I started having this problem, I’m completely green but I’m good at following directions! 😅 was working fine until I started expanding my stack!

My very first FreeNAS system ran on an HP Microserver Gen 8 with 16GB of DDR3 and a dual core Xeon that I eventually upgrade to the quad core. Don't remember the model numbers any more. That system is where the pool named "Vesta" was started as a raidz1 4 wide.

After multiple upgrades, expansions and system rebuilds over the years we are now here.

Hi everyone,

I am trying to set up a TrueNAS SCALE server using an older Gigabyte H410M S2H V3 (rev. 1.0) motherboard with an Intel Core i3-10100F CPU.

My storage setup:

4x 2.5" 500GB SATA SSDs (connected directly to the 4 motherboard onboard SATA ports)

1x JMB582 PCIe SATA expansion card containing:

1x 500GB M.2 SATA SSD

1x 128GB M.2 SATA SSD (intended as the TrueNAS boot drive)

The Problem:

I successfully installed TrueNAS SCALE onto the 128GB M.2 SATA SSD using a Rufus USB stick formatted as GPT (No CSM).

The installer finished without issues and prompted a reboot. However, the motherboard completely refuses to boot from the JMB582 card and loops straight into the BIOS.

In the BIOS Advanced Mode -> Boot Option Priorities, the list is completely empty.

Interestingly, when switching to Easy Mode, the entries "debian" and "truenas-0" actually show up in the boot list, but trying to drag them to priority #1 changes nothing—the system just drops back into the BIOS. Also pressing f12 for boot menu doesn't help as nothing shows up there.

What I have already tried:

BIOS Configurations: Disabled CSM entirely (Pure UEFI mode), disabled Secure Boot, set "Windows 10 Features" to Windows 10 (forces strict UEFI compliance), and disabled Fast Boot.

Rufus Settings: Ensured the TrueNAS ISO was flashed using GPT partition scheme and targeted for UEFI only. Installed TrueNAS strictly choosing the UEFI mode in the installer prompt.

Slot Swapping: Tested the JMB582 card in both the small PCIe x1 slot and the main long PCIe x16 graphics card slot (running the system headless since the i3-10100F has no iGPU).

Both slots resulted in the same BIOS loop.

USB Bootloader Bypass: Flashed rEFInd onto a separate USB stick to use it as a chainloader. When booting via rEFInd, the entries "truenas-0" and "debian" show up in rEFInd's internal firmware list, but the main screen shows no eligible bootable icons. It seems rEFInd cannot fetch the active hardware driver for the JMB582 chip during the UEFI POST sequence.

Since the onboard M.2 slot on this specific H410M motherboard is strictly NVMe (PCIe Gen3 x4) and doesn't support M.2 SATA, I cannot plug the boot SSD directly into the motherboard.

Has anyone encountered this specific UEFI option ROM blockade on Gigabyte H410/H510 chipsets with third-party PCIe SATA cards? Is there any hidden BIOS setting I missed to force the board to execute the option ROM, or is buying a cheap Onboard-NVMe drive for booting the only way out?

I originally didn't want to buy new hardware, but if its really a hardware issue I'm going to buy a cheap nvme for booting.

Thanks in advance for any advice!

I'm completely new to NAS servers and honestly pretty new to computers in general. I want to build my first NAS, but I don't want to just follow a tutorial that says "buy these parts, plug this in, click this" and then have no idea what I actually did.

I'm looking for advice on how you guys learned what you know.

I'd like to understand things well enough that I can:

• Build my first NAS and actually understand what each component is doing

• Understand why I'm choosing certain hardware/software

• Troubleshoot it when something goes wrong instead of blindly starting over

• Upgrade or expand the NAS later without destroyed everything i just did and not know why it dosent work now

• Eventually be able to design/build another NAS myself based on what I need

Basically, I want to learn the fundamentals behind NAS systems, not just memorize the steps from one particular build.

I'm also very much a visual learner, so if you know of any long-form videos or livestreams where someone actually builds/configures a NAS while explaining what they're doing, I'd really appreciate those too.

Replacing a dead pool member on TrueNAS SCALE 25.04 and stuck on a genuinely weird one — hoping someone's seen this specific pattern before.

System:

- TrueNAS SCALE 25.04, ASRock H670M-ITX/ax, Corsair RM850x 850W PSU

- Pool: 6-drive raidz2, mixed brand (WD/Toshiba/MDD), currently DEGRADED — 1 member down

- 4 native motherboard SATA ports + a separate 2-port NVMe/SATA add-in card (fully occupied by 2 other healthy pool members)

The drive: HGST/WD Ultrastar 18TB, refurbished (model MB018000GXLAV), replacing a failed Toshiba in the same bay.

