4 ms·

Not a great time price-wise to be building a NAS, but I have been doing so for the last two weeks. Inside a Jonsbo N6 case, which is pretty nice with an 8x SATA

by Confiks 3mo ago

Not a great time price-wise to be building a NAS, but I have been doing so for the last two weeks. Inside a Jonsbo N6 case, which is pretty nice with an 8x SATA backplane and drive bays (unlike the earlier Jonsbo variants). I ended up on shucking 4x the 14 TB WD Elements Desktop. They contain helium drives, the WD140EDGZ in my case, and are about a third cheaper than 4x the 12 TB WD Red Plus drives (which are air-filled). The shucking was easier than I expected too, and the performance seems very comparable. The warranty is a definite downside (European, so no Magnuson-Moss), but I think I can even get them back in their enclosure should they fail during the 2-year warranty period. I've put some second hand 256 GB M.2 SSDs in there as boot drives. It was a bit of a struggle to get it to work in a way that failure of one of the drives doesn't hold up booting, combined with LUKS, TPM keys and ZFS on root. Learned a lot about systemd-boot which I have never used before, but feels a lot saner to me than grub ever was. So now I have a large script which debootstraps a Debian based NAS into being. I noticed that there are a lot of ZFS myths and cargo culting. For example TFA mentions ECC RAM, which in some circles is a must-have because ZFS would wreck your pool during a scrub otherwise, which is a myth. It's also very expensive, especially this year. You also don't need much RAM for ZFS, L2ARC doesn't use much RAM at all, to name a few others. Still doubting about setting `dnodesize=auto` (which is the default), because there are some horror stories about that [1]. And it seems impossible to find a cloud storage provider with reasonable prices that supports `zfs send`. Rsync.net upped their minimum order to 10 TiB recently, which is far too much for my use case. [1] https://github.com/openzfs/zfs/issues/11353 https://github.com/openzfs/zfs/issues/11353 [2] https://www.rsync.net/products/zfsintro.html https://www.rsync.net/products/zfsintro.html

