Provided by: nbd-server_3.24-1_amd64 bug

NAME

       /etc/nbd-server/config - configuration file for nbd-server

SYNOPSIS

       /etc/nbd-server/config

DESCRIPTION

       This file allows to configure the nbd-server.

       While  /etc/nbd-server/config  is  the default configuration file, this can be varied with
       the -C option to nbd-server(1).

       The configuration file consists of section header lines, comment lines, and option lines.

       A section header is a unique name that is enclosed in square brackets  ("["  and  "]").  A
       section  header  denotes  the  beginning  of a section; a section continues until the next
       section or the end of the file, whichever is first. The first section in the configuration
       file  must  be  called generic, and is used for global options that apply to more than one
       export. This section must always be present, even if it  holds  no  options.  Every  other
       section defines one export; the names of these sections are not important, except that you
       should take care to make sure that each section name is unique. The section name  is  used
       as  the  name for the export in case the client connects with a name rather than a port to
       specify an export, and must therefore be unique.

       A comment line is a line that starts with optional whitespace, followed by  a  pound  sign
       ("#"),  and  continues until the end of the line. Comments may not be used on option lines
       or section header lines.

       An option line is a line that starts with an option  name,  followed  by  an  equals  sign
       ("="),  followed by the option value. An option can be of type string, of type integer, or
       of type boolean. The value of a boolean option can be denoted with either  true  or  false
       (so  not  yes,  no,  on,  off,  1,  or  0). All booleans default to false unless specified
       otherwise. No value may be quoted; always enter it directly. For a string option,  leading
       whitespace is stripped (but trailing whitespace is not).

OPTIONS FOR SECTION [GENERIC]

       allowlist
              Optional; boolean

              Whether  to  allow  the  client  to  fetch  a  list of exports from this server. If
              enabled, the client can run nbd-client -l to get a list of exports on this server.

       cacertfile
              Optional; string

              If this option is set,  it  should  contain  a  path  to  a  PEM  format  X.509  CA
              certificate used for validating client certificates supplied by the client. If this
              option is not set then client certificates will not be checked.

       certfile
              Optional; string

              If this option is set, it should contain a  path  to  a  PEM  format  X.509  public
              certificate  used  for  TLS  negotiation  with  the  client.  If keyfile is set but
              certfile is not set, then the server will attempt to read the certificate from  the
              path specified by keyfile.

       force_tls
              Optional; boolean.

              Switch the server to FORCEDTLS mode.

              Note:  this  is  not  the  same as enabling the force_tls option for each and every
              export individually.  The latter will allow certain options  to  be  issued  during
              negotiation  (e.g.,  the  "list exports" option, even if that would return an empty
              result set), whereas enabling this option will disallow the use of any option to be
              issued  during  negotiation,  apart  from the STARTTLS option itself (to switch the
              transport to TLS).

              Using FORCEDTLS mode should result in a safer environment, as the server  will  not
              allow  any  communication  to  take place unless and until TLS has been negotiated.
              However, it also makes it impossible to  set  up  a  nonencrypted  export  for  the
              benefit of older clients, or for clients that want to swap and not deadlock.

              Using  this  parameter  without  also  specifying a value for the other TLS-related
              parameters is possible, but silly.

       group  Optional; string.

              The name of the group this server must run as. If this parameter is not  specified,
              then  nbd-server  will not attempt to change its GID (so the GID it runs as will be
              the primary group of the user who starts nbd-server). If it is specified, then nbd-
              server will change its GID after opening ports, but before accepting connections or
              opening files.

       includedir
              Optional; string

              The argument should be a directory containing files  with  the  '.conf'  extension;
              these  files  will  be  parsed as if they were part of the configuration file. Note
              that these extra configuration  files  cannot  contain  a  [generic]  section;  any
              configuration  that  should  go  in  the generic section must be placed in the main
              configuration file.

