nfs_server: Move exports file under roles

playbooks/nas.yml

@@ -39,21 +39,3 @@
     - nfs_server
     - role: keytab
       keytab_principals: "nfs/{{ inventory_hostname }}@FOO.SH"
-
-  tasks:
-    - name: Copy exports file
-      ansible.builtin.copy:
-        dest: /etc/exports
-        content: |
-          /export/home   172.20.20.0/22(rw,root_squash,secure,sec=krb5p) \
-                         172.20.30.0/24(rw,root_squash,secure,sec=krb5p) \
-                         @nfsclients-rw(rw,root_squash,secure) \
-                         @nfsclients-ro(ro,root_squash,secure)
-          /export/roles  172.20.20.0/22(rw,root_squash,secure,sec=krb5p) \
-                         172.20.30.0/24(rw,root_squash,secure,sec=krb5p) \
-                         @nfsclients-rw(rw,root_squash,secure) \
-                         @nfsclients-ro(ro,root_squash,secure)
-        mode: "0644"
-        owner: root
-        group: "{{ ansible_wheel }}"
-      notify: Restart nfs-server

roles/nfs_server/files/exports

@@ -0,0 +1,6 @@
+/export/home   @nfsclients-rw(rw,root_squash,secure,xprtsec=mtls,sec=sys) \
+               @nfsclients-ro(ro,root_squash,secure,xprtsec=mtls,sec=sys) \
+               @nfsclients-krb(rw,root_squash,secure,xprtsec=mtls,sec=krb5p)
+/export/roles  @nfsclients-rw(rw,root_squash,secure,xprtsec=mtls,sec=sys) \
+               @nfsclients-ro(ro,root_squash,secure,xprtsec=mtls,sec=sys) \
+               @nfsclients-krb(rw,root_squash,secure,xprtsec=mtls,sec=krb5p)

roles/nfs_server/tasks/main.yml

@@ -15,6 +15,15 @@
     owner: root
     group: "{{ ansible_wheel }}"
 
+- name: Create exports
+  ansible.builtin.copy:
+    dest: /etc/exports
+    src: exports
+    mode: "0644"
+    owner: root
+    group: "{{ ansible_wheel }}"
+  notify: Restart nfs-server
+
 - name: Install home/role autocreate scripts
   ansible.builtin.copy:
     dest: "/usr/local/sbin/{{ item }}"