feat(nfs): per-host NFS options (IP/CIDR with own ro/async/squash flags)

This is a backward-compatible MINOR bump (0.4.0 → 0.5.0).

BREAKING NOTES (for users upgrading from pre-0.5.0):
- The nfs_exports.clients column schema changed from []string to
  []NFSClient (per-host options). A migration (0005) transforms existing
  string arrays into object arrays, taking export-level options as
  defaults for each host.
- ValidateNFSClient now only accepts IPv4 (192.168.1.1) or IPv4/CIDR
  (192.168.1.0/24). Hostnames, wildcards, netgroups are rejected.
- If you use NASCTL_IMPORT_ON_BOOT, re-import your /etc/exports to pick
  up per-host options.

What changed:
- NFSClient type: {host, read_only, async, root_squash, subtree_check, advanced}
- NFSExport.Clients is now []NFSClient (was []string)
- export-level flags (ro/async/root_squash/subtree_check/advanced) are
  preserved as template defaults for newly added hosts in the UI.
- buildExportLine generates: path host1(ro,sync,...) host2(rw,async,...) fsid=N
- ValidateNFSClient: strict IPv4/CIDR only (0-255 octets, /0-32 prefix)
- parseExportLine now parses per-host options from /etc/exports (previously
  only the first host's options were kept, others were discarded)
- UI: per-host rows with toggles (ro/async/root_squash/subtree_check) and
  advanced options (all_squash, secure, wdelay, hide, crossmnt)

internal/db/db.go

@@ -3,6 +3,7 @@ package db
 import (
 	"database/sql"
 	"embed"
+	"encoding/json"
 	"fmt"
 	"io/fs"
 	"sort"
@@ -79,6 +80,11 @@ func (d *DB) Migrate() error {
 				return fmt.Errorf("populate legacy fsids: %w", err)
 			}
 		}
+		if name == "0005_nfs_per_host_options.sql" {
+			if err := d.MigrateNFSClients(); err != nil {
+				return fmt.Errorf("migrate nfs clients: %w", err)
+			}
+		}
 	}
 	return nil
 }
@@ -132,3 +138,83 @@ func isIgnorableMigrationError(err error) bool {
 	return strings.Contains(msg, "duplicate column name") ||
 		strings.Contains(msg, "already exists")
 }
+
+func (d *DB) MigrateNFSClients() error {
+	rows, err := d.conn.Query(`
+		SELECT id, clients, read_only, async_, root_squash, subtree_check, fsid, advanced
+		FROM nfs_exports`)
+	if err != nil {
+		return fmt.Errorf("query nfs exports: %w", err)
+	}
+	defer rows.Close()
+
+	type rowData struct {
+		ID           int64
+		Clients      string
+		ReadOnly     bool
+		Async        bool
+		RootSquash   bool
+		SubtreeCheck bool
+		FSID         int64
+		Advanced     string
+	}
+
+	var toUpdate []rowData
+	for rows.Next() {
+		var r rowData
+		if err := rows.Scan(&r.ID, &r.Clients, &r.ReadOnly, &r.Async, &r.RootSquash, &r.SubtreeCheck, &r.FSID, &r.Advanced); err != nil {
+			return fmt.Errorf("scan row: %w", err)
+		}
+
+		var raw []any
+		if err := json.Unmarshal([]byte(r.Clients), &raw); err != nil {
+			continue
+		}
+		if len(raw) == 0 {
+			continue
+		}
+
+		if _, ok := raw[0].(string); !ok {
+			continue
+		}
+
+		var adv NFSAdvanced
+		if r.Advanced != "" && r.Advanced != "{}" {
+			_ = json.Unmarshal([]byte(r.Advanced), &adv)
+		}
+
+		clients := make([]NFSClient, len(raw))
+		for i, elem := range raw {
+			host, ok := elem.(string)
+			if !ok {
+				host = ""
+			}
+			clients[i] = NFSClient{
+				Host:         host,
+				ReadOnly:     r.ReadOnly,
+				Async:        r.Async,
+				RootSquash:   r.RootSquash,
+				SubtreeCheck: r.SubtreeCheck,
+				Advanced:     adv,
+			}
+		}
+
+		clientsJSON, err := json.Marshal(clients)
+		if err != nil {
+			return fmt.Errorf("marshal clients for id %d: %w", r.ID, err)
+		}
+
+		r.Clients = string(clientsJSON)
+		toUpdate = append(toUpdate, r)
+	}
+	if err := rows.Err(); err != nil {
+		return fmt.Errorf("rows iteration: %w", err)
+	}
+
+	for _, r := range toUpdate {
+		if _, err := d.conn.Exec(`UPDATE nfs_exports SET clients = ? WHERE id = ?`, r.Clients, r.ID); err != nil {
+			return fmt.Errorf("update nfs export id %d: %w", r.ID, err)
+		}
+	}
+	return nil
+}

