Enable Atlas NAS management and document bootstrap workflow

2026-09-27 11:02:47 +00:00 · 2026-09-12 18:53:21 +02:00
parent 8c35ef63c9
commit db10d1296e
9 changed files with 138 additions and 78 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -56,7 +56,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
  - Atlas media stack:
    `ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff`
  - Atlas phase-one rootless services:
-    `ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff -e backend_phase1_enabled=true`
+    `ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff`
  - Prometheus/Atlas WireGuard overlay:
    `ansible-playbook ansible/site.yml --limit prometheus,atlas --tags wireguard --check --diff`
  - DuckDNS config only: `ansible-playbook ansible/site.yml --limit prometheus --tags duckdns --check --diff`
@@ -126,15 +126,16 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - `atlas` is a remote Rocky Linux 9 NAS. Keep its connection, LAN, pool and mountpoint values in
  `host_vars/atlas.yml`. Bootstrap it once with `-e atlas_connection_username=<existing-admin>`;
  subsequent runs use the dedicated Atlas account.
- The pool is pre-existing: never add pool creation, disk partitioning, RAIDZ creation, rollback,
-  or destruction to the Atlas profile.
- `atlas_manage_storage`, `atlas_manage_firewall`, and `atlas_manage_media_stack` remain false until their placeholders
-  and Vault inputs are replaced; only then may the profile manage datasets, shares, LAN-restricted firewall rules, and
-  rootful media Quadlets.
+- The pool is normally pre-existing. A one-time bootstrap may create it only when `atlas_create_pool=true`
+  is explicitly supplied and `atlas_zpool_disks` contains exactly four real `/dev/disk/by-id/...` paths.
+  Never partition, force, destroy, roll back, or modify the vdev layout of an existing pool.
+- `atlas_manage_storage`, `atlas_manage_sharing`, and `atlas_manage_firewall` are enabled in Atlas host vars as
+  the declared steady state; set one false only for a deliberate suspension. `atlas_manage_media_stack` remains false
+  until the future rootful Immich stack has its required Vault inputs and target validation.
 - Atlas requires `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` for Cockpit
-  and, when the relevant gates are enabled, `vault_atlas_samba_password` and
+  and, while sharing is enabled, `vault_atlas_samba_password`. The future rootful media stack also requires
  `vault_atlas_immich_db_password`. Never print these values.
- Atlas creates the complete declared hierarchy only under the verified pre-existing pool: `work`, `archive`,
+- Atlas creates the complete declared hierarchy only under the verified existing or explicitly bootstrapped pool: `work`, `archive`,
  `archive/app_data`, `archive/app_data/navidrome`, `archive/app_data/syncthing`, `media`, `media/music`,
  `media/photobook`, `backups`, `backups/services`, and `backup_prometheus`. `backups/services` has a `500G`
  refreservation. There is no separate legacy `zpool/syncthing` dataset.
@@ -157,14 +158,13 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
  use `10.0.0.2:4533` for Navidrome and `10.0.0.2:8384` for the Syncthing GUI. Native Syncthing transfer/discovery does
  not use the HTTP proxy.
 - `wireguard_overlay` manages the required `wg0` path between Prometheus and Atlas, persists private keys only on their
-  respective hosts, and exchanges only derived public keys. The first gated run must include both hosts. Prometheus
+  respective hosts, and exchanges only derived public keys. The initial run must include both hosts. Prometheus
  opens `51820/udp`; the Atlas backend role admits service ports only in the WireGuard firewalld zone.

