Nginx Proxy Manager

Using the default charts in TrueNAS Scale, your application can only be exposed on a high port. Accessing your apps via such a weird port and without a proper domain isn’t cutting it. Is it? Therefore you can run a reverse proxy that manages TLS encryption and directs traffic for each subdomain to its respective app, without needing a special port in the URL.

Until now, I had always used a Traefik proxy when working with Kubernetes, but I found this cool project that seemed to fit perfectly. It’s called Nginx Proxy Manager, or NPM for short. With NPM, you can set up a reverse proxy and also manage your TLS certificates using Let’s Encrypt.

Installation

First of all, we can’t install this app the way we would normally install an app. It is in the default app catalog, but this version can only be hosted on port 9000. Instead, we’ll use the Docker image to deploy it. This won’t make any difference, but we can use our own IP address for it, which also means we can use all ports.

To start, go to the app catalog and click Custom APP in the top right corner. There, you can configure everything. I’ll provide the required settings below.

After installing the app, you can access it via its IP address on port 81. The default username is admin@example.comand the password is changeme. Change them immediately!

Setting Up TLS

Once everything is set up and you’ve changed your password, you’ll see something like this. First of all, I recommend setting up your TLS certificate if you have a domain. If you don’t have a domain, you can still upload a custom certificate.

Click on the SSL Certificates tab to see a list of all the certificates you’ve set up. If you click the button in the top right, you can create a new certificate. Here, you can choose between the Let’s Encrypt certificate authority or upload a custom certificate if you’re using a local domain. But if you can get a domain, I recommend doing so. I will proceed with the setup instructions for Let’s Encrypt.

If your server is reachable from the public internet, you just need to enter your domain name and agree to the Terms of Service. This will spin up a local webpage to verify that you actually own the domain you enter.

You can also set up a TLS certificate for all subdomains by entering *.example.com.

If your server is not accessible from the public or if you want to use another method, you can choose the DNS challenge. NPM has a couple of DNS providers which you can choose from. Take a look at the list and search for your DNS provider.

You just have to enter the API token or log in another way specific to your provider. NPM will then modify the DNS records to prove that you own the domain you have provided.

If you complete any of these methods successfully, you’ll get your SSL certificate.

Setting Up Your Apps

Now we want to configure the Nginx Proxy Manager to relay traffic from specific domains to a specific TrueNAS Scale app. To do this, go to Dashboard => Proxy Hosts.

Here, you’ll see an overview of all the hosts / apps you’ve configured. On the top right, you can add a new host.

In this window, you can finally configure access to your app. You need to enter the domain where you want your app to be available, choose the scheme (http/https) your app runs on (probably http)and enter the port your application uses.

The hostname of your app is its internal DNS entry in the Kubernetes cluster. It usually follows this pattern: <app-name>.ix-<app-name>.svc.cluster.local. So, for Jellyfin, it would be: jellyfin.ix-jellyfin.svc.cluster.local.

You can find the correct port in the app’s configuration or use the default port.

These are the values for your app running in TrueNAS Scale, not the values for accessing the app publicly!

I also recommend enabling Websocket Support and Block Common Exploits.

At this point, your app will be accessible via your domain, but one final step is needed to allow requests over HTTPS. You just have to go to the SSL tab and select the certificate we set up earlier.

After selecting your certificate, I recommend enabling all the available options (Force SSL, HTTP/2 Support, HSTS Enabled, HSTS Subdomains).

Once you click save, the host is set upand your app should be accessible via your domain and the HTTPS protocol.

If you want to point one domain to your Nginx Proxy Manager UI, you can just point it to http://localhost:81.

Footnotes

Hardware

(Looks a bit messy, I know 😅 But I somehow like it 😜)

As you can see, I am using an old PC as my server. This has the advantage that I only needed to buy the hard drives to support my storage needs, but the downside is that electricity consumption is rather high. Last time I measured with all my apps running, it consumed about 60W. A fresh build could be optimized for electricity consumption, which can save you a lot of money if you want the server to run 24/7. ¹

I chose not to do a hardware RAID because I am using the ZFS file system. I will explain this in detail in a dedicated part.

ECC memory?

I unfortunately do not have ECC RAM, but if you can get it, I would recommend it. Error Correction Code (ECC) RAM is able to correct wrong bits, which makes the system more secure against some hardware attacks and especially more reliable. It is not a complete dealbreaker not having it, (especially because it’s kind of rare in the consumer world at the moment) but having it is a nice addon.