watermelon0 3mo ago
I've been thinking about building my own NAS as well. Mind sharing how much did you pay for those hard drives, and what motherboard did you choose?
- Confiks 3mo ago
  It was €329 per hard drive (through a reputable store), and I chose the ASRock B650M-HDV/M.2 mATX motherboard combined with a Ryzen 5 8500G. Stock CPU cooler, replaced the Jonsbo case fans with Arctic P12 Pro PST LN. I only slightly regret the PSU (MSI MAG A650GL), which could be quieter. Not that it's very noisy, and it's a great PSU otherwise, but I should've chosen one that just shuts the fan down at low power usage.
- conradev 3mo ago
  https://diskprices.com/ https://diskprices.com/ is great for this You have SATA or SAS to pick from. The CPU requirements for a storage server are not high. On a typical ATX board you have motherboard SATA and can put SAS controllers in the spare PCIe slots. My first "NAS" was two 22TB hard drives in a ZFS pool on my motherboard SATA
  - dapperdrake 3mo ago
    ATA (SATA), SCSI (SAS), and NVM (NVMe).
    - Brian_K_White 3mo ago
      no. just sata & sas. There is no nvme spinning drive and flash loses bits just from sitting, it's not archival. flash is good for working not for storing.
      - Dylan16807 3mo ago
        A NAS is plugged in. Flash works fine for it.
      - QuiEgo 3mo ago
        This is true, but if you use a file system that does scrubs (and you should use such a file system for a NAS), and if you keep the NAS on 24*7, this won’t be an issue.
  - sgt 3mo ago
    There should be more sites like diskprices. So refreshing to see no styling, no cookie banners, just pure information.
realityfactchex 3mo ago
> Not a great time price-wise to be building a NAS That under-states the matter. It is a terrible time, price-wise, to build a NAS. I'd almost rather have no AI whatsoever and have storage 1/10 the price of pre-AI times. (If there were a magical choice between having AI and significantly more expensive storage, and having no AI and some program to dump that investment money into getting and somehow leveraging significantly more available storage, that is.)
- bigstrat2003 3mo ago
  I would kill (figuratively, anyway) to have no AI whatsoever. No slop machine threatening to replace my job, or turn my job into babysitting its stupidity, and hardware would be reasonably priced? That would be awesome. AI has brought me nothing but downside.
  - dandanua 3mo ago
    But we now have trillionaires, aren't you happy about that? It means you might be the one some day too /s
    - i_idiot 3mo ago
      I immigrated wanting to become a millionaire. Never found time working my ass off. Now that I get pension and tokens from Musk and Zuck, I can finally try!
  - dotancohen 3mo ago
    AI has freed most people I know from the tedious job of writing actual emails and birthday greetings - leaving then more time to e.g. wash dishes or clean the floor. Seriously, if arts and creativity is what sets humans apart from other animals, then AI has almost completely displaced our capacity to even consider doing these activities ourselves. People reach for AI when they should be composing a birthday greeting themselves.
    - sgt 3mo ago
Hamuko 3mo ago
I'm also planning a new home server build now and the prices are definitely relatively ass. So far I've spent 820€ on two 22 TB WD Elements HDDs, 375€ on 2x16 GB DDR5 kit, and 520€ on two 2 TB M.2 SSDs (cache). About 1700€ and I still have no server to show for it. Doesn't help that I've been procrastinating on picking the CPU and motherboard.
Fr0styMatt88 3mo ago
I’m running an 8-drive ZFS RAIDZ2 pool. I’m wondering if you know — are the free space recommendations around ZFS cargo or real? Like I’m already giving up two full drives for redundancy (which saved my ass - I recently had two drives fail on me in quick succession — both SSDs from what looks like an identical batch) but then the advice is kinda saying I need to keep at least another drive worth of space free for the pool to perform well and not crap itself. That hurts with current prices for sure.
- gpt5 3mo ago
  ZFS will auto-degrade performance if there isn't enough headroom. In addition, if you use SSD, you also want the headroom, because otherwise you end up writing and rewriting on the same small empty space which kills SSD (unless you have enterprise SSD, which have built-in headroom).
  - gpt5 3mo ago
    Not sure why I'm being downvoted for being factually correct (and also, why I can't edit my above comment). ZFS will definitely degrade write performance gradually from 90% utilization, and will hit a stronger cliff at 95%+. Same with SSD, using a consumer SSD above 90%+ utilization would rapidly degrade its lifetime. The effect will be smaller for very large pools and very large files, but the effect is stil there. I'm repeating this so that people who set up these drives know what is actually going to happen.
    - 6581 3mo ago
      > Not sure why I'm being downvoted for being factually correct Maybe because your statement about SSDs is incorrect. Consumer SSDs have spare blocks too, and wear leveling prevents the scenario you're describing.
      - gpt5 3mo ago
        I appreciate the reply, but my warning consumer SSD is not incorrect. Perhaps I should have clarified that While they typically have a small overprovisioning of 7%, enterprise SSDs have close to 4 times as much, exactly to allow more writes (which is very relevant if running a ZFS raid on the drive). Keeping 10-20% headroom will prolong your SSD's life significantly, and increase performance of ZFS.
neilpanchal 3mo ago
> 4x the 14 TB WD Elements Desktop. I recommend staying away from SATA drives (huge consumer rush) and look for SAS drives on eBay, particularly HC520 Helium drives from HGST/WD. Need a SAS3008 PCIe adapter ($20) and a SFF-8643 splitter ($30). No backplane is required. Huge lots of decommissioned drives frequently appear. I bought Qty 10* of HC520 (12TB) SAS drives for $1000 about 3 weeks ago, avg age is about 2.5 years, still well within its rated lifetime. Yea may be some of the stuff is fear mongering and cargo culting. I was told ECC is necessary for ZFS. When the article was written, it was cheap af (2024) to buy ECC RAM so not much consideration was given to it. -- (*) I have no idea what to do with it. Anyone has any good idea for using 120TB space? I have about 40TB unused bandwidth in the datacenter, may be host a Debian mirror? Donate storage/bandwidth to Internet Archive? Please contact me, appreciate it.
- Confiks 3mo ago
  > I bought Qty 10* of HC520 (12TB) SAS drives for $1000 about 3 weeks ago, avg age is about 2.5 years, still well within its rated lifetime. That's cheap indeed. Enough headroom for some failing disks too. How is the noise and power usage? I didn't look at SAS drives at all, because my impression was that they're very noisy. I can place my NAS in a closed off room, but it's not too far away and I was afraid SAS drives would be audible through the wall. At the same time, the shucked drive I'm using presents itself as an WD Ultrastar, which comes very close to a SAS drive, and isn't very noisy.
