CT-101 Samba: ganesha.conf für Ganesha 6.5 im unprivileged LXC korrigieren

- Allow_Set_IO_Flusher_Fail = true: PR_SET_IO_FLUSHER braucht CAP_SYS_ADMIN
  in der init-userns (im Guest nicht vorhanden) und war FATAL
- NFSv4 RecoveryRoot = /var/lib/nfs-ganesha (rw-State-Volume des Quadlets);
  der Default /var/lib/nfs/ganesha ist im ReadOnly-Container nicht schreibbar
- AccessType -> Access_Type (Ganesha 6.5, sonst "Unknown parameter")
- per-export Client-Liste entfernt: Clients/clients/CLIENT-Block werden vom
  6.5-Parser abgelehnt; die Client-Beschränkung (nur 10.0.0.90) wird durch
  die nftables-Policy durchgesetzt (2049 nur von 10.0.0.90, default drop)
- im Image verifiziert: strict parse (-x) clean, Listener auf *:2049 OK

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

proxmox/lxc/ct-101-samba/ansible/roles/samba_nfs/templates/ganesha.conf.j2

@@ -6,22 +6,37 @@ NFS_CORE_PARAM {
     Protocols = 4;
     Enable_NLM = false;
     Enable_RQUOTA = false;
+    # Unprivileged LXC: PR_SET_IO_FLUSHER needs CAP_SYS_ADMIN in the init user
+    # namespace, which a guest root does not have; allow the failure (verified
+    # with ganesha.nfsd in the image on 2026-10-30).
+    Allow_Set_IO_Flusher_Fail = true;
+}
+
+NFSv4 {
+    # The recovery dir must live on the rw state volume (the Quadlet mounts
+    # /var/lib/ghostnet/samba/ganesha at /var/lib/nfs-ganesha); the compiled-in
+    # default /var/lib/nfs/ganesha is read-only inside the container.
+    RecoveryRoot = /var/lib/nfs-ganesha;
 }
 
 EXPORT_DEFAULTS {
-    AccessType = None;
+    Access_Type = None;
 }
 
 EXPORT {
     Export_Id = {{ samba_nfs_export_id }};
     Path = {{ samba_nfs_export_path }};
     Pseudo = {{ samba_nfs_export_path }};
-    AccessType = RW;
+    Access_Type = RW;
     Squash = rootid;
     SecType = sys;
     Protocols = 4;
     Transports = TCP,UDP;
-    Clients = {{ samba_nfs_client_ipv4 }};
+    # Client restriction ("only ghostnet-ki 10.0.0.90", GNAI-017 section 4.1) is
+    # enforced by the nftables policy (port 2049 only from 10.0.0.90, default
+    # drop; samba_firewall, asserted by verify-production.yml). Ganesha 6.5 has
+    # no valid per-export client-list parameter (Clients/clients/CLIENT block
+    # are all rejected by the parser, verified 2026-10-30).
     FSAL {
         Name = VFS;
     }