underpost 3.2.10 → 3.2.12

package/scripts/k3s-node-setup.sh

@@ -1,46 +1,70 @@
 #!/bin/bash
-set -e
+set -euo pipefail
 
 # ---------------------------------------------------------------------------
 # Underpost K3s Node Setup
-# Usage:
-#   --control                   Initialize as K3s control plane node (default)
-#   --worker                    Initialize as K3s worker node
-#   --control-ip=<ip>           Control plane IP (required for --worker)
-#   --token=<token>             K3s node token (required for --worker)
 #
-# DESIGN NOTES:
-# - This script installs the underpost CLI globally via npm.
-# - It then uses the global CLI binary for configuration and K3s setup.
-# - Engine source replication (e.g. via --bootstrap-engine from the host)
-#   is a SEPARATE step. This script does NOT depend on /home/dd/engine
-#   being pre-pushed. Use --bootstrap-engine after --init-vm completes.
+# This script runs INSIDE an LXD VM. It assumes the host has already mirrored
+# the project source into $ENGINE_ROOT (default /home/dd/engine) via the
+# `underpost lxd [vm-id] --vm-init` flow in `src/cli/lxd.js`. There is no
+# fallback to a globally installed `underpost`: every operational command
+# resolves from the local project so the latest local changes are always what
+# runs in the VM.
+#
+# Usage:
+#   --engine-root=<path>   Path to the mirrored engine source (default: /home/dd/engine)
+#   --control              Initialize as K3s control plane node (default)
+#   --worker               Initialize as K3s worker node
+#   --control-ip=<ip>      Control plane IP (required for --worker)
+#   --token=<token>        K3s node token (required for --worker)
 # ---------------------------------------------------------------------------
 
 ROLE="control"
 CONTROL_IP=""
 K3S_TOKEN=""
+ENGINE_ROOT="/home/dd/engine"
 
 for arg in "$@"; do
-  case $arg in
-    --worker)         ROLE="worker" ;;
-    --control)        ROLE="control" ;;
-    --control-ip=*)   CONTROL_IP="${arg#*=}" ;;
-    --token=*)        K3S_TOKEN="${arg#*=}" ;;
-  esac
+    case $arg in
+        --worker)         ROLE="worker" ;;
+        --control)        ROLE="control" ;;
+        --control-ip=*)   CONTROL_IP="${arg#*=}" ;;
+        --token=*)        K3S_TOKEN="${arg#*=}" ;;
+        --engine-root=*)  ENGINE_ROOT="${arg#*=}" ;;
+    esac
 done
+
+# Fail fast if the bootstrap step did not run / left the directory empty.
+# Split into two checks so `ls -A` only runs against a path that exists; this
+# avoids needing an error-swallowing redirect.
+if [ ! -d "$ENGINE_ROOT" ]; then
+    echo "ERROR: engine source directory $ENGINE_ROOT does not exist."
+    echo "The LXD [vm-id] --vm-init flow must mirror the project here before running this script."
+    exit 1
+fi
+if [ -z "$(ls -A "$ENGINE_ROOT")" ]; then
+    echo "ERROR: engine source directory $ENGINE_ROOT is empty."
+    echo "The LXD [vm-id] --vm-init flow must mirror the project here before running this script."
+    exit 1
+fi
+
 # ---------------------------------------------------------------------------
-# NVM and Node.js
+# NVM and Node.js — required for `node bin ...` entrypoints
 # ---------------------------------------------------------------------------
-echo "Installing NVM and Node.js v24.10.0..."
+echo "Installing NVM and Node.js v24.15.0..."
 
 curl -o- https://cdn.jsdelivr.net/gh/nvm-sh/nvm@v0.40.1/install.sh | bash
 
 export NVM_DIR="$([ -z "${XDG_CONFIG_HOME-}" ] && printf %s "${HOME}/.nvm" || printf %s "${XDG_CONFIG_HOME}/nvm")"
+# shellcheck disable=SC1090
 [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
 
 nvm install 24.15.0
 nvm use 24.15.0
+nvm alias default 24.15.0
+ln -sf "$(command -v node)" /usr/local/bin/node
+ln -sf "$(command -v npm)" /usr/local/bin/npm
+ln -sf "$(command -v npx)" /usr/local/bin/npx
 
 echo "
 ██╗░░░██╗███╗░░██╗██████╗░███████╗██████╗░██████╗░░█████╗░░██████╗████████╗
@@ -50,59 +74,51 @@ echo "
 ╚██████╔╝██║░╚███║██████╔╝███████╗██║░░██║██║░░░░░╚█████╔╝██████╔╝░░░██║░░░
 ░╚═════╝░╚═╝░░╚══╝╚═════╝░╚══════╝╚═╝░░╚═╝╚═╝░░░░░░╚════╝░╚═════╝░░░░╚═╝░░░
 