  - neilpanchal 3mo ago
    > How is the noise and power usage? I think they're same as SATA drives, just different interface. AFAIK they have the same physical dimensions and same internals.
    - bobbob1921 3mo ago
      This reply is exactly right about using enterprise drives (hdd), and ideally SAS. Note the power usage of SAS vs sata for an identical drive make/model is very small sometimes 0.5 W to 1.5 W at idle (idle power draw is what matters for spinning HDD’s as underload it doesn’t increase much and idle is what you’ll be at 98% of the time). Also enterprise SSDs are much better than consumer SSD‘s for ZFS, and be aware that when you get above the 4 TB size SSD drives frequently use more power than HDD drives (i’m mainly referring to enterprise non-consumer level drives as that’s all I run for 100s of disks across many zfs systems over past 15 yrs). Also something people forget for home nas or figuring out cost for a nas, the power draw of the entire system times your electricity price you then have to multiply this times 2x to 4x times if your climate requires cooling air conditioning of any kind
ylyn 3mo ago
You assert that ECC RAM being necessary for ZFS is just a myth but provide no justification for why that is untrue. Is it not the case that if you don't have ECC memory, ZFS could end up writing a checksum that does not match the data if you get a bitflip in just the right (wrong) spot?
- naturalmovement 3mo ago
  > You assert that ECC RAM being necessary for ZFS is just a myth but provide no justification for why that is untrue. ZFS without ECC is no more risky than any other file system / software RAID without ECC. As no one owes you an explanation, it would take you five seconds to Google this and discover: 1. It's been disproven, with one of the original ZFS developers chiming in. 2. The original source of the rumor was a forum post that somehow became canon.
  - wpm 3mo ago
    What an incredibly rude comment
  - cormorant 3mo ago
    > five seconds to Google this and discover ...(after much longer) that it's a rabbit hole with nuance. https://news.ycombinator.com/item?id=18481910 https://news.ycombinator.com/item?id=18481910
- Confiks 3mo ago
  Yes, indeed. ECC RAM is better than non-ECC RAM, also for ZFS. The myth, popularized by a notorious thread on the TrueNAS forums [1], is specifically that ZFS requires ECC RAM, and will do worse than other filesystems without it, because scrubbing will multiply a single bitflip into a failed pool. A ZFS core developer says that that isn't the case [2]. Here's some more reasoning [3], also about many other myths. [1] https://www.truenas.com/community/threads/ecc-vs-non-ecc-ram-and-zfs.15449/ https://www.truenas.com/community/threads/ecc-vs-non-ecc-ram... [2] https://news.ycombinator.com/item?id=18480016 https://news.ycombinator.com/item?id=18480016 [3] https://kldload.com/zfs-wiki/myths https://kldload.com/zfs-wiki/myths
nuker 3mo ago
> combined with LUKS, TPM keys Does it work? Server can reboot and use TPM to unlock rootfs? What about /boot - encrypted and tamper proof? Resists evil maid attack? Rabbit hole, I know, but so fascinating if you solved it all :)
- Gigachad 3mo ago
  If you are worried about someone breaking in to your house and replacing the bootloader while leaving your drives in place I probably wouldn't use the TPM auto unlock even if in theory secure boot should be able to handle this. But in reality that will never happen and the only actual attack you need to be worried about is junkies breaking in and flogging the drives on facebook marketplace. For which, this level of security is fine.
  - nuker 3mo ago
    > junkies breaking in and flogging the drives For this you dont need TPM. Just a LUKS key in rootfs /etc. He said TPM :)
- toast0 3mo ago
  I run my cheap hosting box with a cleartext boot setup that uses ssh to automatically grab the key for the real root from my home server (or an alternate at my MILs house). Using FreeBSD, but similar concepts. A previous hoster once gave me someone else's drives without wiping them. I don't want random customers snooping around on my data if a similar mistake happens with my disks. For home use, I run without disk encryption. If I ever need to do data recovery, it's not going to be possible with encrypted disks and one point of a centralized NAS is to have stable long term storage.
- NekkoDroid 3mo ago
  > What about /boot - encrypted and tamper proof? Resists evil maid attack? > Rabbit hole, I know, but so fascinating if you solved it all :) Encrypting `/boot/` is the wrong thing to do. One can just replace it with something that logs the encryption key instead (and sends it off to somewhere). You actually need to verify that what you expect to be there is actually there and a encryption isn't gonna do that for you. A reasonably secure boot chain looks roughly as follows: bootloader is checked by the UEFI (read secure-boot), bootloader chain loads a signed UKI which also uses secure boot verification (or just skip the bootloader if you only have a single kernel with no fallback), this then loads a signed dm-verity `/usr/` which brings you to the login screen. Root is just data (e.g. mounted `noexec`) and is encrypted using e.g. PCR 11 so that it only unlocks if the UKI is the one that is expected (with some other backup unlock method). This is basically #2 of the "Design Goals" of Poetterings "Fitting everything together"[0]. It's a good read if you are looking to designing your own Linux image and are looking for some inspiration. There is ParticleOS[1] which somewhat dogfoods this kind of system, though I don't think it is anything remotely considered for a production system. [0]: https://0pointer.net/blog/fitting-everything-together.html https://0pointer.net/blog/fitting-everything-together.html [1]: https://github.com/systemd/particleos https://github.com/systemd/particleos
jsr0 3mo ago
Have you looked at https://zfs.rent/ https://zfs.rent/ for cloud storage? You have to provide your own drive, but the monthly cost is relatively low.
devy 3mo ago
Yep. The 4 Samsung SSD 990 PRO 4TB NVMe SSDs are $1100 apiece. Yikes! https://www.samsung.com/us/memory-storage/nvme-ssd/990-pro-pcie-4-0-nvme-ssd-4tb-sku-mz-v9p4t0b-am/ https://www.samsung.com/us/memory-storage/nvme-ssd/990-pro-p...
tomasff 3mo ago
> So now I have a large script which debootstraps a Debian based NAS into being. Is part of this publicly available? After seeing, - https://words.filippo.io/frood/ https://words.filippo.io/frood/ - https://0pointer.net/blog/fitting-everything-together.html https://0pointer.net/blog/fitting-everything-together.html I've been looking at setting something up with mkosi/systemd for my home server/NAS - it's interesting seeing how different setups are solving the problem for inspiration.

