81 lines
4.3 KiB
Markdown
81 lines
4.3 KiB
Markdown
# TrueNAS pveuser + Proxmox Storage Integration Chart — 2026-06-02
|
|
|
|
**TrueNAS:** beelink-tns (192.168.16.254) | **Proxmox:** mk33 (192.168.7.33)
|
|
|
|
---
|
|
|
|
## TrueNAS Changes: New User `pveuser`
|
|
|
|
| Property | Value |
|
|
|----------|-------|
|
|
| **Username** | `pveuser` |
|
|
| **UID** | 3003 |
|
|
| **GID** | 3003 |
|
|
| **Home** | `/var/empty` |
|
|
| **Shell** | `/usr/sbin/nologin` |
|
|
| **SMB** | Disabled |
|
|
| **Password** | Disabled (SSH key only) |
|
|
| **Groups** | `src` (GID 40) |
|
|
| **Role** | FULL_ADMIN (TrueNAS API role) |
|
|
|
|
## TrueNAS Changes: NFS ACL Permissions
|
|
|
|
| Dataset | Path | pveuser | Other Users | TrueNAS Permission |
|
|
|---------|------|---------|-------------|-------------------|
|
|
| **Backup** | `/mnt/Ice/Backup` | FULL_CONTROL | owner@, group@ | rw |
|
|
| **ISOs** | `/mnt/Ice/ISOs` | READ | owner@, group@ | r |
|
|
| Archive | `/mnt/Ice/Archive` | — | owner@, group@ | (not mapped) |
|
|
| Repo | `/mnt/Ice/Repo` | — | owner@, group@ | (not mapped) |
|
|
|
|
## TrueNAS Changes: NFS Maproot (All Shares)
|
|
|
|
| Share ID | Path | Previous Maproot | New Maproot |
|
|
|----------|------|-----------------|---------|
|
|
| 1 | `/mnt/Ice/Archive` | `nobody` | `pveuser` |
|
|
| 2 | `/mnt/Ice/Backup` | `nobody` | `pveuser` |
|
|
| 3 | `/mnt/Ice/ISOs` | `nobody` | `pveuser` |
|
|
| 6 | `/mnt/Ice/Repo` | `nobody` | `pveuser` |
|
|
| 7 | `/mnt/Ice/Backup/proxmox-pool/ds-mp-share` | (empty) | `pveuser` |
|
|
| 8 | `/mnt/Ice/Backup/proxmox-pool/pve-ct-stor` | (empty) | `pveuser` |
|
|
| 9 | `/mnt/Ice/Backup/proxmox-pool/pve-vm-stor` | (empty) | `pveuser` |
|
|
|
|
> **Note:** Maproot remaps ALL incoming NFS root (UID 0) requests to `pveuser` (UID 3003) on TrueNAS. Any root client (e.g., Proxmox mk33) accessing these shares will appear as `pveuser` on the TrueNAS filesystem, enforcing the ACL permissions above.
|
|
|
|
## Proxmox Storage Configuration (mk33)
|
|
|
|
| Storage ID | Type | Server | Export | Content | Options | Status |
|
|
|------------|------|--------|--------|---------|---------|--------|
|
|
| `nas-backup` | NFS | 192.168.16.254 | `/mnt/Ice/Backup` | backup, images, rootdir, snippets, vztmpl | vers=4.2,proto=tcp | ✅ active |
|
|
| `nas-iso` | NFS | 192.168.16.254 | `/mnt/Ice/ISOs` | iso, vztmpl | vers=4.2,proto=tcp | ⚠️ inactive (read-only, PVE cannot create content dirs) |
|
|
| `nas-repo` | NFS | 192.168.16.254 | `/mnt/Ice/Repo` | snippets | vers=4.2,proto=tcp | ⚠️ inactive (permission) |
|
|
| `nas-ds-mp-share` | NFS | 192.168.16.254 | `/mnt/Ice/Backup/proxmox-pool/ds-mp-share` | images, rootdir | vers=4.2,proto=tcp | ✅ active |
|
|
| `nas-ct-stor` | NFS | 192.168.16.254 | `/mnt/Ice/Backup/proxmox-pool/pve-ct-stor` | rootdir | vers=4.2,proto=tcp | ✅ active |
|
|
| `nas-vm-stor` | NFS | 192.168.16.254 | `/mnt/Ice/Backup/proxmox-pool/pve-vm-stor` | images | vers=4.2,proto=tcp | ✅ active |
|
|
|
|
## PVE Access Verification
|
|
|
|
| Mount Point | Writable? | Expected? |
|
|
|-------------|-----------|-----------|
|
|
| `/mnt/pve/nas-backup` | ✅ Yes | Yes (FULL_CONTROL) |
|
|
| `/mnt/pve/nas-iso` | ❌ Read-only | Yes (READ via ACL + NFS mount) |
|
|
| `/mnt/pve/nas-vm-stor` | ✅ Yes | Yes (Proxmox pool) |
|
|
| `/mnt/pve/nas-ct-stor` | ✅ Yes | Yes (Proxmox pool) |
|
|
| `/mnt/pve/nas-ds-mp-share` | ✅ Yes | Yes (Proxmox pool) |
|
|
|
|
## Notes
|
|
|
|
- `nas-iso` shows `inactive` in `pvesm status` because Proxmox tries to create `/mnt/pve/nas-iso/template/iso` on activation and fails (ACL READ only). The mount is still present and usable for ISO uploads/downloads — just not as a content-managed Proxmox storage.
|
|
- `nas-repo` shows `inactive` for similar reasons — Repo has no `pveuser` WRITE access in its ACL. Add `pveuser` to Repo ACL if snippets need to be writable from PVE.
|
|
- No local `pveuser` account exists on mk33. The user mapping is handled entirely by NFS `maproot_user` on TrueNAS.
|
|
- All NFS exports restricted to `192.168.0.0/18` (done in prior hardening).
|
|
|
|
## Recommendations
|
|
|
|
1. **ISOs as managed storage**: If you want Proxmox to manage ISOs (upload via UI), remove the ACL READ-only restriction and set `pveuser` READ on ISOs, or use the Proxmox `local` storage for ISO staging and copy to `nas-iso` manually.
|
|
2. **Repo snippets**: Add `pveuser` FULL_CONTROL to `/mnt/Ice/Repo` if you need to store Proxmox snippets there.
|
|
3. **Monitor mount health**: If TrueNAS reboots, PVE will auto-reconnect on next storage access. For immediate recovery, run `pvesm status` or restart `pvedaemon`.
|
|
|
|
---
|
|
|
|
*Generated: 2026-06-02*
|