Uninterrupted Power Supply (UPS)

I bought a UPS to support my server in case of power outages. The UPS has a battery that can keep my server alive for about 15 minutes, then it gives a signal to the server, which is configured to shut down before the UPS battery runs out. This ensures that most power outages never cause a problem, as they are shorter than the battery time and if the power is out for a while the server shuts down gracefully.

Why I chose TrueNAS Scale

Now to, in my opinion, the most important part: The operating system. I chose TrueNAS Scale for a couple of reasons. First of all I wanted something that is Open Source. I also wanted to run apps on the system and definitely needed some sort of RAID / software RAID. TrueNAS Scale has it all. It is based on Linux and led by the company iXsystems. ² For applications, it supports Docker and Kubernetes, as well as its own VMs. I am actually not really using the VMs yet, but I really like Kubernetes and also Docker. So this was great news for me. These technologies allow you to run basically any app you like on it because most apps are or can be containerized. In addition to this, the system uses OpenZFS as the file system, which is pretty cool in my opinion. We will take a look at it in the next part.

RAID

As I previously mentioned, I am not using a classical RAID system. Instead the ZFS file system which is used by TrueNAS Scale, has something similar to a software RAID built into it.

But first of all, to bring everyone on the same level, I want to explain what RAID actually is. RAID stands for Redundant Array of Independent Disks and as the name suggests brings redundancy into data storage. There are several versions of RAID (0, 1, 5, 6 are the most important ones). RAID 0 just stripes the data across multiple disks and does not provide any redundancy. RAID 1 mirrors every disk on another one so half of the disks could fail without losing any data. The last two versions are the important ones for this blog post. They both work similarly: First the data gets striped like in RAID 0, but a parity part is also calculated, which can be used to recover the data if a drive fails. With RAID 5 you can lose one disk without losing data and with RAID 6 you can lose two disks without an issue. The disadvantage of RAID is that you need more disks because of the redundancy.

OpenZFS

Now let’s talk about ZFS, which is an awesome file system in my opinion. It provides a set of features that make it especially interesting for server operation and other systems where correct data storage is important. A few of its features are RAID-Z (which I’ll discuss later), data compression, data deduplication, snapshots and self-healing. All of these features are very interesting for building a storage-focused server like the one I am building.

RAID-Z is the most important feature of ZFS in my opinion. It allows me to run the server without a physical RAID controller. It works a bit differently from RAID, which brings better performance and it also has the self-healing ability ZFS is known for, all while not needing a physical RAID controller anymore. This is actually only possible because there is no RAID controller and the file system can manage the disks directly. It is not recommended to use ZFS in addition to a hardware RAID because of that.

Setup of the OS

The installation of the OS is pretty straightforward. You can follow the installation guide on the developer’s website.

If you set everything up, this is how the web UI looks. Here you can control pretty much everything about the system graphically. In addition to the UI, I would recommend setting up an SSH connection so you can use the command line on your system. You can do that under credentials => users => upload SSH key.

Under datasets you can set up different folders with different permissions, purposes, shares and much more. You can decide if you want to encrypt your data (you want to 😉) and how you want to do it. There are two options. With the simplest option, a key gets generated and you just have to save it somewhere safe as a backup, while the server stores it securely. But if you are like me and a bit paranoid when it comes to disk encryption, you can also use a really strong password. The difference is that you have to enter this password after every restart. This provides the security that if your system is shut down, it is safe against a lot of hardware attacks.

How I move files

TrueNAS Scale provides you with a few kinds of file shares. I tried them all but did not really like any of them, which actually makes it a lot simpler for me. I am using SSH in my Gnome file explorer if I want to move files or I just do it over the command line. This works perfectly fine for me.

If you want to use shares, you are able to use SMB, NFS and iSCSI to do so. Just play around with it and see what you like most. For me, it’s the good old SSH.

What apps I run

Now to the most interesting part, in my opinion. I want to run apps that support me in my day-to-day life and provide value. This is why I do all of this.

TrueCharts and why I do not use them anymore

But first of all, we need to talk about TrueCharts. They are a pretty big third-party app catalog or at least they were for a very long time. They now said that they are going to drop support for TrueNAS Scale because they claim iXsystems will remove Kubernetes from the OS in a future update. I am not really sure about that because I haven’t read anything significant. But I think sticking with the original apps is not that bad either way. It’s a bit different to set up, but I will guide you through it here.