by Confiks 3mo ago

watermelon0 3mo ago

I've been thinking about building my own NAS as well. Mind sharing how much did you pay for those hard drives, and what motherboard did you choose?

Confiks 3mo ago
It was €329 per hard drive (through a reputable store), and I chose the ASRock B650M-HDV/M.2 mATX motherboard combined with a Ryzen 5 8500G. Stock CPU cooler, replaced the Jonsbo case fans with Arctic P12 Pro PST LN. I only slightly regret the PSU (MSI MAG A650GL), which could be quieter. Not that it's very noisy, and it's a great PSU otherwise, but I should've chosen one that just shuts the fan down at low power usage.
conradev 3mo ago
https://diskprices.com/ https://diskprices.com/ is great for this You have SATA or SAS to pick from. The CPU requirements for a storage server are not high. On a typical ATX board you have motherboard SATA and can put SAS controllers in the spare PCIe slots. My first "NAS" was two 22TB hard drives in a ZFS pool on my motherboard SATA
- dapperdrake 3mo ago
  ATA (SATA), SCSI (SAS), and NVM (NVMe).
  - Brian_K_White 3mo ago
    no. just sata & sas. There is no nvme spinning drive and flash loses bits just from sitting, it's not archival. flash is good for working not for storing.
    - Dylan16807 3mo ago
      A NAS is plugged in. Flash works fine for it.
    - QuiEgo 3mo ago
      This is true, but if you use a file system that does scrubs (and you should use such a file system for a NAS), and if you keep the NAS on 24*7, this won’t be an issue.
- sgt 3mo ago
  There should be more sites like diskprices. So refreshing to see no styling, no cookie banners, just pure information.

