And labstore::misc will also need to configure a static rpcdmountd port (already done for labstore::secondary)

Change 353508 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Add initial class for ferm rules shared by all labstore hosts

https://gerrit.wikimedia.org/r/353508

Here's a breakdown of the current NFS port configuration for labstore and what needs to change:

rpc.mountd:
dumps: 32767
labstore1003: 38466
labstore1004: 38466
labstore1005: 38466
labstore2003: dynamic
labstore2004: dynamic
-> The port can be made static via RPCMOUNTDOPTS in /etc/default/nfs-kernel-server:

statd:
dumps: 32765
labstore1003: 55659
labstore1004: 55659
labstore1005: 55659
labstore2003: dynamic
labstore2004: dynamic
-> The port can be made static via STATDOPTS in /etc/default/nfs-common

lockd udp:
dumps: 32768
labstore1003: dynamic
labstore1004: dynamic
labstore1005: dynamic
labstore2003: dynamic
labstore2004: dynamic
-> The port can be made static via /etc/modprobe.d

lockd udp:
dumps: 32768
labstore1003: dynamic
labstore1004: dynamic
labstore1005: dynamic
labstore2003: dynamic
labstore2004: dynamic
-> The port can be made static via /etc/modprobe.d

lockd tcp:
dumps: 32769
labstore1003: dynamic
labstore1004: dynamic
labstore1005: dynamic
labstore2003: dynamic
labstore2004: dynamic
-> The port can be made static via /etc/modprobe.d

portmapper:
dumps: 111
labstore1003: 111
labstore1004: 111
labstore1005: 111
labstore2003: 111
labstore2004: 111

Change 354226 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Add ferm service for rpc.statd on labstore

https://gerrit.wikimedia.org/r/354226

Change 356347 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Add ferm service for rpc.mountd on labstore

https://gerrit.wikimedia.org/r/356347

Change 357562 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Configure fixed lock manager ports for labstore NFS servers

https://gerrit.wikimedia.org/r/357562

Change 382718 had a related patch set uploaded (by Rush; owner: cpettet):
[operations/puppet@production] labstore: set base::firewall comment with notice

https://gerrit.wikimedia.org/r/382718

Change 382718 merged by Rush:
[operations/puppet@production] labstore: set commented base::firewall

https://gerrit.wikimedia.org/r/382718

Change 357562 merged by Rush:
[operations/puppet@production] Configure fixed lock manager ports for labstore NFS servers

https://gerrit.wikimedia.org/r/357562

Change 354226 abandoned by Rush:
Add ferm service for rpc.statd on labstore

Reason:
added to 353508

https://gerrit.wikimedia.org/r/354226

Change 356347 abandoned by Rush:
Add ferm service for rpc.mountd on labstore

Reason:
added to 353508

https://gerrit.wikimedia.org/r/356347

cc'd from the patch

Totally should be a profile but all of this storage code needs refactoring and for now I don't want to separate this bit from the rest of the logic, which means role for now. I don't think profile/wmcs/nfs is where we want this to end up, etc.

I am updating this with changes from https://gerrit.wikimedia.org/r/#/c/354226/2/modules/role/manifests/labs/nfs/ferm.pp and https://gerrit.wikimedia.org/r/#/c/356347/1/modules/role/manifests/labs/nfs/ferm.pp
Not ready to apply, I still have a few mysteries. Why is rsync daemon listening on labstore1003? Is conntracking here going to kill us? But I think I'm ready to merge and let's try this out on labstore1003 once that first question is answered.

Change 391824 had a related patch set uploaded (by Rush; owner: cpettet):
[operations/puppet@production] labstore: rsync server on misc (dumps hosting)

https://gerrit.wikimedia.org/r/391824

Change 391824 merged by Rush:
[operations/puppet@production] labstore: rsync server on misc (dumps hosting)

https://gerrit.wikimedia.org/r/391824

Change 392063 had a related patch set uploaded (by Rush; owner: cpettet):
[operations/puppet@production] labstore: fix rsync rule for misc

https://gerrit.wikimedia.org/r/392063

Change 392430 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] role::labs::nfs::secondary: Add Ferm rules for DRBD

https://gerrit.wikimedia.org/r/392430

Change 353508 merged by Madhuvishy:
[operations/puppet@production] labstore: initial ferm rules shared by all labstore hosts

https://gerrit.wikimedia.org/r/353508

Noting that I merged https://gerrit.wikimedia.org/r/353508 and applied profile::wmcs::nfs::ferm to the new dumps distribution servers labstore1006&7, and the ferm rules seem to be working well.

Change 392063 abandoned by Rush:
labstore: fix rsync rule for misc

Reason:
this should be all obsolete with 1008/9 coming online

https://gerrit.wikimedia.org/r/392063

Change 392430 abandoned by Muehlenhoff:
role::labs::nfs::secondary: Add Ferm rules for DRBD

Reason:
Obsolete, a variant of this has been merged

https://gerrit.wikimedia.org/r/392430

Change 575296 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[operations/puppet@production] labstore: finish setting up the firewall on the old primary cluster

https://gerrit.wikimedia.org/r/575296

Change 575296 merged by Bstorm:
[operations/puppet@production] labstore: finish setting up the firewall on the old primary cluster

https://gerrit.wikimedia.org/r/575296

Awesome, thanks!