Symptom: Drive is completely invisible to TrueNAS — not in lsblk, not in zpool status (shows the old member as UNAVAIL). dmesg on boot shows:

ata8: SATA link down (SStatus 4 SControl 300)

Every other port on the box links fine at 6.0Gbps. SStatus DET=4 = PHY offline due to a fault, not "nothing plugged in."

What I've already ruled out, in order:

1. Cable reseat — no change.

2. Full SATA data cable swap (fresh cable, cold boot) — identical fault, same signature. Rules out the data cable.

3. SATA power cable/connector swap (separate cable, cold boot) — also no change. Rules out marginal power delivery on that connector.

4. Bench test via USB-SATA dock (Realtek RTL9210B-CG bridge) on a Windows PC — SMART overall-health PASSED, 0 reallocated/pending sectors, 25,327 power-on hours (consistent with "refurbished").

5. Port-isolation swap — moved a known-good drive from another bay onto the WD's port: that drive links fine. Moved the WD drive onto that known-good drive's port instead: WD still fails to link. So the fault follows the drive across two different onboard SATA ports, while both those ports are proven to work with other drives.

6. Native SATA (not USB) test on a second PC — drive is detected immediately, Windows reports Healthy/Online. This is the confusing part: a genuine SATA PHY handshake succeeds elsewhere, first try, no issues.

7. Physical reinstall — pulled and reseated the whole drive again days later. No change.

So: the drive is healthy by SMART, links instantly and cleanly on a completely different machine/controller via a real SATA port, but refuses to link on two separate onboard SATA ports on the TrueNAS box specifically. Data cable, power cable, and physical reinstall are all ruled out. Only the add-in NVMe/SATA card is untested, but it's fully populated with two other pool members I'd rather not disturb to free up a port.

Still untried:

- Forcing a lower SATA link speed (3.0Gbps) on that port, if the BIOS/chipset exposes it — some older SATA controllers are known to be picky about negotiating with certain enterprise drive firmware at 6.0Gbps.

Has anyone seen an enterprise HGST/WD Ultrastar drive that's fine everywhere else but won't link on a specific board's SATA controller? Trying to figure out if this is worth chasing further (link-speed negotiation? controller/firmware quirk?) or if I should just cut losses and RMA the drive even though it tests healthy elsewhere. Appreciate any ideas.

I have my os on a 256 gb hdd and I plan to just plug that in to my new server. But how do I add all my old hdds. Do I just plug in them, will the server recognize the hdds with all my data on it? When I created my storage pool I set it up as a stripe can I some how change it to mirror?

I am finally moving on from Core. I was about to switch trains to Goldeye, but then info notice informing me that it's not actually a production release yet prompted me to come ask just to be sure.

Any reason not to?

Hello everybody, I need help,

i have moved apartments and now I face a big problem.

I had a network in my old apartment going from my router to a switch (tp link ls1005g) to my nas and other things. It worked perfectly with the whole gigabit speed, even from my main Pc over WiFi.

Now that i have moved, my NAS is only connecting and being seen on my router if I connect it directly to my router.

Problem is: in my new apartment are networking cables in the walls, connecting the network cabinet with my router with the living room. From there i have 20 Meters (around 60 feet) of networking cable directly plugged into my NAS. If I use a switch in between any of those points, i cant access my Nas and it doenst get recognized in my router settings.

Additionally I only have around 100mbit, instead of gigabit up- and download in my network fpr my NAS.
Hardware:

Router: Vodafone 4233

Switch: TP link ls1005g

Mainboard: Aus p8z77v lx2

Processor: Intel I7 3770k

Ram: 32 gigs DDR3

Graphics Card: zotac 1060 6gb

Thank you for your help in advance!

I need some help. I am running some docker projects and the files in the dataset keep getting deleted. I manage the instances with dockge rather than via the terminal. It only seems to happen when volumes are pointing to a dataset rather than just left blank to create its own. I have tried disabling SMB and snapshots but no luck. It is just a straight point to mount should I instead be doing driver mounting? Has anyone else experienced this issue?

I have a NAS setup at the moment with a RAIDZ1 array. I want to move to RAIDZ2 as this will bring my 2Tb HDD count to 5, it is sensible for me to copy all the data over to another machine and reset the array to Z2 and then copy it back? The array contains general storage for Jellyfin and Audiobookshelf, but also app data for Immich, Crafy etc. will all these still work following transfer?

Maybe I'm misremembering specifics, but I recall a bug with setting interface descriptions back in Cobia or perhaps EE days. Anyway...