              If this argument is not specified, then no directory will be  searched.  If  it  is
              specified  but  the  directory  does  not  exist, then nbd-server will exit with an
              appropriate error message; if it is specified but the  given  directory  is  empty,
              nbd-server  will  continue  (unless  no exports whatsoever have been configured, in
              which case it will exit with an appropriate error message)

       keyfile
              Optional; string

              If this option is set, it should contain a path to a PEM format X.509  private  key
              used for TLS negotiation with the client. This option must be set to enable TLS.

       listenaddr
              Optional; string

              If  this  option  is  set,  it should contain a comma-separated lis of the local IP
              addresses on which we should listen to nbd-client(8) connections. If it is not set,
              nbd-server  will  listen to "::, 0.0.0.0", which causes nbd-server to listen to all
              local IPv4 and IPv6 addresses. To limit to IPv6, specify the address  as  "::".  To
              limit to IPv4, specify as "0.0.0.0".

       max_threads
              Optional; integer; default 4

              Since NBD 3.12, nbd-server will read requests in a main thread, but do the handling
              of these requests, and the sending of the reply, in a  number  of  separate  worker
              threads, which are shared among all exports. With this parameter, you can configure
              the number of these worker threads.

              The default should be reasonable for a dual-core single-disk server. You might want
              to  increase  it  if  you have a powerful server that does little else than serving
              NBD.

       oldstyle
              Optional; boolean

              In versions of nbd-server between 2.9.17 and 3.9.1, when this  option  was  set  to
              true,  nbd-server  would  export  all  exports  on  a  separate  port  with the old
              (pre-2.9.17) handshake protocol. In that case, the  'port'  option  for  individual
              exports was mandatory.

              Since  version 3.10 of nbd-server, however, this option is no longer supported, and
              any attempt to use it will result in nbd-server exiting with an  appropriate  error
              message.

       port   Optional; string

              The port on which to listen for new-style nbd-client connections. If not specified,
              the IANA-assigned port of 10809 is used.

       splice Optional; boolean

              Allow the server to use the splice() system call to handle read or write calls when
              possible.  Using  splice  can  speed  up  handling  of  such  calls  significantly.
              Unfortunately, splice cannot be used in combination with  TLS  or  the  copyonwrite
              mode, and will only work for requests smaller than 1MiB.

              To  handle these situations, the server will exit with an appropriate error message
              if splice and copyonwrite are both enabled for an export; it will  silently  ignore
              the  splice  option if TLS is enabled, falling back on normal reads and writes; and
              it will similarly fall back on normal reads when the request size exceeds 1MiB.

       user   Optional; string.

              The name of the user this server must run as. If this parameter is  not  specified,
              then  nbd-server  will not attempt to change its UID (so the UID it runs as will be
              the user who starts nbd-server). If it is specified, then  nbd-server  will  change
              its UID after opening ports, but before accepting connections or opening files.

       unixsock
              Optional; string

              Path for a UNIX domain socket.

              If  specified,  the  server  will listen on a UNIX domain socket with the specified
              name. Only newstyle negotiation is supported on UNIX  domain  sockets.  If  a  UNIX
              domain socket is, then the server will not listen for TCP connections.

       duallisten
              Optional; boolean

              If  true,  and  unixsock  is  specified,  the  the  server  will listen on both the
              configured UNIX domain socket and any configured TCP or SDP  socket.   Defaults  to
              false.

       tlsprio
              Optional; string; default NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2:%SERVER_PRECEDENCE

              This option allows to configure the GnuTLS priority string, which is used to select
              the algorithms which GnuTLS will allow to be negotiated with the  client.  The  NBD
              STARTTLS  specification  requires that clients and servers require TLS1.2 or higher
              by default, so the default string disables all older versions of the TLS protocol.

              Not all versions of GnuTLS support the %SERVER_PRECEDENCE  flag,  which  exists  to
              signal  that  the  server  should  pay  no  attention  to the algorithm preferences
              selected by the client. If you're using an older version of GnuTLS (e.g., 2.12), it
              may  be  necessary  to  specify  a  priority  string  that  does  not  include  the
              %SERVER_PRECEDENCE flag.

