NFS

NFS (Network File System) is a distributed file system protocol that lets a client access files on a remote server as if they were local. It is ubiquitous in datacenter and enterprise environments for shared storage, home directories, and appliance exports on NAS devices.

The NFS integration walks an exported directory tree and captures its files and directories into a Kloset store with encryption and deduplication. Plakar speaks NFSv3 directly over ONC-RPC, so no kernel mount is involved and neither root privileges nor mount capability are required on the host.

The NFS integration provides two connectors:

Installation

The NFS package can be installed using pre-built binaries or compiled from source.

$ plakar pkg add nfs

$ plakar pkg show

$ plakar pkg build nfs

$ plakar pkg add ./nfs_v1.0.0_darwin_arm64.ptar

$ plakar pkg show

To list, upgrade, or remove the package, see managing packages guide.

Configuration

Addressing an export

An NFS location identifies the server and the export to mount:

nfs://<host>[:<port>]/<export>[/<subpath>]

The path is the server-side export to mount. A deeper subpath narrows the walk to a subtree of that export, which the root option also does.

Configuration options

These options apply to both connectors.

Source connector

The source connector walks the export, or a subtree of it, and stores the files and directories it finds in a Kloset store with encryption and deduplication. Each entry is captured with its size, mode, ownership, and modification time.

flowchart LR

subgraph Source["NFS Export"]
  FS["Files"]
end

subgraph Plakar["Plakar"]
  Connector["Walk export via
NFSv3"]
  Transform["Encrypt & deduplicate"]
  Connector --> Transform
end

Source --> Connector

Store["Kloset Store"]
Transform --> Store

Register the source and run a backup:

$ plakar source add my-nfs-export \
  location=nfs://nas.example.com/exports/data

$ plakar at /var/backups backup "@my-nfs-export"

To back up a subtree rather than the whole export, extend the location with the path inside the export. The uid and gid presented to the server decide what the walk is allowed to read:

$ plakar source add my-nfs-home \
  location=nfs://nas.example.com/exports/home/alice \
  uid=1000 gid=1000

A location can also be passed directly to backup:

$ plakar at /var/backups backup nfs://nas.example.com/exports/data

$ plakar at /var/backups backup \
  -o uid=1000 -o gid=1000 \
  nfs://nas.example.com/exports/home/alice

Destination connector

Restores a snapshot from a Kloset store back to an NFS export, recreating the directory hierarchy and file contents.

flowchart LR

Store["Kloset Store"]

subgraph Plakar["Plakar"]
  Transform["Decrypt & reconstruct"]
  Connector["Write files via
NFSv3"]
  Transform --> Connector
end

Store --> Transform

subgraph Destination["NFS Export"]
  FS["Files"]
end

Connector --> Destination

Register the destination and restore a snapshot:

$ plakar destination add my-nfs-restore \
  location=nfs://nas.example.com/exports/restore

$ plakar at /var/backups restore -to "@my-nfs-restore" <snapshot_id>

Limitations

Protocol support

Only NFSv3 is supported. NFSv4, Kerberos (sec=krb5), and NFS over UDP are not.

Authorization

Authorization uses AUTH_UNIX, meaning a numeric user and group ID presented to the server. The export must permit the presented credentials, for example through an *(rw,no_root_squash)-style export or a matching uid on the server.

Restored file types and metadata

Only regular files and directories are reconstructed on restore. Symlinks, device nodes, sockets, and FIFOs are reported as errors.

File modes are applied when each entry is created. Ownership and timestamps are not restored.