[david-mendez1]

Summary

CP-13821 (child of Epic CP-13819): closes port 2049 by default on most Delphix appliance variants. Companion appliance change: dlpx-app-gate PR #4967, CP-13820.

This PR is not safe to merge independently of the companion dlpx-app-gate PR. Merging either repo's change alone leaves an engine in a broken state:

• delphix-platform alone: new images ship with /etc/nfs_disable present (NFS disabled), and nothing in this repo ever removes it — only the companion PR's ProductServiceImpl/StackStartup code does.
• app-gate alone: the upgrade retrofit and setup-time enable logic exist, but there is no systemd Condition anywhere to actually gate nfs-server.service without this PR.

Both must land in the same release train.

• ConditionPathExists=!/etc/nfs_disable added to the existing [Unit] block in files/common/lib/systemd/system/nfs-server.service.d/override.conf, alongside the existing ConditionVirtualization=!container.
• A new, ansible_is_chroot-gated task in roles/delphix-platform/tasks/main.yml creates /etc/nfs_disable on every variant except six named internal-infra variants (internal-minimal, internal-unittest, internal-dcenter, internal-buildserver, internal-package-mirror, internal-claude). The ansible_is_chroot gate is required: without it, this task would re-run on every real engine's boot-time Ansible re-run after every delphix-platform package upgrade and silently re-disable NFS on a live VIRTUALIZATION/BOTH engine.

Test plan

• Build (via ab-pre-push) and manually verify on cloned internal-dev engines for both VIRTUALIZATION and MASKING: /etc/nfs_disable present/absent and nfs-server.service active/inactive match expectations on both.
• Confirm the systemd Condition blocks nfs-server.service while the marker exists.
• Confirm factory reset (developer_reset) correctly reconciles NFS state back to disabled on a previously-enabled Virtualization engine, and leaves a Masking engine unaffected.
• server:storage tests could not be executed in the implementation sandbox (no native libzfs on that machine) and need a real run on Linux/CI before merge.

Replaces #578, which was closed because its head branch (CP-13821-disable-nfs-default) had unintentionally acquired develop-level branch protection (no force-push, no admin bypass, linear-history-only, 1 required review with no self-approval), making it impossible to update.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Coordinated delivery with the companion PR and outstanding Linux storage tests require human verification.

No open issues 🎉

What changed in this PR

Disables NFS by default on most appliance variants, with engine-specific enablement handled by the companion application change.

Changes:

• Gates nfs-server.service on the absence of /etc/nfs_disable.
• Creates the marker only during image builds, excluding six internal infrastructure variants and avoiding runtime upgrade resets.

File	Description
files/​common/​var/​lib/​delphix-platform/​ansible/​10-delphix-platform/​roles/​delphix-platform/​tasks/​main.yml	Creates the NFS-disable marker for eligible image builds.
files/​common/​lib/​systemd/​system/​nfs-server.service.d/​override.conf	Prevents NFS startup while the marker exists.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Safe rollout requires coordinated companion changes and completion of the outstanding Linux/CI storage tests.

No open issues 🎉

_{Review effort: Balanced}