Nas Nasa

nas-nasa Host Configuration & Container Deployment Guide

Role: Network Attached Storage (NAS) / Media, Smart Home & Backups
Platform: x86_64 (Intel Celeron J4125 @ 2.00GHz)
Current OS: QNAP QTS (Custom Linux Kernel 5.10)
Future Target: NixOS (hosts/nas-nasa) LAN IP: 192.168.31.12 | Tailscale IP: 100.64.243.70

1. Hardware Overview

• Processor: Intel Celeron J4125 (4 cores, 4 threads @ 2.00GHz) — highly capable x86_64 architecture with Intel QuickSync for media transcoding.
• Network Interfaces: Dual 2.5 Gbps Ethernet ports (eth0 at 192.168.31.12, eth1 at 192.168.31.138), both negotiating at 2500 Mb/s (2.5 Gbps).

Physical Drives & RAID Configuration

The NAS houses a 4-bay high-availability storage array using Enterprise-grade disks:

• Drive Bays Configuration:
  • Bay 1 (sda): Seagate Exos 7E8/7E10 8TB Enterprise HDD (ST8000NM000A-2KE)
  • Bay 2 (sdb): Seagate Exos 7E8/7E10 8TB Enterprise HDD (ST8000NM000A-2KE)
  • Bay 3 (sdc): Seagate Exos 7E10 8TB Enterprise HDD (ST8000NM017B-2TJ)
  • Bay 4 (sdd): Seagate Exos 7E10 8TB Enterprise HDD (ST8000NM017B-2TJ)
• RAID Array (/dev/md1):
  • Level: RAID 5 (1-disk parity fault tolerance)
  • Members: sda3, sdb3, sdc3, sdd3
  • Capacity: 21.80 TiB raw block volume

LVM Thin Provisioning System

The physical RAID group is mapped through a DRBD virtualization/caching layer (/dev/drbd1) to LVM Volume Group vg1, utilizing a single large LVM Thin Pool (tp1):

• Thin Pool Capacity: 21.60 TiB total allocatable pool space.
• Pool Resource Usage: 54.85% allocated (~11.85 TiB consumed physically).
• Metadata Usage: 1.16% allocated.

Logical Volumes & Storage Pools (CACHEDEV Filesystems)

Active mounts are formatted as ext4 and thinly provisioned from tp1:

2. Backup Architecture Integration

To protect workstations like id3-eniac and lab-matrix without real-time file replication issues:

[id3-eniac / lab-matrix]
    │
    ├──► 1. Local Snapshots (btrbk) ────► Local SSD/HDD (Btrfs subvolumes)
    │
    └──► 2. Offsite/NAS Backup (restic) ──► restic-rest-server (Port 8000) ──► QNAP /share/CACHEDEV2_DATA/

• Tier 1 (Instant recovery): btrbk runs locally to manage Btrfs snapshots on the workstation’s NVMe system drive.
• Tier 2 (NAS Archive): Workstations backup directly to the QNAP NAS using Restic over HTTP/HTTPS, using a self-hosted restic-rest-server container for full Gigabit speeds (~110 MB/s) and append-only ransomware protection.

3. Step-by-Step Container Deployment Guides

All containers are deployed using Container Station 3 on the QQNAP NAS via Docker Compose (the “Applications” feature).

Setup A: Restic REST Server (High-Performance Backups)

Restic REST Server provides append-only security (ransomware protection) and full Gigabit backup speeds.

[!NOTE] For details on configuring client-side backups, excluding build directories, and setting up encryption secrets on your NixOS workstations, see backup.md.

Step 1: Generate the .htpasswd File on id3-eniac

Restic REST Server uses standard HTTP basic authentication. Generate the credentials file on your NixOS workstation using a temporary Nix shell, and copy it to the NAS:

# Generate the file for the user 'restic-id3-eniac' (matching your repository folder name)
nix-shell -p apacheHttpd --run "htpasswd -B -c .htpasswd restic-id3-eniac"

# Copy it to your QNAP NAS backup folder
scp .htpasswd nasnasa:/share/CACHEDEV2_DATA/alienzj/backup/

Step 2: Create the Application in Container Station

1. Log in to QTS web admin (http://192.168.31.12:8080) $\rightarrow$ Open Container Station.
2. Click Applications on the left menu $\rightarrow$ Click Create (or +).
3. Fill in the parameters:
   • Application Name: restic-server
   • YAML Config:

     version: '3.8'
     services:
       restic-rest-server:
         image: restic/rest-server:latest
         container_name: restic-rest-server
         restart: unless-stopped
         ports:
           - "8000:8000"
         volumes:
           - /share/CACHEDEV2_DATA/alienzj/backup:/data
         environment:
           - OPTIONS=--append-only --private-repos

4. Click Validate $\rightarrow$ Click Create.

Step 3: NixOS Client Configuration

Update your workstation’s NixOS restic.nix options. To keep credentials secure and prevent leaks in the world-readable Nix store, define an environment file with HTTP basic auth variables:

1. Create a restic-env.age secret containing:

   RESTIC_REST_USERNAME="restic-id3-eniac"
   RESTIC_REST_PASSWORD="your_rest_server_password"

2. Enable the service in your NixOS configuration (the repository URL defaults to your NAS IP on port 8000 and uses the environment file):

   modules.services.sharing.restic.enable = true;

Setup B: Home Assistant (Smart Home Controller)

To allow Home Assistant to auto-discover local smart home devices (via mDNS, UPnP, SSDP), it must run in the host’s networking mode. We also pass through any connected Zigbee or Z-Wave USB controllers.

