mnt/nas/vms
│                     ──► kvm-02:/mnt/nas/vms    (adding now)
├── /volume1/ISOs     ──► kvm-01:/mnt/nas/isos
│                     ──► kvm-02:/mnt/nas/isos   (adding now)
└── /volume1/Backups  ──► kvm-01:/mnt/nas/backups
                      ──► kvm-02:/mnt/nas/backups (adding now)

# 1. Load credentials and sign SSH key
ds d000 dev/vault && vault-ssh-sign

# 2. Copy NAS admin password to clipboard (45s timeout)
gopass show -c v3/domains/d000/storage/nas-01/admin

# 3. SSH interactively (paste password when sudo prompts)
ssh nas-01

# On nas-01: View current exports
sudo exportfs -v | grep -E "VMs|ISOs|Backups"

/volume1/Backups
/volume1/VMs  	192.168.1.181(rw,async,no_wdelay,hide,no_subtree_check,insecure_locks,anonuid=1024,anongid=100,sec=sys,insecure,root_squash,all_squash)
/volume1/ISOs 	192.168.1.181(rw,async,no_wdelay,hide,no_subtree_check,insecure_locks,anonuid=1024,anongid=100,sec=sys,insecure,root_squash,all_squash)

# On nas-01: Add kvm-02 (10.50.1.111) to /volume1/VMs
echo '/volume1/VMs    10.50.1.111(rw,async,no_wdelay,no_root_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)' | sudo tee -a /etc/exports

# On nas-01: Add kvm-02 (10.50.1.111) to /volume1/ISOs
echo '/volume1/ISOs    10.50.1.111(rw,async,no_wdelay,no_root_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)' | sudo tee -a /etc/exports

# On nas-01: Add kvm-02 (10.50.1.111) to /volume1/Backups
echo '/volume1/Backups    10.50.1.111(rw,async,no_wdelay,no_root_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)' | sudo tee -a /etc/exports

# On nas-01: Reload and verify
sudo exportfs -ra

# Capture result with command substitution
result=$(sudo exportfs -v | grep 10.50.1.111) && echo "$result" || echo "ERROR: kvm-02 not in exports"

/volume1/VMs      10.50.1.111(rw,async,wdelay,no_root_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)
/volume1/ISOs     10.50.1.111(rw,async,wdelay,no_root_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)
/volume1/Backups  10.50.1.111(rw,async,wdelay,no_root_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)

# Exit nas-01 when done
exit

# Exit nas-01, SSH to kvm-02
exit
ssh kvm-02

# Check if exports are visible (should show 10.50.1.111)
showmount -e nas-01 | grep -E "vms|isos|backups"

/volume1/backups          10.50.1.111,192.168.1.181
/volume1/isos             10.50.1.111,192.168.1.181
/volume1/vms              10.50.1.111,192.168.1.181

# Test mount (use sudo for ls - regular user may lack perms)
sudo mkdir -p /mnt/test
sudo mount -t nfs nas-01:/volume1/vms /mnt/test
sudo ls -la /mnt/test
sudo umount /mnt/test
sudo rmdir /mnt/test

# Create mount directories
sudo mkdir -p /mnt/nas/{vms,isos,backups}

# Add fstab entries
sudo tee -a /etc/fstab << 'EOF'

# NAS NFS Mounts (added 2026-03-01)
nas-01:/volume1/vms      /mnt/nas/vms     nfs  defaults,_netdev  0 0
nas-01:/volume1/isos     /mnt/nas/isos    nfs  defaults,_netdev  0 0
nas-01:/volume1/backups  /mnt/nas/backups nfs  defaults,_netdev  0 0
EOF

# Mount all and verify
sudo mount -a && df -h | grep nas

nas-01:/volume1/vms       21T  2.1T   19T  10% /mnt/nas/vms
nas-01:/volume1/isos      21T  2.1T   19T  10% /mnt/nas/isos
nas-01:/volume1/backups   21T  2.1T   19T  10% /mnt/nas/backups

# Reload systemd to pick up fstab changes
sudo systemctl daemon-reload

# Define nas-vms pool
sudo virsh pool-define-as nas-vms dir --target /mnt/nas/vms
sudo virsh pool-autostart nas-vms
sudo virsh pool-start nas-vms