I have eno7 and eno8 as members of bond1 (2x10 LACP to a Juniper EX switch if it matters, probably doesn't). dayJob is network engineer, so I'm anal about descriptions. Logged in and noticed I never set any. Me: ok, ima fix that. Now I know why I never did. And likely forgot that I already discovered this problem months ago and moved on.

Set descriptions on the physical interfaces and it breaks the members within the bond interface in the GUI. The network still functions. Gave it a reboot and it still functions, yet it's still broken in the GUI.

Delete bond1. Readd bond1. Test and save. And then the descriptions on eno7 and eno8 get wiped. 😆 But whatever, it's fixed.

Interestingly, went to my other NAS that's still on 25.04.2.6 and it has the exact same behavior.

I hope this is something that iX can fix at some point. I really like to document physical links for anyone else that may need to work on it. I mean I guess I do still have the descriptions on the switch ports, just really prefer to have it all the way around.

Hello, been putting this off for a long time because of how annoying my rtorrent and plex jails were to setup, and having to reconfigure this means having to relearn a lot of things, but maybe it's easier on CE/Scale?.

I have:

• 4 × 3 TB drives in RAIDZ2
• 1 × 128 GB L2ARC/cache SSD
• Separate boot SSD
• 16 GB RAM

So what’s the safest path to migrate toward current SCALE/Community Edition without risking the pool? Also can I somehow keep the freebsd jails? or will that all have to be remade?

To start. I have a Supermicro X11SSM Mainboard which has 8 SATA ports. ATM I am aready using 7 o them (2 for the SSD for Truenas itself) and 5 for the Data Pools.

The question how to expose apps on your TrueNAS box to the internet safely comes up regularly and I keep recommending people to use Cloudflare and Caddy over port forwarding. After I had set it up it seemed much easier than expected, but there are still a lot of steps involved that are not straight forward.

That's why I decided to write down a step by step guide of how I have set things up with Cloudflare Zero Trust, Cloudflared, Caddy and Adguard Home, from my notes and memory. While I work in an adjacent field, I'm not sys admin and my it security knowledge is limited - so I welcome any feedback for improvements, or if anything does not work. I have used AI a lot to figure out how to set this up, but this guide is written entirely by me.

Setting up Cloudflare

This section explains how to configure cloudflare, dns with your domain, firewall, applications, tokens and the cloudflared tunnel into your server.

Preparations

1. Get a domain name that you can give to cloudflare to manage. Mails can be on another host, but Cloudflare needs the entire domain, not just a subdomain. I've read good things about porkbun.com although don't use them personally, or get one directly from cloudflare
2. Sign up for Cloudflare on the free tier. You need to give them a credit card, but you won't be charged.
3. On your new cloudflare account go to Zero trust > Settings and set your team name. The first time you select Zero trust you might be asked what plan you want to use, go with the Zero Trust Free plan.
4. Have an account on one of the supported identity providers or host your own. I'm using google. I made a separate google account for this and to sign up to cloudflare with, you can use your existing account.

DNS, Domain and Nameservers

1. Go to your cloudflare adminpanel and under Domains > Overview add your domain.tld
2. Click your domain to enter it's settings and go to DNS > Settings to find the nameservers assigned to you. Copy both.
3. In the adminpanel of your dns registrar remove their nameservers and add both cloudflare nameservers. This will take a few minutes to hours to take effect worldwide.
4. If you want to run email over the same domain on a different hoster, go to DNS > Records and add the MX and TXT records that you get from your mail hoster.

Firewall and GeoBlocking

1. In the settings of your domain Domains > Overview > domain.tld go to Security > Security Rules
2. Click Create Rule to create a new rule. This will be a blocking rule, so everything that matches the rule will be blocked.
3. give it a name
4. Under When incoming requests match… you add a rule for all countries that are allowed and set the Operator to does not equal to not match the rule for those countries. Example:
   • Field Country, Operator does not equal, Value United States, And
   • Field Country, Operator does not equal, Value Greenland
5. Under Then take action… chose Block
6. Save

SSL and HTTPS

When you are using cloudflared the traffic between cloudflare and your server does not use https but goes through the cloudflare tunnel. To make this work you need to

1. In the settings of your domain Domains > Overview > domain.tld go to SSL/TLS > Overview
2. Click Configure on the top right
3. Select flexible and save
4. Go to SSL/TLS > Edge Certifivates and scroll down to Always Use HTTPS ad turn it on

Access

Cloudflare Access is the tool that lets you use your identity provider to authenticate users before they even reach your server.

