docs(audit): DSM spike — consumer recipes validated on real DSM 7.2, hardlink caveat closed, taxonomy identical
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
@@ -0,0 +1,67 @@
|
||||
# SPIKE — Synology DSM pass of the NAS recipes (virtual-dsm), validated through the v0.114 pipeline
|
||||
|
||||
**Date:** 2026-07-11 · **Class:** Spike (timeboxed 90 min; finished in ~55 incl. teardown).
|
||||
**Goal:** replace the "Debian-simulated NAS" caveat with REAL DSM evidence for the consumer recipes,
|
||||
answer the DSM hardlink question (the Q5 caveat), and spot-check the error taxonomy against DSM's
|
||||
strings. Output = this doc + the guidance-copy edit list (lands with controller v0.115.0).
|
||||
**Rig:** `vdsm/virtual-dsm` container on DooPlex, **macvlan** network with its own LAN IP
|
||||
**192.168.0.199** (standard ports 445/2049 — the locked mount recipes cannot use alternate ports;
|
||||
the ping+neigh-verified-unused IP from the earlier spikes). DSM **7.2** (VirtualDSM), storage on a
|
||||
spike-named scratch volume. Setup wizard + all DSM config driven via claude-in-chrome; throwaway
|
||||
credentials, never committed. **Everything below ran through the REAL demo add pipeline** (guest
|
||||
9201, controller v0.114.0 + agent v0.81.0, the exact `/api/storage/netstorage/add` + status-poll
|
||||
the UI invokes — anti-F9).
|
||||
|
||||
## Verdict table
|
||||
|
||||
| # | Recipe | Result | Evidence |
|
||||
|---|--------|--------|----------|
|
||||
| 1 | **NFS consumer recipe** — DSM squash **"Map all users to admin"**, rw, host IP rule | **PASS end-to-end** — add `done` in 4 s; uid-1000 probe: write/mkdir/rename/**hardlink (links=2)**/delete all OK; guest view `65534:65534` (nobody); `chown` clean EPERM; `chmod` succeeds — **byte-for-byte the Debian Route-A profile** |
|
||||
| 2 | **NFS WRONG case** — same share, squash **"No mapping"** | **PASS (refused as designed)** — verify mounts, the uid-1000 probe refuses → `not_writable` + the Route-A Hungarian message (computed 101000), full rollback (zero units left). The June pin holds on real DSM |
|
||||
| 3 | **SMB plain user** — DSM user + rw on the share, NO server-side uid config | **PASS end-to-end** — `done` in 4 s; guest view forced `1000:1000/0664`; **hardlink WORKS on DSM SMB (`links=2`)** — the Q5 caveat CLOSES for Synology (DSM 7.2 Samba/btrfs) |
|
||||
| 4 | **Taxonomy spot-check** — wrong SMB password / wrong share name | **IDENTICAL classification** — `smb_auth` / `smb_share`; no DSM-specific strings fell to `mount_failed` |
|
||||
|
||||
## DSM menu paths + exact wording (for the guidance)
|
||||
|
||||
- **Enable NFS (OFF by default, and capped at NFSv3 by default!):** Control Panel → File Services →
|
||||
**NFS** tab → check "Enable NFS service" → **Maximum NFS protocol: NFSv4.1** → Apply.
|
||||
⚠ This is a REQUIRED guidance step: the felhom mount is `vers=4.1`; a DSM left on the NFSv3
|
||||
default refuses it (the add would fail `mount_failed`-class). SMB needs nothing (on by default).
|
||||
- **NFS rule:** Control Panel → Shared Folder → \<share\> → Edit → **NFS Permissions** tab → Create →
|
||||
Hostname or IP: the Felhom host IP → Privilege: Read/Write → **Squash: "Map all users to admin"**
|
||||
(dropdown options verbatim: `No mapping / Map root to admin / Map root to guest / Map all users
|
||||
to admin / Map all users to guest`) → Save. The **mount path** (what goes in the felhom form's
|
||||
export field) is displayed on the same tab: `/volume1/<share>`.
|
||||
- **SMB user:** Control Panel → User & Group → Create → (wizard) → at "Assign shared folders
|
||||
permissions" tick **Read/Write** on the share. That is ALL — no force-user anywhere.
|
||||
|
||||
## Guidance-copy edit list (rides controller v0.115.0 — Part B)
|
||||
|
||||
1. SMB paragraph: unchanged in substance; may cite "DSM: Vezérlőpult → Felhasznál..." — keep it
|
||||
one line: user + Read/Write a megosztáson (validated on DSM 7.2).
|
||||
2. NFS simple recipe: name DSM's dropdown verbatim — `„Map all users to admin”` as the concrete
|
||||
Synology wording for the map-all-users option; add the REQUIRED step "NFS szolgáltatás
|
||||
bekapcsolása + Maximum NFS protocol: NFSv4.1" with the File Services path; add that the export
|
||||
path is `/volume1/<megosztás>` and is shown on the NFS Permissions tab.
|
||||
3. The closing caveat line narrows from "Synology/QNAP útmutató készül" to **QNAP only**:
|
||||
`A QNAP felületére szabott lépésről lépésre útmutató készül.` — Synology is now validated.
|
||||
**QNAP stays a stated caveat — no emulator exists; nothing was fabricated.**
|
||||
4. The *arr/hardlink note (network-storage-nas.md): Synology SMB hardlink = CONFIRMED WORKING
|
||||
(DSM 7.2); the "re-verify per appliance" caveat now applies to QNAP/others only.
|
||||
|
||||
## Observations (not acted on)
|
||||
|
||||
- virtual-dsm's NAT (container 192.168.0.199 → inner VM 172.30.0.199) forwards NFS/SMB fine; the
|
||||
verify pipeline's TCP pre-probe, mount, and uid-1000 probe all behaved as on a bare server.
|
||||
- DSM's first-boot wizard pushes Synology-account/2FA/analytics screens — all skippable; the
|
||||
update-options page was set to manual (a spike VM must not self-update mid-test).
|
||||
- The demo box now carries the operator's own permanent `nas-media` share
|
||||
(192.168.0.180:/mnt/5_hdd/felhom-data, health ok) — untouched by this spike; it is the Part E
|
||||
(Q1c restart) subject.
|
||||
|
||||
## Teardown — verified
|
||||
|
||||
`dsmsmb`/`dsmnfs` removed via the real remove endpoint (list shows only `nas-media`); felhom-pve:
|
||||
zero dsm* units/creds/mountpoints, reset-failed clean. DooPlex: `dsm-spike` container removed,
|
||||
`dsm-spike-net` macvlan removed, `~/dsm-spike` scratch deleted; port probes DEAD (5000 + 445
|
||||
refused). Throwaway DSM credentials died with the VM.
|
||||
Reference in New Issue
Block a user