document NFS4 mounts in more detail

admin-guide/configuration/mount.md

@@ -35,27 +35,37 @@ For auto-mounts, add another option to the mountpoint definition:
 Remote NFS mountpoints can be defined as in following example:
 
 ```
+mounter::def::data1:
+  'ensure': 'mounted'
+  'device': 'x01dc-fs-1:/export/X01DC/Data1'
+  'mountpoint': '/sls/X01DC/Data1'
+  'type': 'nfs'
+  'options': 'nfsvers=4.2,sec=krb5'
+
 mounter::def::controls:
   'ensure': 'mounted'
   'device': 'sls-hafs:/export/sls/controls'
   'mountpoint': '/gfa/.mounts/sls_controls'
   'type': 'nfs'
 
-mounter::def::data1:
-  'ensure': 'mounted'
-  'device': 'x01dc-fs-1:/export/X01DC/Data1'
-  'mountpoint': '/sls/X01DC/Data1'
-  'type': 'nfs'
-  'options': 'soft,nfsvers=4,tcp,bg'
-
-
 mounter::mounts:
-  - 'controls'
   - 'data1'
+  - 'controls'
 ```
 
 Ideally use NFSv4 (option `nfsvers=4.2`) and Kerberos authentication (option `sec=krb5`) is used. For Kerberos please contact the Linux Core Group for support. We managed to get it running experimentally, but it might not run yet automatically from Puppet. And of course also the NetApp side needs to be prepared accordingly.
 
+Following options are possible for `sec`:
+- `sys` client enforces access control (default on NFS3)
+- `krb5` server enforces access control, client user authenticates with Kerberos
+- `krb5i` server enforces access control, client user authenticates with Kerberos and traffic is integrity checked
+- `krb5p` server enforces access control, client user authenticates with Kerberos and traffic is fully encrypted
+
+NFS and Kerberos also needs ID mapping, which is automatically configured to the default domain `psi.ch`. Should a different domain be required, you may set it with Hiera:
+```
+nfs_idmap::domain: 'ethz.ch'
+```
+
 ## CIFS
 
 ### CIFS with Multiuser Option and Kerberos