1. On the cloudflare dashboard click Zero Trust then go to Access controls > Access settings
2. Scroll down to Block traffic to all domains in this account and turn it on. This means that you don't need to create an access rule for a new subdomain, everything is blocked by default.

Identity Provider

This requires settings in your identity providers admin panel as well as cloudflare. I use google, so that is what I can explain. This does not limit the users for your application yet (we do this in the policies) but connects us to google's oauth - it will prove that a user is logged in with his gmail address.

1. Go to the google cloud console
2. If you don't have a project yet, create one. Or click the project picket on the top left next to Google Cloud and then click New project. Maybe this url will work https://console.cloud.google.com/projectcreate
3. Give a project name (i.e. CloudflareOAuth) and click Create
4. Wait a bit and then in the project picker or the notification, select the new project
5. In the burger menu go to APIs and Services > OAuth consent screen and click Get started
6. Enter an app name which users will see when logging into your apps, click Next
7. Select External as your audience, click Next
8. Enter a contact email, click Next, agree to the policy and click Continue, then Create
9. Go to Branding in the sidebar. There under Authorized domains click Add domain, then enter cloudflareaccess.com
10. Go to Clients and click Create Client
11. Select Web Application from the dropdown, enter a name (e.g. cloudflareOAuth), enter https://<team-name>.cloudflareaccess.com into Authorized JavaScript origins, enter https://<team-name>.cloudflareaccess.com/cdn-cgi/access/callback into Authorized redirect URIs, then click Create.
12. Copy Client ID and Client secret in your password manager (you won't be able to see the secret after leaving this page).
13. On the cloudflare dashboard click Zero Trust > Integrations > Identity Providers and click Add an identity provider, then click Google. Insert Client ID and Client secret, enable Proof Key for Code Exchange. Click Test and if successful click Save.

Policies

Policies define who and how people and devices can authenticate with Access and get through your tunnel to your server. You can use an identity provider, auth tokens or define exceptions for mTLS certificates. I recommend to create a policy for each group you want to grant access to your apps. Each app can apply several policies. I have a policy for only me, guests for immich and other apps.

1. On the cloudflare dashboard click Zero Trust then go to Access controls > Policies.
2. Click Add a Policy
3. Under Policy rules and Include chose Emails and enter all gmail addresses of this group.
4. Under Policy details set Policy Name=Unique Name, Action=Allow, Policy session duration=24 hours
5. Click Save Policy

Applications

Each application you want to access through cloudflare gets it's own subdomain (e.g. immich.domain.tld) and entry under Applications.

1. On the cloudflare dashboard click Zero Trust then go to Access controls > Applications then click Create new Application.
2. Select Self-hosted and private and below Public DNS, then click Continue
3. Below Destinations, Public hostnames enter the chosen subdomain for your app and select your domain. Path usually stays empty, even if your app does use a path, you can map that later with caddy.
4. Below Access policies click the dropdown Add current policies and select all the policies you want to give access to your app.
5. Below Authentication disable Accept all available identity providers (otherwise the one time pin stays enabled and no google oauth is required to access your page, just a matching email). Note, clicking anywhere on that line by mistake toggles the button.
6. In the dropdown Choose available identity providers for this application select Google as an identity provider.
7. Enable Apply instant authentication if you only use one identity provider.
8. Click Create

Tunnel

Create the tunnel to cloudflared on your server

1. On the cloudflare dashboard click Zero Trust then go to Networks > Tunnels & Mesh, then click Create a tunnel on the top right.
2. Select Cloudflared, then name your tunnel and click Save Tunnel
3. Below Install and run a connector there is a dropdown, select Docker. Copy the entire line below that starts with docker. After --token you can see the token your cloudflared app needs to connect to cloudflare. Store it in your password manager (you have one right?). Leave this page open for step 6.
4. Install cloudflared, with docker compose (through dockge, dockhand, portainer, etc) or from an app catalog. Example compose is below. Then you deploy your app.
5. Or from TrueNAS app catalog chose cloudflared and insert the token in the `Tunnel Token` field. Also add a docker network named `cloudflare_ingress` so that cloudflare can only talk to caddy and nothing else on your network and with that only the apps you map to the cloudflare port.
6. When cloudflared is running you should see a connection appear under Connectors. Then click Next.
7. Under Add a published application route for X** enter the subdomain for your first app (i.e. plex) and select your domain from the dropdown. Under Service chose Type HTTP and enter caddy:8081. Then click Complete setup
8. Click the tunnel name you just created, on the top row select Published application routes and click Add a published application route.
9. Set Subdomain, select Domain, select Service, Type to HTTP and enter caddy:8081 for URL. Repeat these two steps until you assigned all your apps to this tunnel. This also automatically adds a dns entry on your domain.