              For an explanation of the  possible  values  of  this  option,  see  the  "Priority
              strings" chapter in the GnuTLS documentation.

OPTIONS FOR EXPORT SECTIONS

       authfile
              Optional; string; default empty

              The  name  of  the authorization file for this export. This file should contain one
              line per IP-address,  or  per  network  (which  must  be  specified  in  CIDR-style
              network/masklen).   Empty  lines  are  skipped, as is any content behind a hashmark
              ('#') on any line.

              If the file does not exist, everyone is allowed to connect.  If the file exists but
              is  empty,  nobody  is  allowed  to  connect. Otherwise, nbd-server will only allow
              clients to connect whose IP-adres is listed in this file.

              Corresponds to the -l option on the  command  line.  However,  note  that  for  the
              command line, the default is /etc/nbd-server/allow.

       copyonwrite
              Optional; boolean.

              Whether  this  is  a copy-on-write export. If it is, then any writes to this export
              will not be written to the master file, but  to  a  separate  file  which  will  be
              removed upon disconnect. The result of using this option is that nbd-server will be
              somewhat slower, and that any writes will be lost upon disconnect.

              Corresponds to the -c option on the command line

       cowdir Optional; string.

              Specifies where to write copy-on-write diff files. If this option is absent,  copy-
              on-write  files  will  be  written  in  the same directory as the base export file.
              Useful for exporting files in copy-on-write mode from a  directory  that  the  user
              running nbd-server has no write access to.

              If the copy-on-write mode is not active, this option has no effect.

       exportname
              Required; string.

              The name of the file (or block device) that will be exported. This must be a fully-
              qualified path and filename; relative paths are not allowed. If used in conjunction
              with the temporary, this specifies a template for the temporary file concerned, and
              thus can be used to control the directory it is created in. If the  file  does  not
              exist, but filesize is set, then the file will be created.

              Note that nbd-server will only try to find and open the exported file when a client
              actually connects; as a result, nbd-server must be able to open and read this  file
              after  changing  to  the user and group that have been specified by use of the user
              and group options; also, nbd-server will only detect errors  in  this  option  upon
              connection of a client.

              When specified on the command line, this should be the second argument.

              Note:  this  is not the "exportname" as defined in the protocol document, and which
              is the name that nbd-client needs to pass to select the correct export; the section
              name is used for that. The name of the file to be exported is called the exportname
              in the configuration file for historical reasons, and cannot easily be changed.

       filesize
              Optional; integer; default autodetected.

              Disable autodetection of file or block device size, and forcibly  specify  a  size.
              Sizes must be specified in bytes. If the multifile option is in effect, this option
              specifies the size of the entire export, not of individual files. If  the  file  is
              not present, a single file is created of this size.

              When specified on the command line, this should be the third argument.

       flush  Optional; boolean.

              When this option is enabled, nbd-server will inform the client that it supports and
              desires to be sent flush requests when the elevator layer receives them. Receipt of
              a  flush  request  will  cause  an  fdatasync()  (or, if the sync option is set, an
              fsync()) on the backend storage. This increases  reliability  in  the  case  of  an
              unclean  shutdown  at the expense of a degradation of performance. This option will
              have no effect unless supported by the client.

       force_tls
              Optional; boolean.

              Require the use of TLS for this export to be available.

              When this option has been enabled for an export, clients that do not negotiate  TLS
              will  not  see the export when they request a list of exports, and will not be able
              to connect to it.

              Enabling this option when TLS credentials have not been configured in the [generic]
              section is possible, but silly.

       fua    Optional; boolean.

              When this option is enabled, nbd-server will inform the client that it supports and
              desires to be sent fua  (force  unit  access)  commands  when  the  elevator  layer
              receives  them.  Receipt  of  a  force unit access command will cause the specified
              command to be synced to backend storage using sync_file_range()  if  supported,  or
              fdatasync()  otherwise.  This  increases  reliability  in  the  case  of an unclean
              shutdown at the expense of a degradation of performance. This option will  have  no
              effect unless supported by the client.

       listenaddr
              Optional; string

              Ignored, kept for compatibility with the obsolete 'oldstyle' global parameter.

       maxconnections
              Optional; integer

              If specified, then it limits the number of opened connections for this export.

       multifile
              Optional; boolean.

