[SOLVED] Unprivliged Nextcloud CT access to Truenas Core VM NFS share

Tactcl

New Member
Aug 11, 2024
2
1
3
This is my first post. I've been dabbling with Proxmox for about a year now, and have usually been able to find the answers I need in the excellent documentation or the abundance of community discussions. While there is a lot of documentation and community resources for what I'm trying to do, I think I've messed up some subtle detail and I'm in too deep to see it.
My goal is to have Nextcloud do auto backups of media on my phone/PC, but when Nextcloud tries to create dir/files the permissions end up as ---rwx--- and it cannot access them:
1723349306960.png

The Truenas VM, PVE host and Nextcloud CT all have a user truenas with uid/gid 7000/7000.
I have a mounted the Truenas VM NFS share on the PVE host and set chown -R 7000:7000 for the share:
Bash:
root@pvex01:~# ls -lahn /mnt/pve/truenas-stor |grep " _"
drwxrwx---  7 7000 7000   11 Jul 28 21:53 _Apps
drwxrwx--- 11 7000 7000   11 Jan 18  2020 _Archive
drwxrwx--- 35 7000 7000   51 Nov  8  2023 _BackUp
drwxrwx---  6 7000 7000   24 Jul 17 01:57 _Documents
drwxrwx---  6 7000 7000    8 Jul 23 00:48 _Games
drwxrwx--- 32 7000 7000   34 Sep 24  2023 _Movies
drwxrwx--- 37 7000 7000   40 Oct 17  2022 _Music
drwxrwx--- 18 7000 7000   18 Jan 26  2023 _NotPictures
drwxrwx--- 94 7000 7000  160 Jul 12 19:06 _Pictures
drwxrwx---  7 7000 7000    7 Jan 31  2021 _TV
drwxrwx---  3 7000 7000    3 Jan 19  2020 _Web
root@pvex01:~#

Configured the Nextcloud CT with help from this doc: https://pve.proxmox.com/wiki/Unprivileged_LXC_containers

Bash:
root@pvex01:~# cat /etc/pve/lxc/103.conf
arch: amd64
cores: 2
features: nesting=1
hostname: nc
memory: 4096
mp0: /mnt/pve/truenas-stor,mp=/mnt/truenas
net0: name=eth0,bridge=vmbr0,firewall=1,hwaddr=BC:24:11:9C:0E:CF,ip=dhcp,ip6=dhcp,type=veth
ostype: debian
rootfs: pve-shared:103/vm-103-disk-0.raw,size=128G
swap: 512
unprivileged: 1
lxc.idmap: u 0 100000 7000
lxc.idmap: g 0 100000 7000
lxc.idmap: u 7000 7000 1
lxc.idmap: g 7000 7000 1
lxc.idmap: u 7001 107001 58535
lxc.idmap: g 7001 107001 58535
root@pvex01:~# cat /etc/subuid
root:100000:65536
root:7000:1
truenas:7000:1
root@pvex01:~# cat /etc/subgid
root:100000:65536
root:7000:1
truenas:7000:1
root@pvex01:~#
pct set 103 -mp0 /mnt/pve/truenas-stor,mp=/mnt/truenas

On the Nextcloud CT, it is using the www-data account to create files, I've added it to the truenas group:
Bash:
root@nc ~# id www-data
uid=33(www-data) gid=33(www-data) groups=33(www-data),109(redis),7000(truenas)
root@nc ~# id root
uid=0(root) gid=0(root) groups=0(root),7000(truenas)
root@nc ~#

What am I lacking to allow the www-data user to create files and directories on the share with the right privliges?
I understand that making this container privileged would make this easier, but it seems like it's so close to working this way.
Someone was talking about doing the share with a iSCSI device, but it wasn't clear to me how that would work.
I'm open to other ideas to accomplish this. I want a Nextcloud group to be able to access the Truenas storage, and also get photos backups from phones in Nextcloud to the Truenas storage.
 
Ok, after setting the data pools ACL for @owner, @group and @everyone, the permissions are correct when new directories or files are created
 
  • Like
Reactions: roxy

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!