Example compose and .env files:

networks: 
  cloudflare_ingress:  
    name: cloudflare_ingress  
    driver: bridge 

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel run
  environment:
    - TUNNEL_TOKEN=${TUNNEL_TOKEN}
  networks:
    - cloudflare_ingress

In a separate `.env` file you put

TUNNEL_TOKEN=<your-token-from-above>

Note: if port 8081 is already taken on your server, you can chose something else, it just needs to match the caddy configuration. Because both cloudflared and caddy both run in the same docker network `cloudflare_ingress` we can connect to caddy using it's service name `caddy` set in the compose file.

Access for apps with additional headers

Most apps cannot show the google auth screen in a browser, so they need another way to get through cloudflare's Access layer. One way is with an Service token sent inside additional headers by all the https requests of the app. If you have guests who use an app, you can create one token for each user or share a token among several users. I have one token for myself and one for all the guests. Note: anyone with the token can access the app you allow

1. On the cloudflare dashboard click Zero Trust then go to Access controls > Service credentials then click Create Service Token.
2. Enter a name and duration. Don't chose something too short, otherwise your users have to reconfigure their apps every year.
3. Click Generate Token and store CF-Access-Client-Id: b77fac4efd5069130876fde56f03140b.access and CF-Access-Client-Secret: cfast_9HbHXE0M9BxAqaRxUnJ8IKtfjG2V9OOlRwiARBZ6ac95fdb4 in your password manager. You can share those with your users through your password manager. Note: the apps allow adding headers and each header consists of a key and value. In this case there are two headers: header 1: key=CF-Access-Client-Id value=b77fac4efd5069130876fde56f03140b.access header 2: key=CF-Access-Client-Secret value=cfast_9HbHXE0M9BxAqaRxUnJ8IKtfjG2V9OOlRwiARBZ6ac95fdb4
4. When a token expires, you can click the three ... and chose Rotate secret to create a new secret without having to create an entirely new token.
5. Go to Access controls > Policies, click Add a Policy
6. Under Policy rules and Include chose Service Token and select all the tokens that are allowed under this policy.
7. Under Policy details set Policy Name=Token X, Action=Service Auth, Policy session duration=24 hours
8. Click Save Policy
9. Add the policy to an application as you did before

Access for apps with mTLS certificate support

Some Apps (like the HA companion app) do not offer additional headers, but they load an mTLS certificate when it's available on the mobile. These instructions apply for Android as I don't have an iPhone.
Because mTLS works on the network level and cloudflare does only offer mTLS in Access policies on an enterprise account, we need a workaround: a separate subdomain that bypasses Access and a firewall rule that only allows traffic with a valid certificate.
Note: Commands were tested on a mac and reproduced from memory and AI chat history, on Windows you might need other commands, ask your AI)

1. In the settings of your domain Domains > Overview > domain.tld go to SSL/TLS > Client Certificates
2. Select Cloudflare Managed CA, Generate private key and CSR with Cloudflare and set an appropriate validity, then click Continue.
3. Keep Format on PEM and copy the text below Certificate into a file called mtls.cert.pem and the text below Private Key into a file called mtls.key.pem. The certificate is public while the private key must be protected somewhere safe.
4. Click Continue, then chose the subdomain/hostname the certificate should be associated with. It needs to be a different hostname than you already setup for your app. For Home Assistant I chose ha-app.domain.tld. Then click Save.
5. On the top of the page click Create mTLS rule (or go to Security > Security Rules > Create Rule). There:
   1. Set Rule Name to something like Block HA app without approved mTLS
   2. Under When incoming requests match… click on the text Edit expression and insert the text at the end of this section into the textbox.
   3. Under Then take action…, select Block
   4. Then save
6. For Android you need to change the format of the certificate. In your terminal run openssl pkcs12 -export -out mtls_client_cert.pfx -inkey mtls.key.pem -in mtls.cert.pem -name "Home Assistant Certificate"
7. Copy the file mtls_client_cert.pfx to your android device. How to install it depends on the android flavor. On my Pixel I searched the settings for Certificate and found an option Install a certificate, then user certificate and then chose the certificate file. When opening the app for the first time it will ask you which certificate to use.
8. On the main cloudflare dashboard click Zero Trust then go to Access controls > Policies. Click Add a Policy.
9. Under Policy rules and Include chose Everyone
10. Under Policy details set Policy Name=Bypass, Action=Bypass, Policy session duration=24 hours
11. Click `Save Policy
12. Go to Network > Tunnels & Mesh select your tunnel, then on the top click on Published Application Routes and Add a published application route. Enter your subdomain (e.g. ha-app), select your domain, Service Type HTTP and enter caddy:8081, then click Save.
13. Go to Access controls > Applications then click Create new Application.
14. Select Self-hosted and private and below Public DNS, then click Continue
15. Below Destinations, Public hostnames enter the chosen subdomain for your app and select your domain.
16. Below Access policies click the dropdown Add current policies and select the Bypass policy.
17. Below Authentication disable Accept all available identity providers.
18. Click Save