              If  this  option  is set to true, then nbd-server will search for files of the form
              exportname.integer, with exportname being the filename that  would  otherwise  have
              been  used  (after  name  transformation  for  virtualization,  if  any,  has  been
              performed) and integer an integer number, starting with 0 and ending when  no  more
              files can be found.

              The  size of the individual files will be autodetected, even if the filesize option
              has been specified.

              Corresponds to the -m option on the command line.

       treefiles
              Optional; boolean.

              If this option is set to true, then nbd-server will search for files  of  the  form
              exportname/TREEXXXX/.../FILEXXXX,  with  exportname  being  the filename that would
              otherwise have been used (after name transformation for virtualization, if any, has
              been  performed)  and  TREEXXXX and FILEXXXX being autogenerated directory and path
              names for individual block files.

              Files and directories are automatically created.  Files  will  be  deleted  if  the
              corresponding  block gets marked as unused.  The size of the individual block files
              is fixed to 4096 bytes.  There  will  be  at  most  1024  files/subdirectories  per
              folder.   An apropriate nesting level of subdirectories will be created to create a
              filesystem of filesize bytes in total forming a virtual block device.

              This feature is  useful  to  provide  a  virtual  block  device  on  an  underlying
              filesystem  that does not handle large files well, for example fuse/ftpfs, davfs or
              other network filesytems.

              This feature is mutually exclusive with the -m and will take precedence if both are
              given.   There  is no corresponding command line option, since command line control
              is considered deprecated. You can however specify a custom config file with the  -C
              option.  The filesize option must be specified when using this feature!

       postrun
              Optional; string

              If specified, then it is assumed to be a command that will be ran when a client has
              disconnected. This can be useful to clean up whatever prerun has  set  up,  to  log
              something, or similar.

              If  the  literal  string '%s' is present in the command, it will be replaced by the
              file name that has just been closed.

              In contrast to the prerun option, the exit state of postrun is ignored.

       prerun Optional; string

              If specified, then this command will be ran after a client  has  connected  to  the
              server  (and  has  been  accepted),  but  before  the server starts serving. If the
              command contains the literal string '%s', then this string will be replaced by  the
              filename of the file which nbd-server wants to export.

              This  is  useful to create export files on the fly, or to verify that a file can be
              used for export, to write something to a log file, or similar.

              If the command runs with a nonzero exit status, then  nbd-server  will  assume  the
              export will fail, and refuse to serve it.

       readonly
              Optional; boolean.

              Disallow  writes  to the device. If this option is specified, nbd-server will issue
              an error to any client that tries to write to the device.

              Use of this option in conjunction with copyonwrite is possible, but silly.

              Corresponds to the -r option on the command line.

       rotational
              Optional; boolean.

              When this option is enabled, nbd-server will inform the client that it would prefer
              it  to  send requests in elevator (i.e., optimized) order, perhaps because it has a
              backing store and no local elevator. By default, the client uses QUEUE_FLAG_NONROT,
              which  effectively  restricts  the  function  of  the  elevator to block merges. By
              specifying this flag on the server, the  client  will  not  use  QUEUE_FLAG_NONROT,
              meaning  the client elevator will perform normal elevator ordering of I/O requests.
              Note that even when the backing store is on rotating  media,  it  is  not  normally
              necessary  to  specify  this flag, as the server's elevator algorithm will be used.
              This flag is only required where the server will not be using an elevator algorithm
              or  where the elevator algorithm is effectively neutered (e.g. with the sync option
              set). This option will have no effect unless supported by the client.

       sdp    Optional; boolean.

              When this option is enabled, nbd-server will use the Socket Direct  Protocol  (SDP)
              to  serve  the  export,  rather  than just IP. This is faster, but requires special
              hardware (usually something like InfiniBand) and support in the kernel.