-Installing underpost VM node...
+Bringing up underpost VM node from $ENGINE_ROOT (role=$ROLE)
 "
 
-npm install -g underpost
+cd "$ENGINE_ROOT"
 
-echo "Applying host configuration..."
-
-# Use the globally installed underpost CLI
-# NOTE: --dev is used to match the host dev context
-underpost cluster --dev --config
-
-# Check if /home/dd/engine exists locally for engine-specific operations.
-# This directory is populated by the host running --bootstrap-engine.
-# If absent, the global underpost CLI handles all operations.
-if [ -d /home/dd/engine ]; then
-  echo "Local engine source found at /home/dd/engine. Using local underpost."
-  cd /home/dd/engine
-  npm install
-  node bin run secret
-else
-  echo "No local engine source at /home/dd/engine. Using global underpost CLI."
-  echo "Engine source can be replicated later with --bootstrap-engine from the host."
-  # The globally installed underpost handles secret generation via its own config
-  underpost secret underpost --init
-fi
+# Install JS deps and generate secrets using the local engine entrypoint only.
+npm install
+node bin run secret
 
 if [ "$ROLE" = "control" ]; then
-  echo "Initializing K3s control plane..."
-  # Use global underpost CLI for K3s setup
-  underpost cluster --dev --k3s
-
-  echo ""
-  echo "K3s control plane is ready."
-  echo "Node token (share with workers to join this cluster):"
-  sudo cat /var/lib/rancher/k3s/server/node-token
-  echo ""
-  echo "Control plane IP addresses:"
-  ip -4 addr show scope global | grep inet | awk '{print $2}' | cut -d/ -f1
-
-elif [ "$ROLE" = "worker" ]; then
-  if [ -z "$CONTROL_IP" ] || [ -z "$K3S_TOKEN" ]; then
-    echo "ERROR: --control-ip and --token are required for worker role."
-    echo "Usage: bash k3s-node-setup.sh --worker --control-ip=<ip> --token=<token>"
-    exit 1
-  fi
-
-  echo "Joining K3s cluster at https://${CONTROL_IP}:6443..."
-  curl -sfL https://get.k3s.io | \
+    echo "Installing underpost CLI..."
+    npm install -g underpost
+    underpost --version
+    echo "Initializing K3s control plane via local engine..."
+    node bin cluster --dev --k3s
+    ln -s /usr/local/bin/k3s /bin/k3s
+    ln -s /usr/local/bin/kubectl /bin/kubectl
+    
+    echo ""
+    echo "K3s control plane is ready."
+    echo "Node token (share with workers to join this cluster):"
+    sudo cat /var/lib/rancher/k3s/server/node-token
+    echo ""
+    echo "Control plane IP addresses:"
+    ip -4 addr show scope global | grep inet | awk '{print $2}' | cut -d/ -f1
+    
+    elif [ "$ROLE" = "worker" ]; then
+    if [ -z "$CONTROL_IP" ] || [ -z "$K3S_TOKEN" ]; then
+        echo "ERROR: --control-ip and --token are required for worker role."
+        echo "Usage: bash k3s-node-setup.sh --worker --control-ip=<ip> --token=<token>"
+        exit 1
+    fi
+    
+    # Worker nodes still need the minimal K3s host prep even though they join via
+    # the upstream installer rather than `node bin cluster --k3s`.
+    echo "Applying minimal K3s host configuration via local engine..."
+    node bin cluster --dev --config --k3s
+    
+    echo "Joining K3s cluster at https://${CONTROL_IP}:6443..."
+    curl -sfL https://get.k3s.io | \
     K3S_URL="https://${CONTROL_IP}:6443" \
     K3S_TOKEN="${K3S_TOKEN}" \
     sh -s - agent
-
-  echo ""
-  echo "K3s worker node joined the cluster at https://${CONTROL_IP}:6443 successfully."
-  sudo systemctl status k3s-agent --no-pager
-fi
+    
+    echo ""
+    echo "K3s worker joined https://${CONTROL_IP}:6443 successfully."
+    sudo systemctl status k3s-agent --no-pager
+fi

