Thanks, I misunderstood the usage of /24. I thought in order to export to a whole subnet, I had to put the subnet address 192.168.0.0/24 while 192.168.0.20/24 would imply a single client within that subnet. I removed the prefix length entirely as CallMeAl suggested, so that’s sorted out.
There’s another issue remaining, see my reply to Al’s comment if you’d like.
Thank you. I’m closer to what I want now. Can you help me explain this behavior though:
For testing purposes, I commented out every line in /etc/exports but these:
/srv/nfsv4 192.168.0.10(ro,sync,secure,root_squash,subtree_check,fsid=0) \
192.168.0.20(ro,sync,secure,root_squash,subtree_check,fsid=0)
Client 192.168.0.20 can mount nfs-server:/ and listing the contents gives both directories foo and bar. It cannot see the contents of foo, as intended, but it can see what’s inside bar (EDIT: it can see down one level, so the subdirectories of bar, but nothing further down). I cannot figure out why? I rebooted the machine in hopes it was just a caching thing, to no avail.
Apart from that, I was hoping 192.168.0.20 could not even mount foo, but as long as its contents are hidden, I can live with that for now.
That can’t be right. For exposing it to a whole subnet, it would have to be 192.168.0.0/24, wouldn’t it?
Non-sysadmin here, I could only find some generic info on ISO 27002/27001, what does it say about containerized applications?
Even with bar exported to this client, it cannot see its subdirectories’ contents. What the hell is going on? Just to be clear, I did run
exportfs -arvafter every change to /etc/exports.