SFSEXPORTS.CFG(5)

📦
version 5.8.0 · 4 versions
, in ubuntu stonking

✨ SFSEXPORTS.CFG(5) — the whole vibe 💖

okay bestie, sit down, we're talking about sfsexports.cfg(5), aka the access-control glow-up list for your SaunaFS sfsmount clients. no cap, this is the file that decides who gets in and who gets told "not today".

🌸 NAME 🌸

sfsexports.cfg — SaunaFS access control for sfsmounts 🫶

📜 DESCRIPTION 📜

So the tea is: the file sfsexports.cfg holds the SaunaFS access list for sfsmount clients. that's it, that's the whole job, and it does it iconically.

🎀 SYNTAX 🎀

the syntax goes a little something like this:

ADDRESS DIRECTORY [OPTIONS]

and lowkey the most important rule: any line starting with the # character is ignored. hashtag comment, hashtag boundaries, we love to see it. 💅

ADDRESS can show up in several forms, pick your fighter:

  • * — all addresses, everybody invited to the function
  • n.n.n.n — a single IP address
  • n.n.n.n/b — an IP class specified by network address and bits number
  • n.n.n.n/m.m.m.m — an IP class specified by network address and mask
  • f.f.f.f-t.t.t.t — an IP range specified by from-to addresses (inclusive, so the ends are in the group chat too)

DIRECTORY can be /, or a path relative to the SaunaFS root. and there's one special girly: the special value . means the SFSMETA companion filesystem ✨

💅 OPTIONS 💅

okay here's the full menu, no skipping, all of them matter:

  • ro, readonly — export the tree in read-only mode. this is the default, she's the baseline.
  • rw, readwrite — export the tree in read-write mode. now we're cooking. 🔥
  • ignoregid — disables testing of group access at the sfsmaster level (it's still done at the sfsmount level, don't worry). in this case the "group" and "other" permissions are logically added; this is needed for supplementary groups to work, because sfsmaster only receives the user's primary group information. it's giving "we work with what we got".
  • caseinsensitive — this option lets the client treat all file and folder names as case-insensitive. when it's on, the client will not differentiate between uppercase and lowercase characters in file and folder names.
Note ⚠️ System administrators are strongly advised not to allow simultaneous access to the same directory or subdirectory by multiple clients where some have the caseinsensitive option enabled and others do not — especially if these clients connect from different session IPs. This configuration can lead to filesystem inconsistencies and unpredictable behavior. For any given path or subfolder, make sure all accessing clients either use this option or none of them do. like, pick a lane, bestie, for real. 😭
  • dynamicip — allows reconnecting of an already authenticated client from any IP address. (the default behavior is to check the IP address on reconnect, so this is the chill mode.)
  • maproot=USER[:GROUP] — maps root (uid=0) accesses to the given user and group, similarly to the maproot option in NFS mounts. USER and GROUP can be given either as a name or as a number; if no group is specified, USER's primary group is used. Names are resolved on the sfsmaster side (see the note below, bestie).
  • mapall=USER[:GROUP] — like the one above, but it maps all non-privileged users (uid!=0) accesses to the given user and group (see the notes below 👀).
  • minversion=VER — rejects access from clients older than the specified version. grandma clients, be gone. 🙈
  • mingoal=N, maxgoal=N — specify the range in which goal can be set by users.
  • mintrashtime=TDUR, maxtrashtime=TDUR — specify the range in which trashtime can be set by users.
  • password=PASS, md5pass=MD5 — requires password authentication in order to access the specified resource. 🔐
  • alldirs — allows mounting any subdirectory of the specified directory (similarly to NFS).
  • nonrootmeta — allows non-root users to use the filesystem mounted in meta mode (this option is available only in this mode).

and the default options, drumroll please: ro,maproot=999:999. that's the starting fit. 👑

🧚 NOTES 🧚

  • USER and GROUP names (if they're not specified by an explicit uid/gid number) are resolved on the sfsmaster host.
  • TDUR can be specified as a number without a time unit (that's the number of seconds) or as a combination of numbers with time units. The time units are: W,D,H,M,S. Order is important — less significant time units can't be defined before more significant time units. so 2h30m slays, 30m2h does not.
  • the mapall option works in SaunaFS in a different way than in NFS, because SaunaFS uses FUSE's "default_permissions" option. When the mapall option is used, users see all objects with uid equal to the mapped uid as their own, and all other objects as root's objects. Similarly, objects with gid equal to the mapped gid are seen as objects with the current user's primary group, and all other objects as objects with group 0 (usually wheel). With the mapall option set, the attribute cache in the kernel is always turned off. no cap, that's just how it is.

🌈 EXAMPLES 🌈

these are literally the looks, copy them directly:

  • * → / with ro
  • 192.168.1.0/24 → / with rw
  • 192.168.1.0/24 → / with rw,alldirs,maproot=0,password=passcode
  • 10.0.0.0-10.0.0.5 → /test with rw,maproot=nobody,password=test
  • 10.1.0.0/255.255.0.0 → /public with rw,mapall=1000:1000
  • 10.2.0.0/16 → / with
rw,alldirs,maproot=0,mintrashtime=2h30m,maxtrashtime=2w

💀 REPORTING BUGS 💀

found a bug? not the vibe, but fair. Report bugs to the GitHub repository https://github.com/leil-io/saunafs as an issue. 🐛

Copyright 2008-2009 Gemius SA

Copyright 2013-2019 Skytechnology sp. z o.o.

Copyright 2023-2024 Leil Storage OÜ

SaunaFS is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3.

SaunaFS is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with SaunaFS. If not, see http://www.gnu.org/licenses/.

⭐ SEE ALSO ⭐

and that's the whole page, bestie — SFSEXPORTS.CFG(5), dated 2026-07-29, from the sfsexports.cfg(5) era. now go forth and configure your exports correctly, mwah 🫶💖✨

📦 where this page comes from