SMB/CIFS ISO image storage directory structure / write issue

[ethereal]

Hi everyone,

I am adding new SMB/CIFS "storage" that will be used exclusively as "iso library" for OS installations (/etc/pve/storage.cfg - content iso).... Idea was to create SMB share with settings 'guest ok = yes' + 'read only = yes' (except for specific users ofcourse), so everyone can read, but not everyone can write.

Unfortunately I've learned that prox needs write permissions on that share so it can create following directory layout (iso-library is smb share):

iso-library
├── images
└── template
└── iso
└── cbpp-12.0-amd64-20230611.iso

In scenario above Prox only sees iso images that are within iso directory (containing 'cbpp'). Is that only possible way, or there's a way to make prox see iso images that are in 'iso-library', two directories above in this case?

And second, did anyone manage to mount iso share that has only Read permissions?

Thanks!

 

[ethereal]

UPDATE:

In regards to default directory layout, Prox says: "We use a predefined directory layout to store different content typesinto different sub-directories. This layout is used by all file levelstorage backends." - https://pve.proxmox.com/wiki/Storage:_Directory

However, here you can see that there is option to override that layout: https://localhost:5555/pve-docs/chapter-pvesm.html#storage_cifs

content-dirs
Overrides for the default directory layout. Optional.

C/P from first link above:

Configuration Example (/etc/pve/storage.cfg)

dir: backup
        path /mnt/backup
        content backup
        prune-backups keep-last=7
        max-protected-backups 3
        content-dirs backup=custom/backup/dir

Getting closer

 

[fabian]

you can tell PVE to never create dirs, and override the content dirs, so I think your use case should be fully supported. note that you need to use "pvesm" (or the API) to set those settings, they are not exposed on the UI

 

[ethereal]

you can tell PVE to never create dirs, and override the content dirs, so I think your use case should be fully supported. note that you need to use "pvesm" (or the API) to set those settings, they are not exposed on the UI

Hi Fabian, thanks for pointing me to right direction. To help others in the future, I've managed to add it with following syntax:

pvesm add cifs test --server "server-ip-address" --share "name-of-share" --content iso --content-dirs iso=./ --username "username" --password "password"

However, share still needs to have write permissions and I did not manage to add it without specifying username and password credentials?!

EDIT: pvesm scan cifs xx.xx.xx.xx shows shares without specifying username/pass...

P.S. Once added, regardless through UI or CLI, if you remove cifs storage from your "datacenter", it disappears from UI and it's removed from storage.cfg but remains mounted, I have to manually unmount it and delete directory in /mnt/pve/ - is that normal behavior?

 

[Kingneutron]

An alternate way:
https://github.com/kneutron/ansitest/blob/master/proxmox/symlink-samba-isos.sh

Recursively scans your Samba ISO mount(s) and flat-maps it into /var/lib/vz , no Write permissions on Samba necessary. I run it nightly in cron to update; it can also remove broken symlinks

 

[fabian]

P.S. Once added, regardless through UI or CLI, if you remove cifs storage from your "datacenter", it disappears from UI and it's removed from storage.cfg but remains mounted, I have to manually unmount it and delete directory in /mnt/pve/ - is that normal behavior?

yes

EDIT: pvesm scan cifs xx.xx.xx.xx shows shares without specifying username/pass...

then those shares are visible to the public

 

[ethereal]

Thanks for help everyone, rest of my issue was trivial - samba share had 770 permissions - resolved by changing to 775. After that, following syntax worked:

pvesm add cifs test --server x.x.x.x --share iso-library --content iso --content-dirs iso=./

smb.conf share configuration:

[iso-library]
comment = ISO library
path = /srv/shares/iso-library
guest ok = yes
read only = yes

then those shares are visible to the public

You are right, 'browseable = yes' is on by default in current smb.