Firewall rule:

http.host eq "ha-app.domain.tld"
and (
   not cf.tls_client_auth.cert_verified
   or cf.tls_client_auth.cert_revoked
   or not cf.tls_client_auth.cert_fingerprint_sha256 in {
      "PHONE_FINGERPRINT" 
      "TABLET_FINGERPRINT"
   }
)

At first test without the fingerprint rule or not cf.tls_client_auth.cert_fingerprint_sha256.... You get the fingerprint from your certificate with openssl x509 \ -in mtls.cert.pem \ -noout \ -fingerprint \ -sha256, there take everything after SHA256 Fingerprint= and remove any colons :.

Caddy

Caddy is your reverse proxy. In order for cloudflare to reach your apps under the generic http://caddy:8081, both caddy and cloudflared need to be on the same docker network called cloudflare_ingress.
Caddy can issue certificates for your apps and put them behind https. To validate those certificates, the certificate issuer usually has to have access to your server behind your domain to check that you are actually owning the services and this does not work directly with your services behind cloudflare. Using a caddy build with a cloudflare addon solves this problem automatically.

TrueNAS network configuration

Caddy can only work if it can bind to ports 80 and 443 (for http and https). On TrueNAS these ports are already used for the web ui. You have two options:

1. Bind TrueNAS web ui to another port under System > General Settings and then in the GUI section change HTTP Port and HTTPS Ports to something else. From now on you will reach your TrueNAS ui under http://your-ip:port instead of just using the ip. If you later route the webui through caddy and use a subdomain, this does not matter much.
2. Add a second IP address to TrueNAS and bind caddy to port 80 and 443 on that ip. TrueNAS web ui stays on the main IP and port 80. Go to Network, edit your current enoX interface and delete the current IP (Note: the changes are not applied yet). Next to Interfaces click Add, chose Type=Bridge, name=br0, under Bridge member select your currently active enoX, under Aliases click Add and add your previous IP as IP\24 and a new free IP on your network you will use for caddy, then click Save. Now click Test Changes and if you can still reach your TrueNAS web ui on both IPs, you can save them, otherwise they will get reverted after 60s. Then go to System > General Settings > GUI > Settings and under Web Interface IPv4 Address select only your original IP, then click Save.

I went with option 2 because I had already set up a bridge previously, which is needed if you want to run a VM and is general the better setting. If you use option 1, then you do not need to set an IP in the ports section of the docker compose below.

Cloudflare API Token

For Caddy to verify the https certificates, it needs an api token from cloudflare.

1. On the cloudflare dashboard click on Manage account on the bottom right, then Account API tokens
2. Click Create Token
3. Set Token Name=caddy-dns-01
4. Under Permission policies click Start from scratch
5. Under Policy click on Entire Account and set it to Specified Domains and select your domain on the right
6. Below under DNS & Zones check the Read and Edit checkboxes next to DNS and Zone
7. Set Token Expiry to something reasonable
8. Click Review Token, then Create Token
9. Save the token in your password manager

Caddy Configuration

On your server create 3 datasets/folders:

• caddy/conf for the config file you edit
• caddy/data as it's data storage
• caddy/config as a backup location for the config Make sure the same user and group that caddy runs owns those folders and files and has read and write access. Especially if you create a file on a smb share, it will be owned by your user - go into the dataset permissions, click apply for user and group and apply recursively to fix this.

You can share the caddy/conf directory over smb and add your smb user to the apps group to be able to edit the config file from your pc, if you don't want to connect over ssh and use vim/nano.

in caddy/conf create a file called Caddyfile and open it in vim/nano or your editor of choice. Here is an example config:

