title: puppet module gets 'Permission denied' applying NFS-based home directories
body: <p>Some disclosure:
  I'm using a master/agent setup in which I own the agent but do not have permission to the master console.  The puppetmaster is git-backed, and I control the source for the module(s) in question.</p>
  
  <p>I have 2 relevant modules for my question.  One of them, which appears to work just fine, ensures autofs is installed and has 2 file resources for auto.master and a custom auto.home to mount home directories.</p>
  
  <pre><code>#auto.home
  #this file is used by auto.master to automount home directories
  #from the nfs cluster when a user logs in.
  * -fstype=nfs,rw,nosuid,soft &lt;IPaddress&gt;:/homedirs/&amp;
  </code></pre>
  
  <p>In the module to add home directories, I'm creating users and deploying their public ssh keys via a file resource.  This module "works" on systems when I comment out the Class dependency and I'm not mounting /home to NFS, and it *sometimes works when I'm deploying it as-is over NFS.</p>
  
  <pre><code>define local_user(
    $fullname,
    $username = $title,
    $userid,
    $gid = 9999,
    $homedir_mode = 0700
  ) {
  
    $white_gid = $gid
  
    user { $username:
      ensure  =&gt; present,
      comment =&gt; $fullname,
      gid     =&gt; $white_gid,
      uid     =&gt; $userid,
      home    =&gt; $homedir,
      require =&gt; Group[ "white" ],
    }
  
    exec { "chage -M 99999 ${username}":
      command     =&gt; "chage -M 99999 ${username}",
      path        =&gt; "/bin:/sbin:/usr/bin:/usr/sbin",
      # chage(1) only works on local users, not on LDAP users,
      # so make sure this is a local user before we try to
      # change their password expiration.
      onlyif      =&gt; "grep -q '^${username}:' /etc/passwd",
      subscribe   =&gt; User[ $username ],
      refreshonly =&gt; true,
    }
  
    file { $homedir:
       ensure   =&gt; directory,
       owner    =&gt; $username,
       group    =&gt; $white_gid,
       mode     =&gt; $homedir_mode,
       require  =&gt; User[ $username ],
     }
  
     file { "$homedir/.ssh":
       ensure  =&gt; directory,
       owner   =&gt; $username,
       group   =&gt; $white_gid,
       mode    =&gt; 0700,
       require =&gt; File[ "$homedir" ],
     }
  
     file { "$homedir/.ssh/authorized_keys":
       ensure  =&gt; present,
       owner   =&gt; $username,
       group   =&gt; $white_gid,
       mode    =&gt; 0600,
       source  =&gt; "puppet:///modules/ssh_keys/${username}_authorized_keys",
       require =&gt; File["$homedir/.ssh"],
    }
  }
  
  class ssh_keys {
    group { "white":
      ensure =&gt; present,
      gid    =&gt; 9999,
      require =&gt; Class["nfs_homedirs"],
    }
  
    #### add users below this line
    local_user { "userA"  : fullname =&gt; "userA",    userid =&gt; "123" }
  </code></pre>
  
  <p>Some things I'm puzzled by and could use expertise with:</p>
  
  <ul>
  <li>In order for the NFS home directories to work at all, I had to run the module on a machine to create the users locally, then mount the root directory of the NFS mount for home directories and create those user's folders owned by their uid/gid for the autofs to actually work when they log in.</li>
  <li>When the module fails to "work" against the NFS-mounted home directories, the error is 'Permission denied' when it tries to create the home folder.  I've tried no_root_squash to combat the error, but to no avail.  I have tried running the agent as root, as not-root via sudo, as not-root at all, etc.</li>
  </ul>
  
  <blockquote>
    <p>Error:
    /Stage[main]/Ssh_keys/Local_user[userA]/File[/home/userA]/ensure: 
        change from absent to directory failed: Could not set 'directory' on ensure: 
        Permission denied - /home/userA at 
        80:/app/puppet/conf/environments/puppet_dev/modules/ssh_keys/manifests/init.pp</p>
  </blockquote>
  
  <ul>
  <li><p>It's seemingly harmless to put ensure => present statements on these directories and file resources. They're technically already created on the NFS share, but the way autofs seems to work is that it won't actually "mount" that user's share until they login.  It's not my expertise, but that's what I experience.  When this module does run successfully, every user's home directory it creates shows as a mount in the <strong>df</strong> output.</p></li>
  <li><p>I suspect that there's something on the machine itself that's preventing this module from working the way it should.  Knowing that there are probably 500 things that I could diff between a machine where this module runs clean and one where it doesn't, what are some places I should investigate?</p></li>
  </ul>
  
  <p>Any assistance would be greatly appreciated.</p>