Step 1: Identify USB Dongles (If applicable)

If you have a Zigbee USB coordinator (e.g., Sonoff Dongle) plugged into the NAS, identify its interface path:

ssh nasnasa ls -la /dev/ttyUSB* /dev/ttyACM*
# Typically resolves to /dev/ttyUSB0 or /dev/ttyACM0

Step 2: Create the Application in Container Station

1. Open Container Station $\rightarrow$ Click Applications $\rightarrow$ Click Create.
2. Fill in the parameters:
   • Application Name: home-assistant
   • YAML Config:

     version: '3.8'
     services:
       homeassistant:
         image: ghcr.io/home-assistant/home-assistant:stable
         container_name: homeassistant
         restart: unless-stopped
         network_mode: host
         volumes:
           - /share/CACHEDEV1_DATA/Container/homeassistant/config:/config
           - /etc/localtime:/etc/localtime:ro
         devices:
           # Pass through Zigbee USB dongles
           - /dev/ttyUSB0:/dev/ttyUSB0
           # - /dev/ttyACM0:/dev/ttyACM0

3. Click Validate $\rightarrow$ Click Create.
4. Access the web interface at http://192.168.31.12:8123 to complete setup.

Setup C: Nextcloud (Personal Cloud & File Sync)

Nextcloud requires a database backend and an in-memory cache (Redis) for lock processing and high-performance operations to avoid sluggishness.

Step 1: Create local folders on QNAP

Ensure that target folders exist on the NAS volume:

ssh nasnasa mkdir -p /share/CACHEDEV1_DATA/Container/nextcloud/db /share/CACHEDEV1_DATA/Container/nextcloud/app /share/CACHEDEV2_DATA/Nextcloud/data

Step 2: Create the Application in Container Station

1. Open Container Station $\rightarrow$ Click Applications $\rightarrow$ Click Create.
2. Fill in the parameters:
   • Application Name: nextcloud
   • YAML Config:

     version: '3.8'
     services:
       db:
         image: mariadb:10.11
         container_name: nextcloud-db
         restart: unless-stopped
         command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
         volumes:
           - /share/CACHEDEV1_DATA/Container/nextcloud/db:/var/lib/mysql
         environment:
           - MYSQL_ROOT_PASSWORD=choose_a_strong_root_db_password
           - MYSQL_PASSWORD=choose_a_nextcloud_db_password
           - MYSQL_DATABASE=nextcloud
           - MYSQL_USER=nextcloud
     
       redis:
         image: redis:alpine
         container_name: nextcloud-redis
         restart: unless-stopped
     
       app:
         image: nextcloud:latest
         container_name: nextcloud-app
         restart: unless-stopped
         ports:
           - "8080:80"
         depends_on:
           - db
           - redis
         volumes:
           # Core web files
           - /share/CACHEDEV1_DATA/Container/nextcloud/app:/var/www/html
           # Massive file storage maps to CACHEDEV2
           - /share/CACHEDEV2_DATA/Nextcloud/data:/var/www/html/data
         environment:
           - MYSQL_PASSWORD=choose_a_nextcloud_db_password
           - MYSQL_DATABASE=nextcloud
           - MYSQL_USER=nextcloud
           - MYSQL_HOST=db
           - REDIS_HOST=redis

3. Click Validate $\rightarrow$ Click Create.
4. Access the web interface at http://192.168.31.12:8080 to run the initial administrator setup.

4. QuFirewall & Tailscale Configuration

If QuFirewall is active on QNAP QTS, incoming connections from your Tailscale private mesh will be blocked by default because they originate from outside the physical local subnet.

To enable seamless administration of the QTS panel, SSH/SFTP, and SMB fileshares over Tailscale, you must add an allowance rule:

Step-by-Step Firewall Setup

1. Log in to the QTS Web Portal via your local LAN IP (http://192.168.31.12:8080 or https://192.168.31.12:5001).
2. Open the QuFirewall application from your desktop or the App Center.
3. Locate your active profile (typically Basic Protection or Include Subnets Only) and click the Edit (pencil) icon.
4. Click + Add to create a new firewall rule:
   • Service: Select Any (or define specific TCP ports: 5001, 8080, 22, 445 for QTS, SSH, and SMB).
   • Source IP:
     • Select Subnet and enter the Tailscale IPv4 CGNAT subnet: 100.64.0.0 with Netmask 255.192.0.0 (which is 100.64.0.0/10).
     • (Optional) Add a second rule for Tailscale IPv6: fd7a:115c:a1e0:: with Prefix length 48.
   • Action: Set to Allow.
5. CRITICAL: In the rules list, drag your new Tailscale rules above the default “Deny all” or “Access violation” rules (rules are evaluated top-down).
6. Click Apply to save and activate the settings.

Verification

Once the rule is applied, test connectivity from your workstation (id3-eniac) over the Tailscale IP (100.64.243.70):

# Test QTS Admin HTTPS port
curl -kI https://100.64.243.70:5001/

# Test SSH/SFTP connection
ssh nasnasa2 hostname

Both should connect instantly instead of timing out.

5. Future NixOS Migration Plan

Migrating nas-nasa from QTS to NixOS brings massive architectural advantages:

• Declarative Storage: Every SMB share, user permission, and disk layout (via disko) is declared in code.
• Self-Healing Deploy: If the OS drive fails, a single command (hey sync) redeploys the exact same storage parameters in minutes.
• Container Integration: CasaOS or Portainer can be installed on top of Podman/Docker on NixOS to preserve the single-click web interface for media container management (Jellyfin, qBittorrent, etc.).