              Additionally, support for this option must be enabled at compile  time,  using  the
              --enable-sdp  option  to  the  configure  script.  If  this  option  is  found in a
              configuration file and nbd-server does not have support for  SDP,  then  nbd-server
              will exit with an error message.

       sparse_cow
              Optional; boolean.

              When  this  option  is  enabled,  nbd-server will use sparse files to implement the
              copy-on-write option; such files take up less space  then  they  appear  to,  which
              allows nbd-server to handle the file as if it was just as large as the block device
              it's for.

              If this option is disabled, nbd-server will map every newly written  block  to  the
              end of the copy-on-write file, which means that nbd-server will have to lseek(2) to
              the right position after every 4096-byte block.

              Using this option may be faster when much is being written during a connection.

       sync   Optional; boolean.

              When this option is enabled, nbd-server will call an fsync() after every  write  to
              the  backend  storage.  Calling fsync() increases reliability in case of an unclean
              shutdown of nbd-server; but, depending on the file system used  on  the  nbd-server
              side, may degrade performance. The use of this option isn't always necessary; e.g.,
              on ext3 filesystems, it is recommended that it is not enabled, since  it  seriously
              reduces   performance   on   ext3   filesystems  while  not  importantly  impacting
              reliability.

       temporary
              Optional; boolean.

              Create a temporary export with a name based on exportname (this can be used to  set
              the  directory).  A  unique filename is created, which is unlinked as soon as it is
              created, and therefore the export will not  persist  between  invocations  of  nbd-
              server.  Set  the  size  of  the  file  using  the  filesize option. This option is
              incompatible with the multifile option.

              When specified on the command line, this should be the third argument.

       timeout
              Optional; integer; default 0

              How many seconds a connection may be idle for this export.  When  a  connection  is
              idle  for a longer time, nbd-server will forcibly disconnect the connection. If you
              specify 0 (the default), then a connection may be idle forever.

              Corresponds to the -a option on the command line

       transactionlog
              Optional; string

              If specified, then  this  pathname  is  used  to  generate  a  transaction  log.  A
              transaction log is a binary file consisting of the requests sent to and the replies
              received by the server, but excluding any data (so, for a write command, it records
              the  offset  and  length  of  the  write but not the data written). It is therefore
              relatively safe to distribute to a third party. Note that the transaction log  does
              not  include  the  negotiation  sequence.  Transaction  logs  are mainly useful for
              debugging. The program  nbd-tester-client  distributed  with  the  source  to  this
              program  can  reply a transaction log against a server and perform a data integrity
              test. Note that the transaction log is written to for every client opened. If it is
              necessary  to maintain separate transaction logs for each client, the prerun script
              should rename the transaction log (which will just have been  opened  in  order  to
              avoid transaction logs overwriting eachother. This action should be race-free.

       trim   Optional; boolean

              When  this  option  is activated, the server announces it supports the NBD_CMD_TRIM
              command for the export. This command allows the server to discard the data from the
              disk, but does not require it to.

       virtstyle
              Optional; string; default "ipliteral"

              Defines the style of virtualization. Virtualization allows one to create one export
              that will serve a different file depending on the IP address  that  is  connecting.
              When virtualization is active, the exportname parameter needs to contain the string
              '%s'; this will then be replaced by the IP address of  the  client  connecting,  in
              accordance with the option selected here. The result of this transformation is then
              used as the filename to be opened.

              When a client connects over a UNIX domain socket, the literal string "unix" is used
              in lieu of a client IP address.

              There are four types of virtualization that nbd-server supports:

              none   No virtualization. Will attempt to open the filename as it was written, even
                     if it contains '%s' in the name.

              ipliteral
                     The %s is replaced by the IP address of the connecting host is  used  as-is.
                     For  IPv4,  this  is  done in dotted-quad notation; for IPv6, in hexadecimal
                     form with leading zeros omitted.