realityfactchex 3mo ago

> Not a great time price-wise to be building a NAS That under-states the matter. It is a terrible time, price-wise, to build a NAS. I'd almost rather have no AI whatsoever and have storage 1/10 the price of pre-AI times. (If there were a magical choice between having AI and significantly more expensive storage, and having no AI and some program to dump that investment money into getting and somehow leveraging significantly more available storage, that is.)

bigstrat2003 3mo ago
I would kill (figuratively, anyway) to have no AI whatsoever. No slop machine threatening to replace my job, or turn my job into babysitting its stupidity, and hardware would be reasonably priced? That would be awesome. AI has brought me nothing but downside.
- dandanua 3mo ago
  But we now have trillionaires, aren't you happy about that? It means you might be the one some day too /s
  - i_idiot 3mo ago
    I immigrated wanting to become a millionaire. Never found time working my ass off. Now that I get pension and tokens from Musk and Zuck, I can finally try!
- dotancohen 3mo ago
  AI has freed most people I know from the tedious job of writing actual emails and birthday greetings - leaving then more time to e.g. wash dishes or clean the floor. Seriously, if arts and creativity is what sets humans apart from other animals, then AI has almost completely displaced our capacity to even consider doing these activities ourselves. People reach for AI when they should be composing a birthday greeting themselves.
  - sgt 3mo ago

Hamuko 3mo ago

I'm also planning a new home server build now and the prices are definitely relatively ass. So far I've spent 820€ on two 22 TB WD Elements HDDs, 375€ on 2x16 GB DDR5 kit, and 520€ on two 2 TB M.2 SSDs (cache). About 1700€ and I still have no server to show for it. Doesn't help that I've been procrastinating on picking the CPU and motherboard.

Fr0styMatt88 3mo ago

I’m running an 8-drive ZFS RAIDZ2 pool. I’m wondering if you know — are the free space recommendations around ZFS cargo or real? Like I’m already giving up two full drives for redundancy (which saved my ass - I recently had two drives fail on me in quick succession — both SSDs from what looks like an identical batch) but then the advice is kinda saying I need to keep at least another drive worth of space free for the pool to perform well and not crap itself. That hurts with current prices for sure.

gpt5 3mo ago
ZFS will auto-degrade performance if there isn't enough headroom. In addition, if you use SSD, you also want the headroom, because otherwise you end up writing and rewriting on the same small empty space which kills SSD (unless you have enterprise SSD, which have built-in headroom).
- gpt5 3mo ago
  Not sure why I'm being downvoted for being factually correct (and also, why I can't edit my above comment). ZFS will definitely degrade write performance gradually from 90% utilization, and will hit a stronger cliff at 95%+. Same with SSD, using a consumer SSD above 90%+ utilization would rapidly degrade its lifetime. The effect will be smaller for very large pools and very large files, but the effect is stil there. I'm repeating this so that people who set up these drives know what is actually going to happen.
  - 6581 3mo ago
    > Not sure why I'm being downvoted for being factually correct Maybe because your statement about SSDs is incorrect. Consumer SSDs have spare blocks too, and wear leveling prevents the scenario you're describing.
    - gpt5 3mo ago
      I appreciate the reply, but my warning consumer SSD is not incorrect. Perhaps I should have clarified that While they typically have a small overprovisioning of 7%, enterprise SSDs have close to 4 times as much, exactly to allow more writes (which is very relevant if running a ZFS raid on the drive). Keeping 10-20% headroom will prolong your SSD's life significantly, and increase performance of ZFS.

