Skill: ivangdavila/nas (version 1.0.0)

--- name: NAS slug: nas version: 1.0.0 description: Configure, secure, and optimize network attached storage with proper backup strategy, remote access, and media serving. metadata: {"clawdbot":{"emoji":"🗄️","requires":{"bins":[]},"os":["linux","darwin","win32"]}} --- ## Quick Reference | Topic | File | |-------|------| | Backup strategy, 3-2-1 rule | `backup.md` | | Remote access, VPN, security | `security.md` | | Docker, home lab, apps | `apps.md` | | Media server, indexing | `media.md` | ## Scope This skill covers NAS administration for Synology, QNAP, TrueNAS, Unraid, and DIY builds. For enterprise SAN/distributed storage, use specialized infrastructure skills. ## Critical Rules 1. **RAID is not backup** — RAID protects against drive failure, not ransomware, fire, or accidental deletion. Always maintain off-site backup. 2. **3-2-1 backup rule is minimum** — Three copies, two different media types, one off-site. Cloud sync to B2/S3/Glacier counts as off-site. 3. **SMB for Windows/Mac, NFS for Linux** — Wrong protocol = permission chaos. AFP deprecated. Enable only protocols you actually use. 4. **Expose ZERO ports to internet** — No DSM/QTS admin on public IP. Use VPN (WireGuard/Tailscale) or reverse proxy with auth. 5. **Test your backups quarterly** — Untested backup is not a backup. Actually restore files to verify integrity. 6. **Disable admin account** — Create named admin accounts. Default "admin" is first target for brute force. 7. **UPS mandatory** — Power loss during write = corrupted pool. Budget for battery backup that signals clean shutdown. 8. **Snapshots are not backup** — Same disks, same failure domain. Snapshots help with accidental delete, not disaster. 9. **Calculate TRUE storage capacity** — RAID overhead, reserved space, filesystem overhead. 4x8TB drives ≠ 32TB usable. 10. **ARM NAS = limited Docker** — Synology J-series, low-end QNAP run ARM. Many Docker images x86 only. Verify before buying.

path: apps.md
content: ## Docker & Applications

### Architecture Awareness

| NAS CPU | Architecture | Docker Compatibility |
|---------|--------------|---------------------|
| Intel Celeron | x86_64 | Full |
| AMD Ryzen | x86_64 | Full |
| ARM Cortex-A (J-series) | arm64 | Limited |
| Realtek (budget models) | arm | Very limited |

**Before buying:** Check CPU architecture. Budget NAS often ARM = most images won't work.

### Docker on Synology

```yaml
# Use bridge network for isolation
networks:
  nas-apps:
    driver: bridge

# Bind to LAN IP, not 0.0.0.0
ports:
  - "192.168.1.10:8080:80"
```

### Common Traps

1. **Permission hell with volumes** — PUID/PGID must match NAS user. Not 1000:1000 always.

2. **Memory limits critical** — NAS has limited RAM. Set container memory limits or OOM kills everything.

3. **Don't run databases on NAS** — Postgres/MySQL on SMB/spinning disks = terrible performance. OK for sqlite.

4. **Path mapping confusion** — Host path `/volume1/docker/app` ≠ container path `/config`. Map explicitly.

5. **Updates break things** — Pin image versions. `:latest` surprise-breaks production setups.

### Resource-Friendly Apps

Low memory, NAS-appropriate:

- **Jellyfin/Plex** — Media server (transcode needs good CPU)
- **Paperless-ngx** — Document OCR and archive
- **Immich** — Photo backup (self-hosted Google Photos)
- **Home Assistant** — Smart home (consider dedicated Pi)
- **Pi-hole** — DNS-level ad blocking
- **Nginx Proxy Manager** — Reverse proxy with GUI

### Storage for Containers

```
/volume1/docker/
├── appdata/          ← config files (fast SSD if available)
├── media/            ← shared media library
└── downloads/        ← temp/scratch space
```

Don't put container configs on spinning array. If NAS has NVMe cache, use it for Docker.


path: backup.md
content: ## Backup Strategy

### 3-2-1 Rule Implementation

```
Primary copy: NAS (RAID protected)
Second copy: External USB drive (monthly rotation)
Third copy: Cloud (B2/S3/Glacier, encrypted)
```

### Common Traps

1. **Sync ≠ backup** — Dropbox/Drive sync deletes propagate. Use versioned backup, not sync.

2. **Cloud-only is risky** — Provider outage, account suspension, sync corruption. Local copy mandatory.

3. **Encryption before cloud** — NAS-side encryption (Hyper Backup, Cryptomator) before upload. Don't trust provider encryption alone.

4. **Test restore quarterly** — Pick random files, restore to different location. Verify content integrity.

5. **Retention policies matter** — Keep 30-day daily, 12-month monthly, 7-year annual for important data.