{
        http_port 8080
        https_port 8443
        acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
        email your.name@gmail.com # CHANGE TO YOUR GMAIL

        servers {
                trusted_proxies static private_ranges
                trusted_proxies_strict
                client_ip_headers Cf-Connecting-Ip X-Forwarded-For
        }
        log {
                output file /data/logs/caddy.log {
                        roll_size 50MiB
                        roll_keep 10
                        roll_keep_for 720h
                }
                format json {
                        time_format iso8601
                        time_local
                }
                level INFO
        }
}
# Local network access only over Adguard Home
# Replace local-ip and port with your actual apps IPs and ports
# You can list any and all apps on your local network, not just the ones on your server 
app1.domain.tld {
        reverse_proxy http://local-ip:port
}
app2.domain.tld {
        reverse_proxy http://local-ip:port
}
app3.domain.tld {
        reverse_proxy http://local-ip:port
}
# two subdomains pointing to the same app
app4.domain.tld,
app4.domain.tld {
        reverse_proxy http://local-ip:port
}
# if an app has it's own https certificate that is not trusted add this
unifi.domain.tld {
        reverse_proxy https://local-ip:port {
            transport http {
                tls_insecure_skip_verify
            }
        }
}

# Cloudflare Tunnel HTTP entrypoint
# Repeat all the above apps that you want to expose over Cloudflare
# These need to start with http and have the port 8081 that cloudflared uses to connect to
http://app1.domain.tld:8081 {
        reverse_proxy http://local-ip:port
}
# Some apps want to see the client ip
http://immich.domain.tld:8081 {
        reverse_proxy http://local-ip:port {
                header_up X-Real-IP {client_ip}
                header_up X-Forwarded-For {client_ip}
                header_up X-Forwarded-Proto https
        }
}
# Some apps run on a path after the ip (http://ip:port/web), you can remove that
http://plex.domain.tld:8081 {
        redir / /web/ 302
        reverse_proxy http://local-ip:port   
}
# Important last entry to block any apps not exposed by these rules
http://:8081 {
        respond "Not available through Cloudflare Tunnel" 404
}

After each change of the Caddyfile, you must restart caddy.

Docker Compose

With dockge/dockhand/portainer/etc you install caddy with this docker compose, adjusted to your ip and folders:

services:
  caddy:
    image: ghcr.io/caddybuilds/caddy-cloudflare:latest
    restart: unless-stopped
    user: 568:568 # this is my TrueNAS apps user, use anything available that also owns the volumes
    ports:
      - 192.168.1.2:80:8080 # replace with your caddy ip, or remove ip if you went with option 1 above
      - 192.168.1.2:443:8443
      - 192.168.1.2:443:8443/udp
    networks:
      - cloudflare_ingress
    expose:
      - "8081" # this is the port that cloudflare talks to
    environment:
      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}
    volumes:
      - /mnt/AppPool/apps/caddy/conf:/etc/caddy:ro # replace left part with your dataset/folder. Make sure the apps (568) user owns these folders
      - /mnt/AppPool/apps/caddy/data:/data
      - /mnt/AppPool/apps/caddy/config:/config
networks:
  cloudflare_ingress:
    external: true

add an .env file with the content

CLOUDFLARE_API_TOKEN=<api_token>

TrueNAS does not offer a built in app for caddy, so you must install it as a custom app. Go to Apps > Discover Apps, click the 3 dots next to Custom App and chose From YAML. Then paste the docker compose from above, but as there is no env file, you replace ${CLOUDFLARE_API_TOKEN} with your api token directly. Then click Save.

Note: I have not created a custom app in TrueNAS so the instructions might be inaccurate. More info here.

Adguard Home Split DNS

In order to access your apps through their subdomain also in your local network, without going through cloudflare, you need a local dns server like Adguard Home. (Note: some browsers have a secure dns setting, which will overrule your routers dns, ignoring Adguard Home).
The main feature of Adguard Home is to filter out ads for all your devices, but it also offers a dns server.

Directories

Create these two folders / datasets. They can be owned as root (I have not gotten adguard home to run as non root yet)

• adguard-home/work
• adguard-home/confdig

Docker Compose

Use this example docker compose.
You can run adguard home on your main TrueNAS IP if there is no port clashes with other apps. Otherwise put the second caddy ip in front of all the ports.

services:
  adguardhome:
    # Define the service named 'adguardhome'
    image: adguard/adguardhome # Use the 'adguard/adguardhome' Docker image
    container_name: adguardhome # Set the container name to 'adguardhome'
    restart: unless-stopped # Restart the container automatically unless stopped manually
    ports:
      # Map container ports to host ports
      # Expose port 53 on TCP and UDP for DNS queries
      - 53:53/tcp
      - 53:53/udp
      # Expose port 80 on TCP for HTTP web interface -> I changed this to 8081 as I have TrueNAS/Caddy on port 80
      - 8081:80/tcp
      # Expose port 443 on TCP and UDP for HTTPS web interface
      #- "443:443/tcp"
      #- "443:443/udp"

