fix(storage): keep the NFS client off the ports the platform publishes

A swarm job lost every published port of the mail stack without anything
reporting it. dockerd aborted the whole ingress program:

  Failed to add ingress: failed to program ingress ports:
  failed to bind host port 0.0.0.0:995/tcp: address already in use

/proc/net/tcp named the squatter: 10.100.1.1:995 -> 10.100.1.11:2049,
the node's own NFS client. The mount carries no noresvport, so the
kernel drew a source port from the 665-1023 reserved window and landed
on pop3s. Afterwards none of 25/465/993/995/4190/8095 was bound while a
sibling service's port was, and stalwart still reported 1/1 healthy
because its healthcheck runs inside the container. The e2e CLI probe
found it two hours later as ECONNREFUSED on SMTP 25.

993 and 995 are the only published ports repository-wide inside that
window, so this is luck of the draw on any NFS-backed swarm host that
runs the mail role.

insecure on the kernel export is not separate hygiene, it is the other
half: kernel nfsd defaults to secure and answers a mount from an
unprivileged source port with EACCES, so noresvport without it would
break every kernel-flavor mount. It reaches the kernel flavor only,
since templates/exports.j2 is reached from tasks/flavor/kernel/main.yml
alone. The ganesha flavor needs nothing: ganesha.conf.j2 sets no
Privileged_Port and the default already accepts unprivileged clients.

What it costs: the next deploy of every existing NFS client sees a
pending opts change and remounts the shared state. The role already
anticipates that, releasing DIR_BACKUPS first when the check-mode probe
reports a change. Nothing bind-mounts that path into a container, so
the exposure is a host-side job holding it at that instant, which fails
loudly rather than silently.

Not yet proven in effect: a source port is chosen when the RPC
connection is established, so a plain remount can leave a running mount
on its old reserved port until the next real mount. Reading
/proc/net/tcp after the first deploy on an existing client is what
confirms it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/svc-storage-nfs-server/vars/main.yml

@@ -13,7 +13,7 @@ SVC_STORAGE_NFS_SERVER_SERVICE:
     Archlinux: nfs-ganesha
 
 SVC_STORAGE_NFS_SERVER_STATE_EXPORT_OPTIONS: >-
-  rw,sync,no_subtree_check,no_root_squash,no_all_squash
+  rw,sync,insecure,no_subtree_check,no_root_squash,no_all_squash
 SVC_STORAGE_NFS_SERVER_STATE_ALLOWED_CIDRS:
   - "*"
 

tests/unit/python/plugins/lookup/test_nfs_lookups.py

@@ -35,19 +35,19 @@ class TestNfsLookups(unittest.TestCase):
     def test_mount_opts_github_soft(self):
         self.assertEqual(
             _run("nfs_mount_opts", BASE),
-            "vers=4,rw,soft,timeo=50,retrans=3",
+            "vers=4,rw,noresvport,soft,timeo=50,retrans=3",
         )
 
     def test_mount_opts_host_hard(self):
         self.assertEqual(
             _run("nfs_mount_opts", {**BASE, "RUNTIME": "host"}),
-            "vers=4,rw,hard,timeo=600",
+            "vers=4,rw,noresvport,hard,timeo=600",
         )
 
     def test_mount_opts_act_soft(self):
         self.assertEqual(
             _run("nfs_mount_opts", {**BASE, "RUNTIME": "act"}),
-            "vers=4,rw,soft,timeo=50,retrans=3",
+            "vers=4,rw,noresvport,soft,timeo=50,retrans=3",
         )
 
 

tests/unit/python/utils/storage/test_nfs.py

@@ -22,17 +22,28 @@ class TestNfsHelpers(unittest.TestCase):
 
     def test_mount_opts_lab_runtimes_soft(self):
         for rt in ("dev", "act", "github"):
-            self.assertEqual(mount_opts(4, rt), "vers=4,rw,soft,timeo=50,retrans=3")
+            self.assertEqual(
+                mount_opts(4, rt), "vers=4,rw,noresvport,soft,timeo=50,retrans=3"
+            )
 
     def test_mount_opts_prod_hard(self):
-        self.assertEqual(mount_opts(4, "host"), "vers=4,rw,hard,timeo=600")
+        self.assertEqual(mount_opts(4, "host"), "vers=4,rw,noresvport,hard,timeo=600")
+
+    def test_mount_opts_keep_the_client_off_published_privileged_ports(self):
+        """A reserved source port can land on imaps/993 or pop3s/995 and then
+        blocks the whole ingress port set of the mail stack."""
+        for version in (3, 4):
+            for runtime in ("dev", "act", "github", "host"):
+                self.assertIn("noresvport", mount_opts(version, runtime))
 
     def test_mount_opts_v4_carries_no_v3_locking_token(self):
         self.assertNotIn("local_lock", mount_opts(4, "host"))
         self.assertNotIn("nolock", mount_opts(4, "host"))
 
     def test_mount_opts_v3_still_disables_nlm(self):
-        self.assertEqual(mount_opts(3, "host"), "vers=3,rw,hard,timeo=600,nolock")
+        self.assertEqual(
+            mount_opts(3, "host"), "vers=3,rw,noresvport,hard,timeo=600,nolock"
+        )
 
     def test_client_src_kernel_v4_is_root(self):
         self.assertEqual(

utils/storage/nfs.py

@@ -61,7 +61,7 @@ def mount_opts(version, runtime):
         else "hard,timeo=600"
     )
     locking = "" if int(version) >= 4 else ",nolock"
-    return f"vers={version},rw,{reliability}{locking}"
+    return f"vers={version},rw,noresvport,{reliability}{locking}"
 
 
 def client_src(server, version, flavor, state_path_value):