neilpanchal 3mo ago

> 4x the 14 TB WD Elements Desktop. I recommend staying away from SATA drives (huge consumer rush) and look for SAS drives on eBay, particularly HC520 Helium drives from HGST/WD. Need a SAS3008 PCIe adapter ($20) and a SFF-8643 splitter ($30). No backplane is required. Huge lots of decommissioned drives frequently appear. I bought Qty 10* of HC520 (12TB) SAS drives for $1000 about 3 weeks ago, avg age is about 2.5 years, still well within its rated lifetime. Yea may be some of the stuff is fear mongering and cargo culting. I was told ECC is necessary for ZFS. When the article was written, it was cheap af (2024) to buy ECC RAM so not much consideration was given to it. -- (*) I have no idea what to do with it. Anyone has any good idea for using 120TB space? I have about 40TB unused bandwidth in the datacenter, may be host a Debian mirror? Donate storage/bandwidth to Internet Archive? Please contact me, appreciate it.

Confiks 3mo ago
> I bought Qty 10* of HC520 (12TB) SAS drives for $1000 about 3 weeks ago, avg age is about 2.5 years, still well within its rated lifetime. That's cheap indeed. Enough headroom for some failing disks too. How is the noise and power usage? I didn't look at SAS drives at all, because my impression was that they're very noisy. I can place my NAS in a closed off room, but it's not too far away and I was afraid SAS drives would be audible through the wall. At the same time, the shucked drive I'm using presents itself as an WD Ultrastar, which comes very close to a SAS drive, and isn't very noisy.
- neilpanchal 3mo ago
  > How is the noise and power usage? I think they're same as SATA drives, just different interface. AFAIK they have the same physical dimensions and same internals.
  - bobbob1921 3mo ago
    This reply is exactly right about using enterprise drives (hdd), and ideally SAS. Note the power usage of SAS vs sata for an identical drive make/model is very small sometimes 0.5 W to 1.5 W at idle (idle power draw is what matters for spinning HDD’s as underload it doesn’t increase much and idle is what you’ll be at 98% of the time). Also enterprise SSDs are much better than consumer SSD‘s for ZFS, and be aware that when you get above the 4 TB size SSD drives frequently use more power than HDD drives (i’m mainly referring to enterprise non-consumer level drives as that’s all I run for 100s of disks across many zfs systems over past 15 yrs). Also something people forget for home nas or figuring out cost for a nas, the power draw of the entire system times your electricity price you then have to multiply this times 2x to 4x times if your climate requires cooling air conditioning of any kind

ylyn 3mo ago

You assert that ECC RAM being necessary for ZFS is just a myth but provide no justification for why that is untrue. Is it not the case that if you don't have ECC memory, ZFS could end up writing a checksum that does not match the data if you get a bitflip in just the right (wrong) spot?

naturalmovement 3mo ago
> You assert that ECC RAM being necessary for ZFS is just a myth but provide no justification for why that is untrue. ZFS without ECC is no more risky than any other file system / software RAID without ECC. As no one owes you an explanation, it would take you five seconds to Google this and discover: 1. It's been disproven, with one of the original ZFS developers chiming in. 2. The original source of the rumor was a forum post that somehow became canon.
- wpm 3mo ago
  What an incredibly rude comment
- cormorant 3mo ago
  > five seconds to Google this and discover ...(after much longer) that it's a rabbit hole with nuance. https://news.ycombinator.com/item?id=18481910 https://news.ycombinator.com/item?id=18481910
Confiks 3mo ago
Yes, indeed. ECC RAM is better than non-ECC RAM, also for ZFS. The myth, popularized by a notorious thread on the TrueNAS forums [1], is specifically that ZFS requires ECC RAM, and will do worse than other filesystems without it, because scrubbing will multiply a single bitflip into a failed pool. A ZFS core developer says that that isn't the case [2]. Here's some more reasoning [3], also about many other myths. [1] https://www.truenas.com/community/threads/ecc-vs-non-ecc-ram-and-zfs.15449/ https://www.truenas.com/community/threads/ecc-vs-non-ecc-ram... [2] https://news.ycombinator.com/item?id=18480016 https://news.ycombinator.com/item?id=18480016 [3] https://kldload.com/zfs-wiki/myths https://kldload.com/zfs-wiki/myths