# Define nas-isos pool
sudo virsh pool-define-as nas-isos dir --target /mnt/nas/isos
sudo virsh pool-autostart nas-isos
sudo virsh pool-start nas-isos

# Verify pools
sudo virsh pool-list --all

 Name       State    Autostart
--------------------------------
 default    active   yes
 nas-isos   active   yes
 nas-vms    active   yes

# Load Vault SSH credentials first
ds d000 dev/vault && vault-ssh-sign

# kvm-02 checks (Vault SSH works)
echo "=== kvm-02 Mount Check ===" && \
ssh kvm-02 "df -h | grep nas" && \
echo -e "\n=== libvirt Pool Check ===" && \
ssh kvm-02 "sudo virsh pool-list --all | grep nas"

# NAS check (requires interactive session - sudo needs password)
# Copy password first: gopass show -c v3/domains/d000/storage/nas-01/admin
ssh nas-01
sudo exportfs -v | grep 10.50.1.111
exit

ssh nas-01

# Remove kvm-02 entries from exports
sudo sed -i '/10.50.1.111/d' /etc/exports
sudo exportfs -ra

# Verify removed
sudo exportfs -v | grep 10.50.1.111  # Should return nothing

sudo synoshare --add vault_backups "Vault snapshots and config" /volume1/vault_backups "" administrators "" 1 1
sudo mkdir -p /volume1/vault_backups/{snapshots,config,audit}
echo '/volume1/vault_backups    10.50.1.0/24(rw,async,no_wdelay,all_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)' | sudo tee -a /etc/exports

sudo synoshare --add keycloak_backups "Keycloak realm exports" /volume1/keycloak_backups "" administrators "" 1 1
sudo mkdir -p /volume1/keycloak_backups/{realms,themes,providers}
echo '/volume1/keycloak_backups    10.50.1.0/24(rw,async,no_wdelay,all_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)' | sudo tee -a /etc/exports

sudo synoshare --add bind_backups "BIND zone files and config" /volume1/bind_backups "" administrators "" 1 1
sudo mkdir -p /volume1/bind_backups/{zones,config}
echo '/volume1/bind_backups    10.50.1.0/24(rw,async,no_wdelay,all_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)' | sudo tee -a /etc/exports

sudo synoshare --add ipa_backups "FreeIPA backups" /volume1/ipa_backups "" administrators "" 1 1
sudo mkdir -p /volume1/ipa_backups/{full,data,logs}
echo '/volume1/ipa_backups    10.50.1.0/24(rw,async,no_wdelay,all_squash,insecure_locks,sec=sys,anonuid=1024,anongid=100)' | sudo tee -a /etc/exports

sudo exportfs -ra
sudo exportfs -v

# synoshare requires sudo
sudo synoshare --enum ALL

# Check exports syntax
sudo exportfs -ra 2>&1 | grep -i error

# Verify export is active
sudo exportfs -v | grep <sharename>

# Check from client
ssh <client> "showmount -e nas-01"

# WRONG - on nas-01
sudo mount -t nfs nas-01:/volume1/k3s /mnt/test  # Will fail

# CORRECT - from k3s-master-01
ssh k3s-master-01
sudo mount -t nfs nas-01:/volume1/k3s /mnt/test  # Works

# Check for malformed entries
sudo cat /etc/exports | grep '\\'

# Fix backslash issues (e.g., \192.168.0.136)
sudo sed -i 's/\\192/192/g' /etc/exports
sudo exportfs -ra

# Check specific lines with awk (shows line numbers)
sudo awk 'NR==12,NR==18 {print NR": "$0}' /etc/exports

14: /volume1/backups 192.168.1.181(...)/volume1/vms 10.50.1.111(...)

# Fix concatenated lines with sed
sudo sed -i 's|anongid=100)/volume1/|anongid=100)\n/volume1/|g' /etc/exports

# Verify fix
sudo awk 'NR==12,NR==18 {print NR": "$0}' /etc/exports

scp: dest open "/volume1/bind_backups/file.tar.gz": No such file or directory

# WRONG - scp blocked by DSM
scp /tmp/backup.tar.gz nas-01:/volume1/share/backup.tar.gz

# CORRECT - cat pipe works
cat /tmp/backup.tar.gz | ssh nas-01 "cat > /volume1/share/backup.tar.gz"

ssh nas-01 "touch /volume1/share/test.txt && rm /volume1/share/test.txt && echo 'Write works'"