package/scripts/lxd-vm-setup.sh

@@ -1,23 +1,208 @@
+#!/bin/bash
+set -euo pipefail
 
-echo "Expanding /dev/sda2 and resizing filesystem..."
+# ---------------------------------------------------------------------------
+# LXD VM OS base setup. Runs inside the VM via `lxc exec`. Idempotent.
+# ---------------------------------------------------------------------------
 
-if ! command -v parted &>/dev/null; then
-  sudo dnf install -y parted
+# lxdbr0 is a plain L2 bridge: LXD runs no DHCP/DNS on it (MAAS owns
+# provisioning), so VMs configure their NIC statically and deterministically.
+# The host pins the gateway (10.250.250.1) on the bridge and provides NAT; no
+# resolver listens there, so DNS must use public/MAAS resolvers, not the gateway.
+# LXD_NET_MODE=dhcp opts back into DHCP-first for VMs on a MAAS-served segment.
+LXD_NET_MODE="${LXD_NET_MODE:-static}"
+LXD_FALLBACK_IPV4_CIDR="${LXD_FALLBACK_IPV4_CIDR:-10.250.250.100/24}"
+LXD_FALLBACK_GATEWAY="${LXD_FALLBACK_GATEWAY:-10.250.250.1}"
+LXD_FALLBACK_DNS="${LXD_FALLBACK_DNS:-1.1.1.1 8.8.8.8}"
+ROCKY_MIRROR_HOST="${ROCKY_MIRROR_HOST:-mirrors.rockylinux.org}"
+
+current_ipv4() {
+    ip -4 addr show "$IFACE" | awk '/inet /{print $2; exit}'
+}
+
+wait_for_ipv4() {
+    local current_ip=""
+    
+    for _ in $(seq 1 10); do
+        current_ip="$(current_ipv4)"
+        if [ -n "$current_ip" ]; then
+            echo "$current_ip"
+            return 0
+        fi
+        sleep 1
+    done
+    
+    return 1
+}
+
+refresh_resolver_state() {
+    if command -v resolvectl >/dev/null 2>&1; then
+        sudo resolvectl flush-caches || true
+    fi
+    
+    if [ -f /run/NetworkManager/resolv.conf ]; then
+        sudo ln -sf /run/NetworkManager/resolv.conf /etc/resolv.conf || true
+    fi
+}
+
+verify_name_resolution() {
+    getent ahostsv4 "$ROCKY_MIRROR_HOST" >/dev/null 2>&1
+}
+
+retry_dnf() {
+    local attempt=1
+    local max_attempts=3
+    
+    until "$@"; do
+        if [ "$attempt" -ge "$max_attempts" ]; then
+            return 1
+        fi
+        
+        echo "DNF command failed (attempt $attempt/$max_attempts): $*"
+        echo "Refreshing resolver state before retry..."
+        refresh_resolver_state
+        verify_name_resolution || true
+        attempt=$((attempt + 1))
+    done
+}
+
+# k3s derives the node name from the system hostname. The Rocky image keeps
+# "localhost.localdomain" for every VM, so without this every node would try to
+# register under the same name — the second one is rejected ("Node password
+# rejected, duplicate hostname"). Pin the hostname to the LXD instance name so
+# node names are unique and deterministic (control plane labeling relies on it).
+if [ -n "${LXD_NODE_NAME:-}" ] && [ "$(hostname)" != "$LXD_NODE_NAME" ]; then
+    echo "--- Hostname ---"
+    echo "Setting hostname to ${LXD_NODE_NAME} (k3s node name)..."
+    sudo hostnamectl set-hostname "$LXD_NODE_NAME" 2>/dev/null || sudo hostname "$LXD_NODE_NAME"
+fi
+
+echo "--- Network Configuration ---"
+
+# 1. Detect primary non-loopback interface
+IFACE=$(ip -o link show up | awk -F': ' '$2!="lo"{print $2; exit}')
+echo "Using network interface: ${IFACE:-none}"
+
+if [ -z "$IFACE" ]; then
+    echo "CRITICAL ERROR: No network interface detected."
+    exit 1
+fi
+
+# 2. Force NetworkManager initialization if interface lacks an IP address
+CURRENT_IP="$(current_ipv4 || true)"
+
+if command -v nmcli >/dev/null 2>&1 && [ -z "$CURRENT_IP" ]; then