 ## Atlas NAS TODO
- Replace every Atlas `CHANGEME` value, provide the required Vault variables and validate the first
-  remote bootstrap on the real Rocky Linux 9 host. Enable `atlas_manage_storage` first and
-  `atlas_manage_firewall` only after confirming the pool, mountpoints, LAN subnet and firewalld zone. Enable
-  `atlas_manage_media_stack` last, after validating `/dev/dri`, the container paths and the Immich database secret.
+- Provide the required Vault variables and validate the first remote bootstrap on the real Rocky Linux 9 host.
+  Before the first apply, confirm the pool, mountpoints, LAN subnet and firewalld zone. Keep
+  `atlas_manage_media_stack` disabled until `/dev/dri`, the container paths and the Immich database secret are validated.
 - Validate the complete baseline on the target: OpenZFS kmod loading, existing pool import, dataset
  mounts, SSH reconnect, Cockpit and all selected 45Drives plugins, NFSv4, SMB and Syncthing.
 - Finalize dataset properties and the shared UID/GID, group and POSIX ACL model; test the same files
--- a/README.it.md
+++ b/README.it.md
@@ -246,13 +246,14 @@ ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser -

 ## NAS

-`atlas` e un NAS Rocky Linux 9 raggiunto tramite SSH. Il pool ZFS esiste gia: il profilo gestisce
-solo i dataset figli e non deve mai creare, partizionare, distruggere, fare rollback o modificare il
-pool. I client Linux usano NFSv4, quelli Windows/WSL SMB; entrambi restano limitati alla LAN
+`atlas` e un NAS Rocky Linux 9 raggiunto tramite SSH. Normalmente il pool ZFS esiste gia e il profilo
+gestisce solo i dataset figli. Un bootstrap RAIDZ2 una tantum e disponibile solo con conferma esplicita
+(`atlas_create_pool=true`) e quattro percorsi reali e verificati `/dev/disk/by-id/...` in
+`atlas_zpool_disks`. Non partiziona, forza, distrugge, esegue rollback o modifica il layout vdev di un
+pool esistente. I client Linux usano NFSv4, quelli Windows/WSL SMB; entrambi restano limitati alla LAN
 configurata.

-Per il primo avvio sostituire i placeholder di host, pool, mount root, LAN e IP di Aegis e
-fornire `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
+Per il primo avvio fornire `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
 `vault_atlas_samba_password` e `vault_atlas_immich_db_password`. Eseguire il bootstrap tramite
 l'amministratore esistente:

@@ -262,13 +263,12 @@ ansible-playbook ansible/site.yml --limit atlas \
 ```

 `vault_atlas_admin_password_hash` deve essere un hash compatibile con `/etc/shadow`, non una
-password Cockpit in chiaro. Le esecuzioni successive usano `atlas_admin_username`. Abilitare
-`atlas_manage_storage` solo dopo aver verificato pool e mountpoint esistenti; abilitare
-`atlas_manage_firewall` solo dopo aver verificato subnet LAN e zona firewalld attiva. Abilitare
-`atlas_manage_media_stack` per ultimo, dopo aver verificato `/dev/dri`, i percorsi dei container e il
-segreto del database Immich.
+password Cockpit in chiaro. Le esecuzioni successive usano `atlas_admin_username`. Atlas dichiara
+abilitati storage, condivisioni e regole firewall LAN. Prima della prima applicazione verificare pool e
+mountpoint esistenti, subnet LAN e zona firewalld attiva. `atlas_manage_media_stack` resta disabilitato
+finche non saranno validati `/dev/dri`, i percorsi dei container e il segreto del database Immich.

-Con la gestione storage attiva, Atlas crea l'intera gerarchia sotto il pool `zpool` preesistente:
+Con la gestione storage attiva, Atlas crea l'intera gerarchia sotto il pool `zpool` esistente o creato esplicitamente:
 `work`, `archive`, `archive/app_data`, i dataset applicativi separati
 `archive/app_data/navidrome` e `archive/app_data/syncthing`, `media`, `media/music`,
 `media/photobook`, `backups`, `backups/services` e `backup_prometheus`. I dataset applicativi e
@@ -284,15 +284,15 @@ Redis, PostgreSQL e NPM condividono una rete Podman. Immich viene eseguito come
 ML ricevono `/dev/dri` e Photobook e montato in sola lettura su `/external/photobook`. NPM pubblica `80` e
 `443`, mentre l'amministrazione resta vincolata a `127.0.0.1:81` per l'accesso tramite tunnel SSH.

-La fase 1 e limitata ai Quadlet utente rootless di Navidrome e Syncthing su Atlas ed e protetta dal
-gate `backend_phase1_enabled`. Navidrome ufficiale `0.63.2` usa il database SQLite sotto `/data` e
+La fase 1 e limitata ai Quadlet utente rootless di Navidrome e Syncthing su Atlas. E abilitata nella
+configurazione host di Atlas e puo essere impostata a `false` solo per una sospensione intenzionale. Navidrome ufficiale `0.63.2` usa il database SQLite sotto `/data` e
 non supporta `ND_DATABASE_URL` ne un backend PostgreSQL esterno. Il servizio obsoleto `navidromedb`
 e quindi rimosso da Prometheus invece di essere replicato su Atlas. Il ruolo deriva i percorsi dal
-pool esistente `zpool`, montato in `/zpool`: musica in sola lettura da `/zpool/media/music`, stato
+pool `zpool`, montato in `/zpool`: musica in sola lettura da `/zpool/media/music`, stato
 applicativo Navidrome e `navidrome.db` in `/zpool/archive/app_data/navidrome` e dati Syncthing in
 `/zpool/archive/app_data/syncthing`. `profile_atlas` crea questi dataset quando
 `atlas_manage_storage` e attivo; il ruolo backend verifica i mountpoint esatti prima di avviare i
-container. Nessun ruolo crea il pool. Il ruolo separato `wireguard_overlay`
+container. Il ruolo backend non crea mai il pool. Il ruolo separato `wireguard_overlay`
 gestisce `wg0` tra Prometheus (`10.0.0.1`) e Atlas (`10.0.0.2`), genera una sola volta le chiavi
 private sui rispettivi host e scambia tramite Ansible soltanto quelle pubbliche. Solo Prometheus apre
 pubblicamente `51820/udp`. Le porte backend sono ammesse esclusivamente nella zona firewalld WireGuard.
@@ -308,20 +308,16 @@ Validare e generare i servizi Atlas con:

 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit atlas --tags storage \
-  -e atlas_manage_storage=true
+ansible-playbook ansible/site.yml --limit atlas --tags storage

 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit prometheus,atlas --tags wireguard \
-  -e wireguard_overlay_enabled=true
+ansible-playbook ansible/site.yml --limit prometheus,atlas --tags wireguard

 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff \
-  -e backend_phase1_enabled=true
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff

 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 \
-  -e backend_phase1_enabled=true
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1
 ```

 Per il cutover, arrestare il vecchio Navidrome prima di copiare la sua directory dati, verificare
@@ -538,7 +534,7 @@ ansible-lint ansible/roles/<role>
 yamllint ansible/path/to/file.yml
 podman-compose -f /opt/docker/server/docker-compose.yml config
 ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff
-ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff -e backend_phase1_enabled=true
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff
 ```

 ## Tag supportati dal playbook
--- a/README.md
+++ b/README.md
@@ -204,13 +204,13 @@ ansible-playbook ansible/site.yml --limit aegis --check --diff --ask-become-pass

 ## NAS

-`atlas` is a Rocky Linux 9 NAS reached through SSH. Its pool already exists: the profile only
-manages child datasets and must never create, partition, destroy, roll back, or otherwise alter the
-pool itself. Linux clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the
-configured LAN.
+`atlas` is a Rocky Linux 9 NAS reached through SSH. Normally its pool already exists and the profile
+only manages child datasets. A one-time RAIDZ2 bootstrap is available only with explicit confirmation
+(`atlas_create_pool=true`) and exactly four verified `/dev/disk/by-id/...` paths in `atlas_zpool_disks`.
+It never partitions, forces, destroys, rolls back, or changes the vdev layout of an existing pool. Linux
+clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the configured LAN.

-For the first run, replace the Atlas host, pool, mount-root, LAN, and Aegis-IP
-placeholders and provide `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
+For the first run, provide `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
 `vault_atlas_samba_password`, and `vault_atlas_immich_db_password`. Bootstrap the host through its
 existing administrator:

@@ -220,13 +220,13 @@ ansible-playbook ansible/site.yml --limit atlas \
 ```

