Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos

variables.nix

@@ -137,10 +137,14 @@
     # (modules/build-types/pxe-boot.nix).
     pxeBootTftp = 69;
 
-    # `server`'s NFS exports need both the portmapper (rpcbind) and the
-    # NFS data port itself opened (modules/build-types/server.nix).
+    # `server`'s NFS exports: portmapper (rpcbind), NFS data, and the
+    # mountd RPC service (used by showmount/NFSv3 mount protocol).
+    # Mountd listens on a fixed port so the firewall can whitelist it
+    # explicitly rather than opening all of rpcbind's dynamic range.
+    # All three need both TCP and UDP (modules/build-types/server.nix).
     nfsRpcbind = 111;
     nfsd = 2049;
+    nfsMountd = 20048;
 
     # Opened on the docker host's firewall for the Traefik-fronted
     # container stack (docker-compose config lives in the separate