internal/db/migrations/0005_nfs_per_host_options.sql

@@ -0,0 +1,3 @@
+-- Migrate nfs_exports.clients from []string to []NFSClient (per-host options).
+-- Schema change: none (clients column already TEXT/JSON).
+-- Data transformation is done by the Go hook MigrateNFSClients in db.go.

internal/db/models.go

@@ -37,10 +37,19 @@ type SambaShare struct {
 	UpdatedAt   time.Time `json:"updated_at"`
 }
 
+type NFSClient struct {
+	Host         string      `json:"host"`
+	ReadOnly     bool        `json:"read_only"`
+	Async        bool        `json:"async"`
+	RootSquash   bool        `json:"root_squash"`
+	SubtreeCheck bool        `json:"subtree_check"`
+	Advanced     NFSAdvanced `json:"advanced"`
+}
+
 type NFSExport struct {
 	ID           int64     `json:"id"`
 	Path         string    `json:"path"`
-	Clients      []string  `json:"clients"`
+	Clients      []NFSClient `json:"clients"`
 	ReadOnly     bool      `json:"read_only"`
 	Async        bool      `json:"async"`
 	RootSquash   bool      `json:"root_squash"`

internal/db/queries_import.go

@@ -57,7 +57,7 @@ func (d *DB) ReplaceNFSExports(exports []NFSExport) error {
 	}
 
 	for _, exp := range exports {
-		clients, err := encodeJSONStrings(exp.Clients)
+		clients, err := encodeNFSClients(exp.Clients)
 		if err != nil {
 			return err
 		}

internal/db/queries_nfs.go

@@ -2,6 +2,7 @@ package db
 
 import (
 	"database/sql"
+	"encoding/json"
 	"fmt"
 	"regexp"
 	"strconv"
@@ -9,6 +10,28 @@ import (
 	"github.com/darroyo/nasctl/internal/system"
 )
 
+func encodeNFSClients(clients []NFSClient) (string, error) {
+	if clients == nil {
+		clients = []NFSClient{}
+	}
+	data, err := json.Marshal(clients)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+func decodeNFSClients(raw string) ([]NFSClient, error) {
+	if raw == "" {
+		return []NFSClient{}, nil
+	}
+	var clients []NFSClient
+	if err := json.Unmarshal([]byte(raw), &clients); err != nil {
+		return nil, err
+	}
+	return clients, nil
+}
+
 func scanNFSExport(row interface {
 	Scan(dest ...any) error
 }) (NFSExport, error) {
@@ -31,7 +54,7 @@ func scanNFSExport(row interface {
 		return NFSExport{}, err
 	}
 	var err error
-	export.Clients, err = decodeJSONStrings(clients)
+	export.Clients, err = decodeNFSClients(clients)
 	if err != nil {
 		return NFSExport{}, err
 	}
@@ -80,7 +103,7 @@ func (d *DB) GetNFSExport(id int64) (NFSExport, error) {
 }
 
 func (d *DB) CreateNFSExport(export NFSExport) (NFSExport, error) {
-	clients, err := encodeJSONStrings(export.Clients)
+	clients, err := encodeNFSClients(export.Clients)
 	if err != nil {
 		return NFSExport{}, err
 	}
@@ -120,7 +143,7 @@ func (d *DB) CreateNFSExport(export NFSExport) (NFSExport, error) {
 }
 
 func (d *DB) UpdateNFSExport(id int64, export NFSExport) (NFSExport, error) {
-	clients, err := encodeJSONStrings(export.Clients)
+	clients, err := encodeNFSClients(export.Clients)
 	if err != nil {
 		return NFSExport{}, err
 	}