+    echo "Inspecting NetworkManager profiles..."
+    
+    # Check if a profile is tracking this device
+    NM_CON=$(nmcli -t -f NAME,DEVICE connection show | awk -F: -v iface="$IFACE" '$2==iface{print $1; exit}')
+    
+    if [ -z "$NM_CON" ]; then
+        echo "No connection profile matches $IFACE. Forcing generation of profile 'k3s-net'..."
+        nmcli connection add type ethernet con-name k3s-net ifname "$IFACE"
+        NM_CON="k3s-net"
+    fi
+
+    apply_static_ipv4() {
+        echo "Applying static LXD bridge address ${LXD_FALLBACK_IPV4_CIDR} (gw ${LXD_FALLBACK_GATEWAY}, dns ${LXD_FALLBACK_DNS})..."
+        nmcli connection modify "$NM_CON" \
+        connection.autoconnect yes \
+        connection.interface-name "$IFACE" \
+        ipv4.method manual \
+        ipv4.addresses "$LXD_FALLBACK_IPV4_CIDR" \
+        ipv4.gateway "$LXD_FALLBACK_GATEWAY" \
+        ipv4.dns "$LXD_FALLBACK_DNS" \
+        ipv4.ignore-auto-dns yes \
+        ipv6.method ignore
+        nmcli connection up "$NM_CON"
+        CURRENT_IP="$(wait_for_ipv4 || true)"
+    }
+
+    # Static-first: lxdbr0 has no DHCP, so a DHCP attempt only adds a ~45s
+    # activation timeout per boot. DHCP is opt-in for VMs on a MAAS-served
+    # segment (LXD_NET_MODE=dhcp), with a static fallback if no lease appears.
+    if [ "$LXD_NET_MODE" = "dhcp" ]; then
+        echo "Configuring DHCP-first NetworkManager profile '$NM_CON'..."
+        nmcli connection modify "$NM_CON" \
+        connection.autoconnect yes \
+        connection.interface-name "$IFACE" \
+        ipv4.method auto \
+        ipv4.dhcp-client-id mac \
+        ipv4.ignore-auto-dns no \
+        ipv6.method ignore
+        echo "Bringing network interface up with DHCP..."
+        nmcli connection up "$NM_CON" || echo "DHCP activation failed; static fallback will be applied."
+        CURRENT_IP="$(wait_for_ipv4 || true)"
+        if [ -z "$CURRENT_IP" ]; then
+            echo "No DHCP lease on $IFACE."
+            apply_static_ipv4
+        fi
+    else
+        echo "Configuring static NetworkManager profile '$NM_CON' for the plain LXD bridge..."
+        apply_static_ipv4
+    fi
+fi
+
+# 3. Give the network interface a short window to settle and lease an IP address
+echo "Waiting for IP address allocation..."
+CURRENT_IP="${CURRENT_IP:-$(wait_for_ipv4 || true)}"
+if [ -n "$CURRENT_IP" ]; then
+    echo "Interface $IFACE successfully initialized with IP: $CURRENT_IP"
+fi
+
+# 4. Verify DNS and outbound connectivity before proceeding (Fail Closed)
+echo "Verifying internet and DNS connectivity..."
+refresh_resolver_state
+if ! verify_name_resolution; then
+    echo "CRITICAL ERROR: DNS lookup failed for $ROCKY_MIRROR_HOST. Diagnostic snapshot:"
+    echo "=== /etc/resolv.conf ==="
+    cat /etc/resolv.conf || true
+    echo "=== Interface State ==="
+    ip -4 addr show "$IFACE" || true
+    echo "=== Routing Table ==="
+    ip route show || true
+    echo "=== NetworkManager Status ==="
+    nmcli device status || true
+    exit 1
+fi
+
+if ! timeout 15 curl -fsSL --max-time 10 "https://${ROCKY_MIRROR_HOST}" -o /dev/null; then
+    echo "CRITICAL ERROR: Network/DNS remains unreachable. Diagnostic snapshot:"
+    echo "=== /etc/resolv.conf ==="
+    cat /etc/resolv.conf || true
+    echo "=== Interface State ==="
+    ip -4 addr show "$IFACE" || true
+    echo "=== Routing Table ==="
+    ip route show || true
+    echo "=== NetworkManager Status ==="
+    nmcli device status || true
+    exit 1
 fi
 