 `vault_atlas_admin_password_hash` must be an `/etc/shadow`-compatible hash, not a clear-text
-Cockpit password. Subsequent runs use `atlas_admin_username`. Enable `atlas_manage_storage` only after
-checking the existing pool and mountpoints; enable `atlas_manage_firewall` only after checking the LAN
-subnet and active firewalld zone. Enable `atlas_manage_media_stack` last, after validating `/dev/dri`,
-the container paths and the Immich database secret.
+Cockpit password. Subsequent runs use `atlas_admin_username`. Atlas declares storage, sharing, and its
+LAN firewall rules enabled. Before the first apply, check the existing pool and mountpoints, LAN subnet,
+and active firewalld zone. `atlas_manage_media_stack` remains disabled until `/dev/dri`, the container
+paths, and the Immich database secret are validated.

-With storage management enabled, Atlas creates the complete dataset hierarchy below the pre-existing
-`zpool`: `work`, `archive`, `archive/app_data`, the separate `archive/app_data/navidrome` and
+With storage management enabled, Atlas creates the complete dataset hierarchy below the existing or
+explicitly bootstrapped `zpool`: `work`, `archive`, `archive/app_data`, the separate `archive/app_data/navidrome` and
 `archive/app_data/syncthing` application datasets, `media`, `media/music`, `media/photobook`,
 `backups`, `backups/services`, and `backup_prometheus`. Application/archive datasets use `zstd`,
 while media, Syncthing and service-backup datasets use `lz4`; `backups/services` also has a `500G`
@@ -240,16 +240,16 @@ and NPM Quadlets share one Podman network. Immich runs as `1100:1100`; Server an
 and Photobook is mounted read-only at `/external/photobook`. NPM publishes ports `80` and `443`; its
 administration interface remains restricted to `127.0.0.1:81` for SSH-tunnel access.

-Phase 1 is limited to rootless Navidrome and Syncthing user Quadlets on Atlas and is gated by
-`backend_phase1_enabled`. Official Navidrome `0.63.2` uses its SQLite database below `/data`; it does
+Phase 1 is limited to rootless Navidrome and Syncthing user Quadlets on Atlas. It is enabled in the
+Atlas host configuration and can be set to `false` only for a deliberate suspension. Official Navidrome `0.63.2` uses its SQLite database below `/data`; it does
 not support `ND_DATABASE_URL` or an external PostgreSQL backend. The obsolete `navidromedb` service
 was therefore removed from Prometheus instead of being reproduced on Atlas. The role derives all
-storage paths from the existing `zpool` mounted at `/zpool`: music is read-only at
+storage paths from the `zpool` mounted at `/zpool`: music is read-only at
 `/zpool/media/music`, Navidrome application state and `navidrome.db` are stored at
 `/zpool/archive/app_data/navidrome`, and Syncthing persists at
 `/zpool/archive/app_data/syncthing`. `profile_atlas` creates these datasets when
 `atlas_manage_storage` is enabled; the backend role verifies their exact mountpoints before starting
-containers. Neither role creates the pool. The separate `wireguard_overlay` role manages `wg0`
+containers. The backend role never creates the pool. The separate `wireguard_overlay` role manages `wg0`
 between Prometheus (`10.0.0.1`) and Atlas (`10.0.0.2`), generating private keys once
 on their respective hosts and exchanging only public keys through Ansible. Prometheus alone opens
 `51820/udp` publicly. Backend ports are admitted only in the WireGuard firewalld zone.
@@ -265,20 +265,16 @@ Validate and render the Atlas services with:

 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit atlas --tags storage \
-  -e atlas_manage_storage=true
+ansible-playbook ansible/site.yml --limit atlas --tags storage

 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit prometheus,atlas --tags wireguard \
-  -e wireguard_overlay_enabled=true
+ansible-playbook ansible/site.yml --limit prometheus,atlas --tags wireguard

 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff \
-  -e backend_phase1_enabled=true
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff

 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 \
-  -e backend_phase1_enabled=true
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1
 ```

 For the cutover, stop the old Navidrome writer before copying its data directory, verify ownership by
--- a/ansible/inventory/host_vars/atlas.yml
+++ b/ansible/inventory/host_vars/atlas.yml
@@ -1,5 +1,5 @@
 ---
-# Keep Atlas management gates disabled until the NAS and required Vault inputs are ready.
+# Atlas declares its intended steady state; set a feature flag false only for a deliberate suspension.
 hostname: atlas
 ansible_host: 192.168.178.55
 ansible_user: "{{ atlas_connection_username }}"
@@ -17,9 +17,13 @@ atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}

 atlas_lan_subnet: 192.168.178.0/24
 atlas_aegis_ip: 192.168.178.54
-atlas_manage_firewall: false
+atlas_manage_firewall: true
 atlas_firewalld_zone: public
 atlas_zfs_pool: zpool
+# Populate only for the first pool bootstrap with four real persistent disk paths.
+# Example: /dev/disk/by-id/ata-Seagate_IronWolf_...
+atlas_zpool_disks: []
+atlas_create_pool: false
 atlas_zfs_dataset_work: work
 atlas_zfs_dataset_archive: archive
 atlas_zfs_dataset_app_data: archive/app_data
@@ -32,10 +36,11 @@ atlas_zfs_dataset_photobook: media/photobook
 atlas_zfs_dataset_backups: backups
 atlas_zfs_dataset_service_backups: backups/services
 atlas_mount_root: /zpool
-atlas_manage_storage: false
+atlas_manage_storage: true
+atlas_manage_sharing: true
 atlas_manage_media_stack: false

-wireguard_overlay_enabled: false
+wireguard_overlay_enabled: true
 wireguard_address: 10.0.0.2/24
 wireguard_peers:
  - name: prometheus
@@ -45,7 +50,7 @@ wireguard_peers:
      - 10.0.0.0/24
    persistent_keepalive: 25

-backend_phase1_enabled: false
+backend_phase1_enabled: true
 backend_phase1_start_services: false
 backend_phase1_wireguard_address: 10.0.0.2

--- a/ansible/inventory/host_vars/prometheus.yml
+++ b/ansible/inventory/host_vars/prometheus.yml
@@ -8,7 +8,7 @@ ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 server_username: rocky
 server_duckdns_domain: fscotto

-wireguard_overlay_enabled: false
+wireguard_overlay_enabled: true
 wireguard_address: 10.0.0.1/24
 wireguard_listen_port: 51820
 wireguard_enable_ipv4_forwarding: true
--- a/ansible/roles/profile_atlas/defaults/main.yml
+++ b/ansible/roles/profile_atlas/defaults/main.yml
@@ -1,5 +1,9 @@
 ---
 atlas_manage_storage: false
+atlas_manage_sharing: false
+# Destructive first-boot action; normally false once the pool exists.
+atlas_create_pool: false
+atlas_zpool_disks: []
 atlas_admin_username: CHANGEME_ATLAS_ADMIN
 atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"
--- a/ansible/roles/profile_atlas/tasks/main.yml
+++ b/ansible/roles/profile_atlas/tasks/main.yml
@@ -5,6 +5,9 @@
 - name: Import Atlas 45Drives tasks
  ansible.builtin.import_tasks: cockpit.yml

+- name: Import Atlas pool bootstrap tasks
+  ansible.builtin.import_tasks: pool.yml
+
 - name: Import Atlas storage tasks
  ansible.builtin.import_tasks: storage.yml

--- a/ansible/roles/profile_atlas/tasks/pool.yml
+++ b/ansible/roles/profile_atlas/tasks/pool.yml
@@ -0,0 +1,56 @@
+---
+- name: Bootstrap Atlas ZFS pool
+  tags: [atlas, storage, pool]
+  when: atlas_create_pool | bool
+  block:
+    - name: Validate Atlas pool bootstrap inputs
+      ansible.builtin.assert:
+        that:
+          - atlas_zpool_disks | length == 4
+          - atlas_zpool_disks | unique | length == 4
+          - atlas_zpool_disks | select('match', '^/dev/disk/by-id/') | list | length == 4
+        fail_msg: >-
+          Set exactly four distinct persistent /dev/disk/by-id paths in
+          atlas_zpool_disks before creating the RAIDZ2 pool.
+
+    - name: Inspect declared Atlas pool disks