nuker 3mo ago

> combined with LUKS, TPM keys Does it work? Server can reboot and use TPM to unlock rootfs? What about /boot - encrypted and tamper proof? Resists evil maid attack? Rabbit hole, I know, but so fascinating if you solved it all :)

Gigachad 3mo ago
If you are worried about someone breaking in to your house and replacing the bootloader while leaving your drives in place I probably wouldn't use the TPM auto unlock even if in theory secure boot should be able to handle this. But in reality that will never happen and the only actual attack you need to be worried about is junkies breaking in and flogging the drives on facebook marketplace. For which, this level of security is fine.
- nuker 3mo ago
  > junkies breaking in and flogging the drives For this you dont need TPM. Just a LUKS key in rootfs /etc. He said TPM :)
toast0 3mo ago
I run my cheap hosting box with a cleartext boot setup that uses ssh to automatically grab the key for the real root from my home server (or an alternate at my MILs house). Using FreeBSD, but similar concepts. A previous hoster once gave me someone else's drives without wiping them. I don't want random customers snooping around on my data if a similar mistake happens with my disks. For home use, I run without disk encryption. If I ever need to do data recovery, it's not going to be possible with encrypted disks and one point of a centralized NAS is to have stable long term storage.
NekkoDroid 3mo ago
> What about /boot - encrypted and tamper proof? Resists evil maid attack? > Rabbit hole, I know, but so fascinating if you solved it all :) Encrypting `/boot/` is the wrong thing to do. One can just replace it with something that logs the encryption key instead (and sends it off to somewhere). You actually need to verify that what you expect to be there is actually there and a encryption isn't gonna do that for you. A reasonably secure boot chain looks roughly as follows: bootloader is checked by the UEFI (read secure-boot), bootloader chain loads a signed UKI which also uses secure boot verification (or just skip the bootloader if you only have a single kernel with no fallback), this then loads a signed dm-verity `/usr/` which brings you to the login screen. Root is just data (e.g. mounted `noexec`) and is encrypted using e.g. PCR 11 so that it only unlocks if the UKI is the one that is expected (with some other backup unlock method). This is basically #2 of the "Design Goals" of Poetterings "Fitting everything together"[0]. It's a good read if you are looking to designing your own Linux image and are looking for some inspiration. There is ParticleOS[1] which somewhat dogfoods this kind of system, though I don't think it is anything remotely considered for a production system. [0]: https://0pointer.net/blog/fitting-everything-together.html https://0pointer.net/blog/fitting-everything-together.html [1]: https://github.com/systemd/particleos https://github.com/systemd/particleos

jsr0 3mo ago

Have you looked at https://zfs.rent/ https://zfs.rent/ for cloud storage? You have to provide your own drive, but the monthly cost is relatively low.

devy 3mo ago

Yep. The 4 Samsung SSD 990 PRO 4TB NVMe SSDs are $1100 apiece. Yikes! https://www.samsung.com/us/memory-storage/nvme-ssd/990-pro-pcie-4-0-nvme-ssd-4tb-sku-mz-v9p4t0b-am/ https://www.samsung.com/us/memory-storage/nvme-ssd/990-pro-p...

tomasff 3mo ago

> So now I have a large script which debootstraps a Debian based NAS into being. Is part of this publicly available? After seeing, - https://words.filippo.io/frood/ https://words.filippo.io/frood/ - https://0pointer.net/blog/fitting-everything-together.html https://0pointer.net/blog/fitting-everything-together.html I've been looking at setting something up with mkosi/systemd for my home server/NAS - it's interesting seeing how different setups are solving the problem for inspiration.