+echo "--- Disk Resizing ---"
+if ! command -v parted >/dev/null 2>&1; then
+    sudo dnf install -y parted
+fi
+
+set +e
 sudo parted /dev/sda ---pretend-input-tty <<EOF
 unit s
 resizepart 2 100%
 Yes
 quit
 EOF
+set -e
 
 sudo resize2fs /dev/sda2
-echo "Disk resized."
+echo "Disk partition and filesystem resized successfully."
 
-echo "Installing essential packages..."
-sudo dnf install -y tar bzip2 git curl jq epel-release
-sudo dnf -y update
+echo "--- Package Installation ---"
+retry_dnf sudo dnf install -y epel-release
+retry_dnf sudo dnf install -y tar bzip2 git curl jq
+retry_dnf sudo dnf -y update
 
-echo "Loading br_netfilter module..."
+echo "--- Kernel Modules for K3s ---"
 sudo modprobe br_netfilter
+echo "br_netfilter" | sudo tee /etc/modules-load.d/k3s-br_netfilter.conf > /dev/null
+
+echo "Setup complete. System is ready for k3s-node-setup.sh"

package/scripts/maas-nat-firewalld.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# MAAS NAT + firewall helper
+# - Enables IPv4 forwarding and masquerading for the MAAS/provisioning subnet
+# - Opens the MAAS API on the uplink zone when requested
+# - Opens provisioning and optional NFS services on the zone bound to MAAS_LAN_CIDR
+#
+# Usage examples:
+#   sudo MAAS_LAN_CIDR="192.168.1.0/24" PUBLIC_ZONE="public" ./maas-nat-firewalld.sh
+#   sudo NFS_MODE="v3" CONFIGURE_NFS_V3_PORTS="true" ./maas-nat-firewalld.sh
+
+MAAS_LAN_CIDR="${MAAS_LAN_CIDR:-192.168.1.0/24}"
+PUBLIC_ZONE="${PUBLIC_ZONE:-public}"
+TRUSTED_ZONE="${TRUSTED_ZONE:-trusted}"
+NFS_MODE="${NFS_MODE:-v4}"                    # v4 or v3
+CONFIGURE_NFS_V3_PORTS="${CONFIGURE_NFS_V3_PORTS:-false}"
+EXPOSE_MAAS_API_PUBLIC="${EXPOSE_MAAS_API_PUBLIC:-true}"
+
+# Fixed NFSv3 ports (only used when CONFIGURE_NFS_V3_PORTS=true)
+NFS_MOUNTD_PORT="${NFS_MOUNTD_PORT:-20048}"
+NFS_STATD_PORT="${NFS_STATD_PORT:-32765}"
+# Outgoing port must differ from the listen port; rpc.statd exits 255 if they match.
+NFS_STATD_OUTGOING_PORT="${NFS_STATD_OUTGOING_PORT:-32766}"
+NFS_LOCKD_PORT="${NFS_LOCKD_PORT:-32803}"
+NFS_LOCKD_UDP_PORT="${NFS_LOCKD_UDP_PORT:-${NFS_LOCKD_PORT}}"
+NFS_CONF_DROPIN="/etc/nfs.conf.d/99-maas-nfs-v3-ports.conf"
+
+case "${NFS_MODE}" in
+    v3|v4) ;;
+    *)
+        echo "[ERROR] NFS_MODE must be 'v3' or 'v4'." >&2
+        exit 1
+    ;;
+esac
+
+# Ensure the kernel NFS server is enabled and actually running. `exportfs -rav` only populates the
+# export table; it does not start nfsd, and `systemctl try-restart` is a no-op when the unit is
+# stopped. Without this, clients hang on mount because nothing listens on 2049/mountd.
+ensure_nfs_server_running() {
+    if [[ "${NFS_MODE}" == "v3" ]]; then
+        # NFSv3 depends on the portmapper and the status monitor.
+        sudo systemctl enable --now rpcbind 2>/dev/null || true
+        sudo systemctl enable --now rpc-statd 2>/dev/null || true
+    fi
+    
+    local unit=""
+    for candidate in nfs-server nfs-kernel-server; do
+        if systemctl cat "${candidate}.service" >/dev/null 2>&1; then
+            unit="${candidate}"
+            break
+        fi
+    done
+    if [[ -z "${unit}" ]]; then
+        echo "[ERROR] No NFS server unit found (nfs-server/nfs-kernel-server). Install nfs-utils or nfs-kernel-server." >&2