                     As an example, if a client connects from  192.168.1.100  and  exportname  is
                     specified   as   /export/%s,   then   nbd-server   will   attempt  to  serve
                     /export/192.168.1.100.   For   IPv6,   with   a   client   connecting   from
                     2001:6f8:32f::39, the filename would be /export/2001:6f8:32f:0:0:0:0:39

              iphash Same  as  above,  except  that  nbd-server  will  replace the dots in the IP
                     address by forward slashes ('/'); in the same example, nbd-server would open
                     /export/192/168/1/100 instead.

                     Since  there  are  no  dots in most IPv6 addresses, the effect of using this
                     option when IPv6 is in use is indistinguishable from the  ipliteral  option.
                     It was thought that having to create an eight-deep directory structure would
                     not be as useful.

              cidrhash
                     This option requires one to add a space and a number  after  it.  nbd-server
                     will  use the number as a network mask in CIDR style, and use that as a hash
                     cutoff point. In the above example,  if  virtstyle  has  been  specified  as
                     cidrhash      16,      then      nbd-server     will     try     to     open
                     /export/192.168.0.0/192.168.1.100; if virtstyle were specified  as  cidrhash
                     26, then nbd-server will try to open /export/192.168.1.64/192.168.1.100.

                     For  IPv6,  in  the  above  example, with cidrhash 42, the filename would be
                     /export/2001:32f:6c0:0:0:0:0:0/2001:32f:6f8:0:0:0:0:39.

       tlsonly
              Optional; boolean.

              When this option is enabled, nbd-server will only serve the export  using  the  TLS
              extension.  If  this option is not supplied, TLS is optional, unless tlsonly is set
              in the generic section. In order for TLS to work at all, the keyfile option must be
              specified in the generic section.

       waitfile
              Optional; string.

              When  this  option  is  set,  nbd-server  will allow writes to this export, but not
              reads, until the server is sent a SIGUSR1 command. Any writes to the export will be
              stored  in  a diff file with the same algorithm as for the copy-on-write option. In
              particular, this means that the cowdir option is in effect for this option, too.

              The backend file (as per the exportname parameter) need not exist until the SIGUSR1
              signal is sent to the server.

              Once  SIGUSR1  is  received,  nbd-server  will open the main export file, and start
              merging all outstanding writes into it. Once this operation finishes, the diff file
              will be removed, and the server will allow normal use of the export.

              This allows the out-of-band live migration of an export from one server to another.

              Note that this option cannot be combined with the copy-on-write option itself.

SEE ALSO

       nbd-server (1), nbd-client (8), nbd-trdump (8)

AUTHOR

       The  NBD  kernel  module  and  the  NBD  tools  were  originally  written  by Pavel Machek
       (pavel@ucw.cz)

       The Linux kernel module is now maintained by Paul  Clements  (Paul.Clements@steeleye.com),
       while the userland tools are maintained by Wouter Verhelst (<wouter@debian.org>)

       On  The  Hurd  there  is  a regular translator available to perform the client side of the
       protocol, and the use of nbd-client is not required. Please see the relevant documentation
       for more information.

       This  manual  page  was  written  by  Wouter Verhelst (<wouter@debian.org>) for the Debian
       GNU/Linux system (but may be used by others).  Permission is granted to  copy,  distribute
       and/or  modify this document under the terms of the GNU General Public License, version 2,
       as published by the Free Software Foundation.

EXAMPLES

       A simple nbd-server configuration file would look like this:

             [generic]
             [export]
                 exportname = /export/blkdev

       For increased security, one might want to create an authorization file, and  set  the  UID
       and GID to run as:

             [generic]
                 user = nbd
                 group = nbd
             [export]
                 exportname = /export/blkdev
                 authfile = /etc/nbd-server/allow

       With /etc/nbd-server/allow containing the following:

             127.0.0.1
             192.168.0.0/8
             192.168.1.1

                         : 2006-10-18 15:01:57 +0200 (wo, 18 okt 2006) $            NBD-SERVER(5)