### What to Backup First

Priority order when storage limited:

1. **Irreplaceable** — Photos, documents, creative work
2. **Expensive to recreate** — VMs, configs, databases
3. **Convenient to have** — Media library (can re-rip/download)

### Backup Verification

Monthly: Check backup job logs
Quarterly: Restore test (5 random files)
Annually: Full disaster recovery drill

### Off-site Options by Budget

| Option | Cost | Recovery Speed |
|--------|------|----------------|
| Cloud (B2) | ~$5/TB/mo | Hours-days |
| External drive at friend's house | One-time | Hours |
| Second NAS at office | High upfront | Fast |
| Safety deposit box rotation | Low | Slow |


path: media.md
content: ## Media Server & Organization

### Folder Structure for Plex/Jellyfin

```
/volume1/media/
├── movies/
│   └── Movie Name (2024)/
│       ├── Movie Name (2024).mkv
│       └── Movie Name (2024).srt
├── tv/
│   └── Show Name/
│       └── Season 01/
│           └── Show Name - S01E01 - Title.mkv
├── music/
│   └── Artist/
│       └── Album (Year)/
│           └── 01 - Track.flac
└── photos/
    └── 2024/
        └── 2024-06-15 Event Name/
```

### Common Traps

1. **Wrong naming = no metadata** — Plex/Jellyfin guess from folder/file names. Follow format exactly or manual matching hell.

2. **Mixed content in one folder** — Movies and TV in same folder confuses scanners. Separate library roots mandatory.

3. **Transcoding melts NAS CPU** — Celeron can't transcode 4K HEVC. Direct play (capable clients) or hardware transcode (Intel QuickSync).

4. **Photo indexing is slow** — First Synology Photos/Immich index of 50K photos takes days. Let it finish before panicking.

5. **Don't trust NAS photo AI** — Face recognition, object detection are mediocre. Immich much better than Synology Photos.

### Hardware Transcoding

| Requirement | Solution |
|-------------|----------|
| 4K HEVC | Intel QuickSync (i3/i5 NAS) or capable clients |
| Multiple streams | Dedicated GPU (Plex Pass) or strong CPU |
| Budget NAS | Direct play only (Infuse, Kodi, Shield) |

### Photo Workflow

```
Phone → Auto-upload to NAS (Synology Photos/Immich)
Camera → Import to /photos/YYYY/ on NAS
RAW files → Separate /photos-raw/ folder
```

### Storage Planning

| Content | Per-item Size | Example Library |
|---------|---------------|-----------------|
| 1080p movie | 5-15 GB | 500 movies = 5 TB |
| 4K movie | 20-80 GB | 100 movies = 5 TB |
| TV episode | 1-4 GB | 50 series = 3 TB |
| Photo (RAW) | 25-50 MB | 10K photos = 400 GB |
| FLAC album | 300-600 MB | 200 albums = 100 GB |

Plan for 2x current library size. You'll fill it faster than expected.


path: security.md
content: ## Security & Remote Access

### Golden Rule

**No ports exposed to internet.** Period.

### Secure Remote Access Options

| Method | Complexity | Security |
|--------|------------|----------|
| Tailscale | Easy | Excellent |
| WireGuard | Medium | Excellent |
| Cloudflare Tunnel | Medium | Good |
| Synology QuickConnect | Easy | Acceptable |
| OpenVPN | Hard | Good |
| Port forwarding + DDNS | Easy | **TERRIBLE** |

### Common Traps

1. **QuickConnect is convenience, not security** — Acceptable for personal use, but adds relay dependency.

2. **Exposing DSM/QTS = ransomware target** — Shodan scans find open NAS admin panels in minutes.

3. **Brute force is real** — Log shows thousands of login attempts. Fail2ban + auto-block mandatory.

4. **VPN to NAS, not router** — NAS-hosted VPN (Synology VPN Server) exposes less than router VPN.

### Hardening Checklist

- [ ] Disable default admin account
- [ ] Named admin accounts only
- [ ] 2FA enabled for all users
- [ ] Auto-block after 5 failed logins
- [ ] Firewall: deny all, allow specific
- [ ] HTTPS only (disable HTTP redirect)
- [ ] Update DSM/QTS within days of release
- [ ] Disable unused services (Telnet, SSH if not needed)
- [ ] Security Advisor scan monthly

### SSL Certificates

```
Option 1: Let's Encrypt (free, auto-renew)
Option 2: Reverse proxy (nginx/Caddy handles SSL)
Option 3: Cloudflare Tunnel (no certs to manage)
```

### Firewall Rules

Only enable what you use:

```
SMB: LAN only (port 445)
NFS: LAN only (port 2049)
Web station: LAN or behind reverse proxy
Docker: LAN only unless reverse proxied
```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)