+        return 1
+    fi
+    
+    echo "[INFO] Enabling and (re)starting ${unit} to apply exports and fixed ports..."
+    sudo systemctl enable "${unit}" 2>/dev/null || true
+    sudo systemctl restart "${unit}"
+}
+
+echo "[INFO] Enabling firewalld..."
+sudo systemctl enable --now firewalld
+
+echo "[INFO] Enabling kernel forwarding..."
+sudo tee /etc/sysctl.d/99-maas-nat.conf >/dev/null <<'EOF'
+net.ipv4.ip_forward = 1
+EOF
+
+sudo sysctl --system >/dev/null
+
+echo "[INFO] Allowing NAT for the MAAS LAN..."
+sudo firewall-cmd --permanent --zone="${PUBLIC_ZONE}" --add-masquerade
+sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-source="${MAAS_LAN_CIDR}"
+
+echo "[INFO] Opening MAAS services on the MAAS LAN zone..."
+sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port=5240/tcp
+for service in dns dhcp tftp; do
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-service="${service}"
+done
+
+if [[ "${EXPOSE_MAAS_API_PUBLIC}" == "true" ]]; then
+    echo "[INFO] Opening MAAS API on the uplink zone..."
+    sudo firewall-cmd --permanent --zone="${PUBLIC_ZONE}" --add-port=5240/tcp
+fi
+
+echo "[INFO] Opening NFS ports on the MAAS LAN zone..."
+
+if [[ "${NFS_MODE}" == "v4" ]]; then
+    # NFSv4 normally needs only TCP 2049.
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port=2049/tcp
+else
+    # NFSv3 side-band daemons need fixed ports for deterministic firewall rules.
+    if [[ "${CONFIGURE_NFS_V3_PORTS}" != "true" ]]; then
+        echo "[ERROR] NFSv3 requires CONFIGURE_NFS_V3_PORTS=true for consistent firewalld rules." >&2
+        echo "[ERROR] Re-run with CONFIGURE_NFS_V3_PORTS=true or switch to NFS_MODE=v4." >&2
+        exit 1
+    fi
+    
+    echo "[INFO] Writing fixed NFSv3 port configuration..."
+    sudo install -d -m 0755 /etc/nfs.conf.d
+        sudo tee "${NFS_CONF_DROPIN}" >/dev/null <<EOF
+[nfsd]
+vers3=y
+
+[mountd]
+port=${NFS_MOUNTD_PORT}
+
+[statd]
+port=${NFS_STATD_PORT}
+outgoing-port=${NFS_STATD_OUTGOING_PORT}
+
+[lockd]
+port=${NFS_LOCKD_PORT}
+udp-port=${NFS_LOCKD_UDP_PORT}
+EOF
+    
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-service=rpc-bind
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port=2049/tcp
+    for proto in tcp udp; do
+        sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_MOUNTD_PORT}/${proto}"
+        sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_STATD_PORT}/${proto}"
+        # Outgoing port is the fixed source for SM_NOTIFY; peers need to reach it.
+        sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_STATD_OUTGOING_PORT}/${proto}"
+    done
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_LOCKD_PORT}/tcp"
+    sudo firewall-cmd --permanent --zone="${TRUSTED_ZONE}" --add-port="${NFS_LOCKD_UDP_PORT}/udp"
+fi
+
+ensure_nfs_server_running
+
+echo "[INFO] Reloading firewall..."
+sudo firewall-cmd --reload
+
+echo
+echo "[INFO] Firewall status:"
+sudo firewall-cmd --zone="${PUBLIC_ZONE}" --list-all
+echo
+echo "[INFO] MAAS LAN zone (${TRUSTED_ZONE}):"
+sudo firewall-cmd --zone="${TRUSTED_ZONE}" --list-all
+
+echo
+echo "[INFO] MAAS NAT + firewall configuration completed."