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop: "{{ atlas_zpool_disks }}"
+      loop_control:
+        label: "{{ item }}"
+      register: atlas_zpool_disk_stats
+
+    - name: Require every declared Atlas pool disk
+      ansible.builtin.assert:
+        that:
+          - item.stat.exists
+          - item.stat.isblk | default(false)
+        fail_msg: "Declared Atlas pool disk is unavailable or is not a block device: {{ item.item }}"
+      loop: "{{ atlas_zpool_disk_stats.results }}"
+      loop_control:
+        label: "{{ item.item }}"
+
+    - name: Check whether the Atlas ZFS pool already exists
+      ansible.builtin.command:
+        argv:
+          - zpool
+          - list
+          - -H
+          - -o
+          - name
+          - "{{ atlas_zfs_pool }}"
+      register: atlas_zpool_bootstrap_check
+      changed_when: false
+      failed_when: atlas_zpool_bootstrap_check.rc not in [0, 1]
+
+    - name: Create the Atlas RAIDZ2 pool when absent
+      community.general.zpool:
+        name: "{{ atlas_zfs_pool }}"
+        state: present
+        mountpoint: "{{ atlas_mount_root }}"
+        force: false
+        vdevs:
+          - type: raidz2
+            disks: "{{ atlas_zpool_disks }}"
+      when: atlas_zpool_bootstrap_check.rc == 1
--- a/ansible/roles/profile_atlas/tasks/sharing.yml
+++ b/ansible/roles/profile_atlas/tasks/sharing.yml
@@ -8,7 +8,7 @@
    group: root
    mode: "0644"
  notify: Reload NFS exports
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Enable Atlas file-sharing services
  tags: [atlas, sharing, services]
@@ -21,7 +21,7 @@
    - smb.service
  loop_control:
    label: "{{ item }}"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Configure Atlas NFSv4-only service
  tags: [atlas, sharing]
@@ -32,7 +32,7 @@
    group: root
    mode: "0644"
  notify: Restart NFS server
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Mask Atlas NFSv3 RPC services
  tags: [atlas, sharing, services]
@@ -47,7 +47,7 @@
    - rpcbind.socket
  loop_control:
    label: "{{ item }}"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Ensure Atlas NFS mount daemon drop-in directory exists
  tags: [atlas, sharing, services]
@@ -57,7 +57,7 @@
    owner: root
    group: root
    mode: "0755"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Disable Atlas NFSv3 mount daemon listeners
  tags: [atlas, sharing, services]
@@ -68,7 +68,7 @@
    group: root
    mode: "0644"
  notify: Restart NFS mount daemon
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Enable SELinux access for Atlas file sharing
  tags: [atlas, sharing, services]
@@ -80,7 +80,7 @@
  loop_control:
    label: "{{ item }}"
  when:
-    - atlas_manage_storage | bool
+    - atlas_manage_sharing | bool
    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'

 - name: Render Atlas Samba configuration
@@ -93,7 +93,7 @@
    mode: "0644"
    validate: "testparm --suppress-prompt %s"
  notify: Restart Samba service
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Require Vault-backed Atlas Samba accounts
  tags: [atlas, sharing]
@@ -109,7 +109,7 @@
      - atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
    fail_msg: Define every authorized Samba account and its Vault-backed password.
  no_log: true
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Ensure Atlas Samba private state directory exists
  tags: [atlas, sharing]
@@ -119,7 +119,7 @@
    owner: root
    group: root
    mode: "0700"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Manage Vault-backed Atlas Samba credentials
  tags: [atlas, sharing]
@@ -129,7 +129,7 @@
    loop_var: atlas_samba_account
    label: "{{ atlas_samba_account.username }}"
  no_log: true
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Require completed Atlas firewall placeholders
  tags: [atlas, sharing, services]