Enable Atlas NAS management and document bootstrap workflow

ansible/roles/profile_atlas/defaults/main.yml

@@ -1,5 +1,9 @@
 ---
 atlas_manage_storage: false
+atlas_manage_sharing: false
+# Destructive first-boot action; normally false once the pool exists.
+atlas_create_pool: false
+atlas_zpool_disks: []
 atlas_admin_username: CHANGEME_ATLAS_ADMIN
 atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"

ansible/roles/profile_atlas/tasks/main.yml

@@ -5,6 +5,9 @@
 - name: Import Atlas 45Drives tasks
   ansible.builtin.import_tasks: cockpit.yml
 
+- name: Import Atlas pool bootstrap tasks
+  ansible.builtin.import_tasks: pool.yml
+
 - name: Import Atlas storage tasks
   ansible.builtin.import_tasks: storage.yml
 

ansible/roles/profile_atlas/tasks/pool.yml

@@ -0,0 +1,56 @@
+---
+- name: Bootstrap Atlas ZFS pool
+  tags: [atlas, storage, pool]
+  when: atlas_create_pool | bool
+  block:
+    - name: Validate Atlas pool bootstrap inputs
+      ansible.builtin.assert:
+        that:
+          - atlas_zpool_disks | length == 4
+          - atlas_zpool_disks | unique | length == 4
+          - atlas_zpool_disks | select('match', '^/dev/disk/by-id/') | list | length == 4
+        fail_msg: >-
+          Set exactly four distinct persistent /dev/disk/by-id paths in
+          atlas_zpool_disks before creating the RAIDZ2 pool.
+
+    - name: Inspect declared Atlas pool disks
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop: "{{ atlas_zpool_disks }}"
+      loop_control:
+        label: "{{ item }}"
+      register: atlas_zpool_disk_stats
+
+    - name: Require every declared Atlas pool disk
+      ansible.builtin.assert:
+        that:
+          - item.stat.exists
+          - item.stat.isblk | default(false)
+        fail_msg: "Declared Atlas pool disk is unavailable or is not a block device: {{ item.item }}"
+      loop: "{{ atlas_zpool_disk_stats.results }}"
+      loop_control:
+        label: "{{ item.item }}"
+
+    - name: Check whether the Atlas ZFS pool already exists
+      ansible.builtin.command:
+        argv:
+          - zpool
+          - list
+          - -H
+          - -o
+          - name
+          - "{{ atlas_zfs_pool }}"
+      register: atlas_zpool_bootstrap_check
+      changed_when: false
+      failed_when: atlas_zpool_bootstrap_check.rc not in [0, 1]
+
+    - name: Create the Atlas RAIDZ2 pool when absent
+      community.general.zpool:
+        name: "{{ atlas_zfs_pool }}"
+        state: present
+        mountpoint: "{{ atlas_mount_root }}"
+        force: false
+        vdevs:
+          - type: raidz2
+            disks: "{{ atlas_zpool_disks }}"
+      when: atlas_zpool_bootstrap_check.rc == 1

ansible/roles/profile_atlas/tasks/sharing.yml

@@ -8,7 +8,7 @@
     group: root
     mode: "0644"
   notify: Reload NFS exports
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Enable Atlas file-sharing services
   tags: [atlas, sharing, services]
@@ -21,7 +21,7 @@
     - smb.service
   loop_control:
     label: "{{ item }}"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Configure Atlas NFSv4-only service
   tags: [atlas, sharing]
@@ -32,7 +32,7 @@
     group: root
     mode: "0644"
   notify: Restart NFS server
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Mask Atlas NFSv3 RPC services
   tags: [atlas, sharing, services]
@@ -47,7 +47,7 @@
     - rpcbind.socket
   loop_control:
     label: "{{ item }}"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Ensure Atlas NFS mount daemon drop-in directory exists
   tags: [atlas, sharing, services]
@@ -57,7 +57,7 @@
     owner: root
     group: root
     mode: "0755"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Disable Atlas NFSv3 mount daemon listeners
   tags: [atlas, sharing, services]
@@ -68,7 +68,7 @@
     group: root
     mode: "0644"
   notify: Restart NFS mount daemon
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Enable SELinux access for Atlas file sharing
   tags: [atlas, sharing, services]
@@ -80,7 +80,7 @@
   loop_control:
     label: "{{ item }}"
   when:
-    - atlas_manage_storage | bool
+    - atlas_manage_sharing | bool
     - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
 
 - name: Render Atlas Samba configuration
@@ -93,7 +93,7 @@
     mode: "0644"
     validate: "testparm --suppress-prompt %s"
   notify: Restart Samba service
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Require Vault-backed Atlas Samba accounts
   tags: [atlas, sharing]
@@ -109,7 +109,7 @@
       - atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
     fail_msg: Define every authorized Samba account and its Vault-backed password.
   no_log: true
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Ensure Atlas Samba private state directory exists
   tags: [atlas, sharing]
@@ -119,7 +119,7 @@
     owner: root
     group: root
     mode: "0700"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Manage Vault-backed Atlas Samba credentials
   tags: [atlas, sharing]
@@ -129,7 +129,7 @@
     loop_var: atlas_samba_account
     label: "{{ atlas_samba_account.username }}"
   no_log: true
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool
 
 - name: Require completed Atlas firewall placeholders
   tags: [atlas, sharing, services]