fix(storage): keep the NFS client off the ports the platform publishes

Main CI run 40976399687, socialhome#0 (swarm, tor, centos): the CLI tests
of svc-net-tor (onion:25 "socks CONNECT failed with reply 0x01") and
web-app-stalwart (probe_mail relay: ConnectionRefusedError on port 25)
failed. dockerd on the manager had aborted the whole ingress program of
the mail stack:

  Failed to add ingress: failed to program ingress ports:
  failed to bind host port 0.0.0.0:993/tcp: address already in use

/proc/net/tcp named the squatter: 192.168.244.10:993 -> :2049, the
node's own NFS client. The mount carries no noresvport, so the kernel
drew a source port from the 665-1023 reserved window and landed on
imaps. None of 25/465/993/995/4190/8095 got a DNAT rule or a
docker-proxy listener while every other published port did, and
stalwart still reported healthy because its healthcheck runs inside the
container. 993 and 995 are the only published ports inside that window,
so this is luck of the draw on any NFS-backed swarm host that runs the
mail role.

mount_opts now emits noresvport. insecure on the kernel-flavor export is
the other half: kernel nfsd defaults to secure and answers a mount from
an unprivileged source port with EACCES. It reaches the kernel flavor
only; ganesha already accepts unprivileged clients.

What it costs: the next deploy of every existing NFS client sees a
pending opts change and remounts the shared state; a host-side job
holding that path at that instant fails loudly. A plain remount may keep
a running mount on its old reserved port until the next real mount.

Port of f46c4d0bab from feature/store-i18n, applied identically so the
later store-i18n -> main merge stays conflict-free.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/svc-storage-nfs-server/vars/main.yml

@@ -13,7 +13,7 @@ SVC_STORAGE_NFS_SERVER_SERVICE:
     Archlinux: nfs-ganesha
 
 SVC_STORAGE_NFS_SERVER_STATE_EXPORT_OPTIONS: >-
-  rw,sync,no_subtree_check,no_root_squash,no_all_squash
+  rw,sync,insecure,no_subtree_check,no_root_squash,no_all_squash
 SVC_STORAGE_NFS_SERVER_STATE_ALLOWED_CIDRS:
   - "*"
 

tests/unit/python/plugins/lookup/test_nfs_lookups.py

@@ -35,19 +35,19 @@ class TestNfsLookups(unittest.TestCase):
     def test_mount_opts_github_soft(self):
         self.assertEqual(
             _run("nfs_mount_opts", BASE),
-            "vers=4,rw,soft,timeo=50,retrans=3",
+            "vers=4,rw,noresvport,soft,timeo=50,retrans=3",
         )
 
     def test_mount_opts_host_hard(self):
         self.assertEqual(
             _run("nfs_mount_opts", {**BASE, "RUNTIME": "host"}),
-            "vers=4,rw,hard,timeo=600",
+            "vers=4,rw,noresvport,hard,timeo=600",
         )
 
     def test_mount_opts_act_soft(self):
         self.assertEqual(
             _run("nfs_mount_opts", {**BASE, "RUNTIME": "act"}),
-            "vers=4,rw,soft,timeo=50,retrans=3",
+            "vers=4,rw,noresvport,soft,timeo=50,retrans=3",
         )
 
 

tests/unit/python/utils/storage/test_nfs.py

@@ -22,17 +22,28 @@ class TestNfsHelpers(unittest.TestCase):
 
     def test_mount_opts_lab_runtimes_soft(self):
         for rt in ("dev", "act", "github"):
-            self.assertEqual(mount_opts(4, rt), "vers=4,rw,soft,timeo=50,retrans=3")
+            self.assertEqual(
+                mount_opts(4, rt), "vers=4,rw,noresvport,soft,timeo=50,retrans=3"
+            )
 
     def test_mount_opts_prod_hard(self):
-        self.assertEqual(mount_opts(4, "host"), "vers=4,rw,hard,timeo=600")
+        self.assertEqual(mount_opts(4, "host"), "vers=4,rw,noresvport,hard,timeo=600")
+
+    def test_mount_opts_keep_the_client_off_published_privileged_ports(self):
+        """A reserved source port can land on imaps/993 or pop3s/995 and then
+        blocks the whole ingress port set of the mail stack."""
+        for version in (3, 4):
+            for runtime in ("dev", "act", "github", "host"):
+                self.assertIn("noresvport", mount_opts(version, runtime))
 
     def test_mount_opts_v4_carries_no_v3_locking_token(self):
         self.assertNotIn("local_lock", mount_opts(4, "host"))
         self.assertNotIn("nolock", mount_opts(4, "host"))
 
     def test_mount_opts_v3_still_disables_nlm(self):
-        self.assertEqual(mount_opts(3, "host"), "vers=3,rw,hard,timeo=600,nolock")
+        self.assertEqual(
+            mount_opts(3, "host"), "vers=3,rw,noresvport,hard,timeo=600,nolock"
+        )
 
     def test_client_src_kernel_v4_is_root(self):
         self.assertEqual(

utils/storage/nfs.py

@@ -61,7 +61,7 @@ def mount_opts(version, runtime):
         else "hard,timeo=600"
     )
     locking = "" if int(version) >= 4 else ",nolock"
-    return f"vers={version},rw,{reliability}{locking}"
+    return f"vers={version},rw,noresvport,{reliability}{locking}"
 
 
 def client_src(server, version, flavor, state_path_value):