bundles/nfs-server: ensure nfs runs on managed ports, fix firewall rules

bundles/nfs-server/metadata.py

@@ -11,6 +11,15 @@ defaults = {
             },
         },
     },
+    'sysctl': {
+        'options': {
+            'fs.nfs.nlm_udpport': 4045,
+            'fs.nfs.nlm_tcpport': 4045,
+        },
+        'reload_triggers': {
+            'svc_systemd:nfs-server:restart',
+        },
+    },
 }
 
 
@@ -19,18 +28,17 @@ defaults = {
 )
 def firewall(metadata):
     ips = set()
-
     for share_items in metadata.get('nfs-server/shares', {}).values():
         for share_target in share_items:
             ips.add(share_target)
 
+    rules = {}
+    for port in ('111', '2049', '1110', '4045', '35295'): # TODO find out if we need more ports
+        for proto in ('', '/udp'):
+            rules[port + proto] = atomic(ips)
+
     return {
         'firewall': {
-            'port_rules': {
-                '111': atomic(ips),
-                '111/udp': atomic(ips),
-                '2049': atomic(ips),
-                '35295': atomic(ips),
-            },
+            'port_rules': rules,
         },
     }