I also want to mention that I had a few problems using charts from TrueCharts. I do not want to blame them for it, but I think they are less stable than the original ones. But they have advantages like more settings and less performance overhead, so I think the guys from TrueCharts still did a really good job.

Install an app

I do not want to use file shares for everything. That is not very convenient. I want to use an app that works like all the other file cloud providers. This is why I host Nextcloud on my NAS. This is a really cool private cloud software that manages everything like files, contacts, calendars and the list goes on and on. I will talk a bit more about it in a future post. ³ But for now, let’s take a look at how to install an app like that.

The process is actually pretty simple. You can just choose your app from the catalog, which you can open with the discover button.

Here you can choose from many different apps or provide your own if you want to create something not in the default apps. If you have found an app you want to install, you can click on it and configure the app with everything the app allows you to change. Here the TrueCharts apps are a lot better because you can configure way more. But the default apps have a few settings as well and are much simpler. An important thing to keep in mind is that there is a limitation with the default apps, so you cannot use ports below 9000.

If you are finished with configuring, it is just as easy as pressing the install button. After a few minutes, the app is running and you can access it over the port you chose.

The End

You now know the basics of TrueNAS Scale. I hope you took a little bit of information from this post and I hope to see you in the next one of this series😄

There are many reasons someone would want to have a home server. In this post, I want to explain why I chose to build a home server and in the following ones, I will show you how I did it and how you can do it too.

Privacy and Independence

For me, there are a few main reasons why I wanted to get started with self-hosting. I think my journey began about two years ago in 2022 when I first played around with a Synology NAS. This helped me a bit with some of the goals I had. Having a Synology NAS improved my independence, especially from the big tech nightmares and therefore also improved my privacy. But after a while, I felt that something wasn’t quite right with this setup. First, the Synology software is not Open Source and therefore there are still privacy concerns. (I will cover why this is so important to me in a future post.) Also, Synology is a Taiwanese company and the situation with China was worrying me. (There would be a lot of bigger problems in tech, but it was still concerning.)

So the next step was building my own NAS / home server with custom Open Source software. I explain this in another post of this series. For now, let’s just say I built my own server about a year ago in 2023 and now I have all my data at home in an environment I trust and am able to control fully. So I achieved a lot of independence from the shady big tech companies.

Cost

Cost can be an advantage or disadvantage if you start to self-host. On one side, you have to pay for your hardware and the electricity your server consumes, but on the other side, you can cancel a couple of subscriptions which are also pretty expensive. For example, you are probably using some sort of cloud storage. (Or at least you should be using something like that in my opinion. ¹ )

Having a bit of data in such storage can have high costs. For example, buying OneDrive, which is included in the Microsoft Personal subscription, costs about $6.99 a month.² This price only includes 1TB. But if you have large amounts of data, this can get very expensive. To look at another example, Google’s cloud storage costs 9.99€ a month for 2TB.³ Other cloud storages, like a hosted Nextcloud, might even be more expensive.

You also have to keep in mind these are only costs for one service. On your server, you can host a couple of services you need and even share those and also the costs.

Because of all this, you save a bug in my opinion if you start self-hosting and replacing the services you pay for with your own server. But this can vary from person to person.

Just to mention it: OneDrive and a lot of other big tech tools scan your files for illegal content and use filters that might report you to law enforcement. These tools are known to make mistakes and so an image of your child on the beach can lead to your Microsoft account being suspended in the best case and a meeting with the local police in the worst case. Something like that will never happen if you are self-hosting. Be aware!

Knowledge

Another good point for having a home lab is all the knowledge you gain from it. You have to think about the hardware, set everything up physically, learn about RAID, about the operating systems and the software you are running, not to mention security and setting up a safe environment. There is a lot to learn on this journey!

And the good thing here is this is not a one-time thing. You can learn a lot as time goes on. Every now and then, if you feel motivated, you can play around with some settings or try something new.

This knowledge can also pay off in your job as you gain experience you maybe wouldn’t have otherwise. Personally speaking, I learned most of the things I know about IT, especially programming and DevOps, while building my own things. It is just way more motivating building the things you want than just learning by doing exercises you do not care about.

Helping others

Last but not least, I want to mention a small point I think is notable. If you are building all of this for yourself, it is really easy to give a few other people access to the services you are running. So you can help out your friends and family to have better privacy and generally speaking all of the benefits I was talking about. ⁴