Skip to main content

NFS share

Overview​

This guide explains how to expose directories via NFS.

Exposing application data as an NFS share helps copy large numbers of media files into or from Emby/Jellyfin, or copy images into Surfer.

Insecure traffic

NFS traffic is unencrypted and can be tampered. Only use NFS mounts on secure private networks.

Install NFS server​

Run on the server:

sudo apt install nfs-kernel-server

Disable NFSv3​

By default, the NFS server supports v3 and v4. NFSv3 has security implications and should be disabled.

  1. Edit /etc/nfs.conf (Ubuntu 22.04+) or /etc/default/nfs-kernel-server (older systems) and add:
RPCNFSDOPTS="-N 2 -N 3"
  1. Restart the server:
systemctl restart nfs-kernel-server
  1. Verify NFSv3 is disabled:
cat /proc/fs/nfsd/versions

Expected output:

-2 -3 +4 +4.1 +4.2
  1. Disable the rpcbind service (only required for NFSv3):
systemctl disable rpcbind.socket rpcbind.service
systemctl stop rpcbind.socket rpcbind.service

Exposing a directory​

Edit /etc/exports and add a line:

# This exposes data of the app with id appid to the client IP address client_ip
/home/yellowtent/appsdata/app_id/data client_ip(rw,sync,no_subtree_check,no_root_squash)

Options:

  • rw - Read and write access
  • sync - Server replies after changes are committed to stable storage
  • no_subtree_check - Skip checking if file access remains in the exported filesystem
  • no_root_squash - Client root user maps to server root user

Export the directory​

Export the configured NFS directory:

exportfs -a
systemctl restart nfs-kernel-server

Expose NFS port​

NFS uses port 2049 (TCP/UDP). Add it to the firewall by editing /home/yellowtent/platformdata/firewall/ports.json:

{
    "allowed_tcp_ports": [ 2049 ],
    "allowed_udp_ports": [ 2049 ]
}

Restart the firewall:

systemctl restart cloudron-firewall

Mounting on client​

Add the following entry to /etc/fstab on your laptop/PC:

cloudron_ip:/home/yellowtent/appsdata/app_id/data               /mounts/app      nfs auto,nofail,noatime,nolock,intr,tcp,actimeo=1800 0 0