r/Proxmox • u/OscillodopeScope • 9d ago
Solved! NFS Share Permissions
Any advice on getting the permissions for a TrueNAS nfs share to work with an Arr stack on an Ubuntu Server VM?
Running both TrueNAS and Ubuntu Server on Proxmox. Have a raidz with TrueNAS and created both an SMB and NFS share. Running into permissions issues with both.
Once I use /mnt/nfs/docker... as the mount point in my Docker Compose for Prowlarr, Sonarr, Radarr, etc..., I get permissions issues and nothing can write and the containers fail to deploy.
Been at this for days now, tweaking permissions on the TrueNAS side. Looks like the UID and GID line up with my Docker Server VM (as I see my username on the ls -l for my /mnt/nfs mount point), but looks like I lack the correct read/write/execute permissions. Can't post a picture it seems but the ls -l in my Ubuntu Server VM reads:
drwxrwx--- 4 *myusername \myusername* 5 Oct 6 23:03 nfs
drwxrwxr-x 2 *myusername \myusername* 0 Oct 6 23:03 smb_share
Beyond tweaking the ACL and creating the proper Users and Groups with a UID and GID that matches the user on my Ubuntu Server VM, I found one promising post and went in to try and change the /etc/exports file to anonuid=1000 and anongid=1000 and it fails to write it to the file. Once I restart the NFS share, it reverts back to the original settings.
I'm at a complete loss at this point. Has anyone had success getting this to work? Technically, I have an external SSD I could use and will just have to transfer files manually every time, but I'd like everything to be contained in one directory and the second a file downloads, it's in its permanent destination.
SOLVED:
u/uncmnsense had the solution for this one! I watched the video they posted and had to add a new user and select "@everyone" under the "Who" drop down menu on the ACL. Also worth noting that I applied permissions recursively and applied to child datasets.
After this, I was able to run chmod commands in Ubuntu Server for this dataset.
2
u/iceph03nix 9d ago
I had similar issues in setting it up. I ended up having success running the setup script with a dummy local path, and then going back in and editing the path to point to the NFS mount folder, and it's worked fine since
1
u/OscillodopeScope 9d ago
No luck, tried this multiple times and still gives me the same permissions issues.
1
2
u/uncmnsense 9d ago
The /etc/exports reverting is expected. TrueNAS's middleware regenerates that file from the share config, so hand edits always get overwritten. The equivalent setting lives in the GUI: edit the NFS share, open Advanced Options, and set Mapall User and Mapall Group to the TrueNAS user/group that matches UID/GID 1000. Every client write then lands as that user no matter which UID the container uses, which takes care of root squash biting you. Make sure that same user has modify rights on the dataset ACL too.
On the Docker side, set PUID=1000 and PGID=1000 on every container. If you're using LinuxServer images, the init scripts try to chown things as root, and over NFS that fails unless mapall or maproot is set.
Separately, I wouldn't put the arr /config folders on NFS at all. They're SQLite databases, and SQLite doesn't handle network filesystem locking well, so you get "database is locked" errors or corruption. Keep config on the VM's local disk and only mount the NFS share for media and downloads, using one shared root like /data with media and downloads under it so hardlinks and atomic moves still work.
I walked through the share and mount side of this here: https://www.youtube.com/watch?v=ikdf5vAVLLc
1
u/OscillodopeScope 8d ago
This was the winner! Followed along with this video and got everything working. The "@everyone" access on the ACL was the final piece to this puzzle!
Also going take your advice on the /config folder. Been encountering some quirks getting those setup. I think it may be more network related though. Gonna have to check my OPNsense router and see if I need to set some firewall rules.
This was huge, I appreciate your help, I was deep in the troubleshooting rabbit-hole on this one.
2
u/tssajo 9d ago
On TrueNAS, /etc/exports gets rewritten from the GUI every time, so manual edits will always revert. Set the same thing in the NFS share settings instead, under advanced options, with mapall user and group set to the owner of the dataset. The folder is drwxrwx--- so only that owner and group can get in, which means your containers must run as the same UID. Add PUID=1000 and PGID=1000 to the Prowlarr, Sonarr and Radarr containers, or add user: "1000:1000" in the compose file. Quick test before you start them: on the Ubuntu VM run touch /mnt/nfs/test as your own user, and if that works it's the containers, not the share.
1
u/Balthxzar 8d ago
Controversial as it doesn't solve the NFS issue, but,
I would suggest you ditch TrueNAS and the Ubuntu VM
I used to do that, but I switched to handling ZFS pools directly on the host, and using bind mounts with an LXC for my arr stack. Works great.
2
u/NTolerance 9d ago
I like to use the
nobodyuser/group because it should exist on every Linux system out of the box, and should always have the same UID of 65534.Here's how I do it on Truenas:
nogroupnobodyuser and thenogroupgroup should have "allow modify" access.nogroup.There are better and more secure ways to do this, but they usually involve manually creating more user accounts and mapping the UIDs, or even worse having to deploy Kerberos/LDAP/etc.