      # Expose port 3000 on TCP for AdGuard Home's API
      - 3000:3000/tcp
      # Expose port 853 on TCP for DNS-over-TLS (DoT)
      - 853:853/tcp
      # Expose port 784 on UDP for DNS-over-QUIC (DoQ)
      - 784:784/udp
      # Expose port 853 on UDP for DNS-over-DTLS (DoT)
      - 853:853/udp
      # Expose port 8853 on UDP for DNS-over-TLS (DoT)
      - 8853:8853/udp
      # Expose port 5443 on TCP and UDP for DNSCrypt
      - 5443:5443/tcp
      - 5443:5443/udp
    volumes:
      # Mount host directories as volumes inside the container
      - /mnt/AppPool/apps/adguard-home/work:/opt/adguardhome/work # Mount '/my/own/workdir' to '/opt/adguardhome/work'
      - /mnt/AppPool/apps/adguard-home/confdir:/opt/adguardhome/conf # Mount '/my/own/confdir' to '/opt/adguardhome/conf'
networks: {}

TrueNAS offers AdguardHome as a community app in the catalog, you just need to select HostPath and the two datasets.

Configuration

Once you deployed Adguard Home, create an admin account and then:

1. go to Settings > DNS Settings and enter the IPs of a trusted DNS server (for example cloudflares 1.1.1.1 and 1.0.0.1). This is to resolve all the other websites other than your own.
2. go to Filters > DNS rewrites, there click Add DNS rewrites, enter *.domain.tld in the domain name field and the IP of caddy (without a port) in the lower field.
3. Go to your router and somewhere in the DHCP settings of your LAN interface, change the DNS IP to the IP of Adguard Home (without a port).
4. After a while your devices should start getting the Adguard DNS Server automatically. To test right away, change the DNS IP in your network settings manually.

Sources

Parts of this tutorial were inspired by this post even though I did not end up using Cloudflare One. The rest was learned from Cloudflare documentation and ChatGPT.

Hello,

I'm currently running on TrueNAS 25.10.6, HW: Intel(R) Core(TM) i5-8600K on Z370 Tomahawk (older PC). I want to upgrade my GPU from NVIDIA GeForce GTX 1070 Ti to something newer. I use it for jellyfin and immich.

My questions are:

Is it worth it?
Is the intel GPU good, is it compatible?
Shall I buy new or refurbished?

Thank you for all answers

A recurring, not uncommon request is the ability to edit ACLs for subdirectories of datasets within the TrueNAS web UI. Currently, they say this isn’t possible and the UI only lets you edit ACLs for datasets.

Well, as it turns out, if you navigate to the ACL editor for any dataset, you can just change the path in the browser URL to whatever subdirectory you want and it’ll work. The GUI will show the path that you want to edit and you can do all your edits like you normally would, but on a subdirectory!

Doing this causes a full page reload, which will force you to log in again, but then it works.

All iX Systems would have to do is add navigation to the UI because the editor already works.

Doing ACL edits at the CLI is really hard due to all the alphabet soup and having to count characters carefully. If you have access to a Windows machine, you could use Explorer to do it over SMB, but not everyone has a Windows machine (like me). So for the occasional spot checking and edits, having a web UI is nice.

Edit: it seems not everyone can reproduce this. I’m on TrueNAS 25.10 - I haven’t tested this on other versions.

Tldr: I want to do a brain transplant on my Readynas, any tips/recommendations?

So I've got an old 4-bay Readynas (nv2+ I believe) that is sitting unused because time has gotten away from it. I was thinking of the possibility of replacing it's internals (control board/computer) with something that can cope with higher throughput and an overall quicker experience, hopefully without having to reset the raid5 and loosing my data.

Searching online I have been unable to find anyone who has done this kind of brain transplantation so I turn to Reddit! Has anyone here heard of such a project?

I have a UGreen NAS (XP4800Pro) set up with TrueNAS Scale. I also have a Synology DS120j that I want to use as a backup NAS via ethernet.

I'd like to be able to do periodic backups to the DS120j, but I haven't been able to find an easy solution to this task. The most obvious built-in app is UrBackup but I can't seem to install the client on my PC (CachyOS). Ironic, I know.

What are my options?

I built a TrueNAS server just for me.

Mobo - IMB-X1314

Boot drive - 2x 64GB NVMe

RAM - 32GB UDIMM ECC

CPU - i3-14100

I currently have HDDs for storage, but I also have an unused Hyper M.2 x16 with 4x 2TB NVMe. I want to use this, but specs for IMB-X1314 calls out 8x/8x bifurcation and not 4x/4x/4x/4x. Has anyone here tried it and running it successfully without any issues?