Another Proxmox File Server Inquiry

bnk

New Member
Dec 22, 2023
3
0
1
I have read so many forum posts about how to run a NAS on Proxmox and watched so many videos that I really hate to post another. Unfortunately, I have not been able to find a guide or other material to help in what I am trying to do.

1. Create a LXC Container (Privileged or Unprivileged)
2. Create a bind-mount from the host into the container
3. Join the container to the existing Active Directory
4. Create samba share with Active Directory Authentication
5. Install some UI to help manage (Cockpit, etc.)

Some guides suggest running a NAS inside a VM. I don't want to do this for several reasons. First, that would require either preconfiguring dedicated space to the VM or hardware passthrough. I want to share the disk space on the host and not have to carve it out for the VM. I also need to share the host resources with multiple LXCs and don't want to get networking involved. Bind-Mount LXCs is both highly performant and easy to share across containers.

I have found some guides for LXC Fileservers, however none discuss Active Directory Integration at all. This is a hard requirement. I think that this is the hardest thing to wrap my head around. I know that it is complicated to integrate the security from the host bind-mount to the LXC Container and finally the share.

So my main question really is, how do I to get the security setup right so that I use a bind-mount to create a share secured by the domain.

Has anyone done exactly this?

Does the proxmox server need to be domain joined first? For UID/GIU mapping?

Does th LXC container need to be Privileged?
 
require either preconfiguring dedicated space
Why? You could put that virtual disk on a storage that supports thin-provisioning.

I also need to share the host resources with multiple LXCs and don't want to get networking involved.
Did you see VirtFS? With that you could do something similar to bind-mounts into VMs: https://www.linux-kvm.org/page/VirtFS
But not sure how stable/experimental it is right now.
 
Why? You could put that virtual disk on a storage that supports thin-provisioning.
Thin provisioning does save space that's true. There is still a lot of extra overhead running virtual disks on top of the file system. I have several high IO operations that I want to optimize as much as possible. I am also talking about large file system (72 TB) which I don't want to run on virtual disks.

Did you see VirtFS? With that you could do something similar to bind-mounts into VMs: https://www.linux-kvm.org/page/VirtFS
But not sure how stable/experimental it is right now.

No, I have never heard of VirtFS. This is interesting. I could run a debian based NAS such as TrueNAS Scale or Open Media Vault as a VM and pass through the filesystem. I like this approach a lot for several reasons. First, these products have very mature UIs which would make administration much easier. Second, the added overhead of the VM will only affect the network shares. Other workloads on the host will still be using bind mount for maximum performance.

Do you know if I am going to experience the same issues with security as I am now with bind-mount LXCs?

I think the complexity of adding Windows Domain Users and ACLs to my security model is what is kicking me in the A$$ and I am not sure that this solves for that.
 
Check out this video. I’m not sure it answers everything but might be a good start.

Turning Proxmox into a Pretty Good NAS
Thanks. Watched it a few times before. Stops at basic user authentication. Does not cover Windows Domain Users and ACLs.

I think the user security and permissions is the biggest piece that I am missing. How to enable user security through the bind mount and up through the samba share including Windows Domain Users and ACLs