NAS on Margrop Blog

Your Photos May Have No Backup: Why a NAS Alone Is Not Enough

Wed, 29 Jul 2026 08:00:00 +0800

The short answer

If your photos exist only on a phone, a computer, and one NAS, you may not have three backups. You may have three doors leading to the same room. A lost phone, ransomware on the NAS, an accidental synchronized deletion, or a house fire can remove all three doors at once.

The rule worth remembering is 3-2-1: at least 3 copies, on at least 2 types of media, with at least 1 copy offsite. The stronger version is 3-2-1-1-0: add 1 offline or immutable copy, and verify that recovery has 0 undetected errors.

RAID Is Not Backup: How to Choose the Right NAS Layout for Synology, fnOS, and Unraid

Sat, 11 Jul 2026 12:00:00 +0800

The short answer

RAID primarily keeps a NAS available when one or more drives fail. Backup restores data after deletion, ransomware, filesystem damage, theft, fire, or a failed NAS. You normally need both.

On Synology, SHR-1 is the practical default for many homes, while larger and more critical arrays deserve SHR-2 consideration. On fnOS, choose the filesystem, storage mode, drive count, and backup destination as one design. On Unraid, understand that the classic Array is not a conventional striped RAID: data disks keep independent filesystems while one or two parity disks provide failure recovery.

A useful starting rule is: mirror two-drive systems; use single-drive redundancy when capacity matters and a separate backup exists; seriously consider dual-drive redundancy as drive count and individual drive capacity grow. Anything irreplaceable still needs an offline or off-site copy.

The Password Was Right—So Why Did Synology Reject It? Rebuilding DSM’s RSA + AES WebAPI Login

Sat, 11 Jul 2026 08:30:00 +0800

The short version

Some Synology WebAPI clients do more than post account and passwd to auth.cgi. The implementation preserved in OpenStack Cinder first calls SYNO.API.Encryption.getinfo, receives an RSA public modulus, server time, and two dynamic field names, then generates a one-use passphrase. RSA PKCS#1 v1.5 encrypts that passphrase; an OpenSSL-compatible AES-256-CBC envelope encrypts the URL-encoded login parameters; both Base64 values are finally placed inside the server-provided cipherkey field.

This is an authorized WebAPI compatibility technique—not a password bypass. A SID for session=DSM is also not automatically the same thing as a complete browser UI login state. Parameter encryption does not replace HTTPS, because TLS still authenticates the server and protects integrity against an active intermediary.

Do Not Buy the “Btrfs Drive” Blind: Cheap HM-SMR HDDs Are the 996 Version of Storage

Thu, 09 Jul 2026 10:00:00 +0800

Short version

A hard drive is not just capacity divided by price. CMR behaves like normal lanes on a road: random rewrites are relatively predictable. SMR behaves like roof shingles: tracks overlap, density improves, but changing one small area may require rewriting a larger zone. The most dangerous detail is that SMR is not one thing. Some SMR drives hide the complexity in firmware. Some expose zone controls. Some are host-managed SMR, where the operating system and software stack must obey zone write rules. Recently, some very cheap large HDDs have been marketed as “Feiniu drives” or “Btrfs drives” on PDD-like listings. In many cases, the real risk is that these are host-managed SMR enterprise drives, not ordinary NAS drives.

My buying rule is simple: no exact model, no purchase; no vendor datasheet, no purchase; Linux reports host-managed, normal users should walk away; if the seller talks about Btrfs or Feiniu but avoids the SMR type, walk away.

Stop Fighting Over the Remote: Use DSM Scheduled Tasks to Lock a Kids' Video Folder Automatically

Sun, 05 Jul 2026 06:50:00 +0800

Short version

This is not an account lockout guide. The goal is narrower and cleaner: lock one kids’ video folder on a Synology DSM 7.2.1 NAS during selected hours, while leaving the account, password, homework folders, photo folders, and other shares alone. The script inserts one temporary deny ACL entry with synoacltool, removes that entry during open windows, backs up the ACL before each change, and verifies the result after each operation.

Synology locked root behind three doors — I spent twenty minutes teaching it how to let me back in

Thu, 18 Jun 2026 16:30:00 +0800

TL;DR

Synology DSM, by design, ships with SSH disabled and root login prohibited — both sensible defaults. This guide walks you through “doing it the right way”:

Control Panel → Terminal & SNMP → Enable SSH (open the gate)

Log in as a normal user, then sudo -i to become root (borrow the landlord’s key first)

Edit /etc/ssh/sshd_config and set PermitRootLogin yes (tell the bouncer “root is family”)

synouser --setpw root xxx to set a root password, and append your public key to ~/.ssh/authorized_keys (hand back a key that can never be lost)

Total time: about twenty minutes. I’ll explain why every step exists using a “key and lock” metaphor, give you a 3-second vi crash course, list the error messages you’ll see, and answer the seven most common questions.

Moving Bedtime Out of the Living Room: Letting macOS launchd Disable Your Kids' Synology Accounts at 22:00 and Quietly Re-enable Them at 08:00

Sun, 14 Jun 2026 08:20:00 +0800

Short version

Synology DSM has a “disable this account” checkbox in the Control Panel, but it does not run on a schedule. With macOS’s built-in launchd and a 50-line bash script, you can flip the expired flag on two local accounts at 22:00 every night and flip it back at 08:00. The script does a before-query, a change, an after-query, and exit 1 the moment the after state does not match expectations. launchd writes stdout and stderr to dedicated log files. The interesting part is that the word “parent” quietly leaves the conversation: you no longer have to remind anyone to go to bed, the machine does it for you, on time, every day.

This post is not a comprehensive “family NAS management” guide. It is about one specific thing: turning a manual button click that depends on human memory into a system-level event that just happens on time.

If you only want the picture, the overview diagram in Section 2 is the whole article in one frame.

PhotoPrism Stuck for 5 Minutes on First Boot? A Postmortem on PHOTOPRISM_INIT=intel

Sat, 13 Jun 2026 08:30:00 +0800

TL;DR (The Short Version)

The PHOTOPRISM_INIT: "intel" line in PhotoPrism’s Plus Docker image is not just a flag to enable Intel hardware acceleration at runtime — it’s a one-shot system-level installer that runs apt-get dist-upgrade against archive.ubuntu.com and then installs 8 Intel/VA-API packages before the main process is allowed to start. On a fresh container this takes 5–10 minutes (sometimes more), during which nothing inside the container listens on port 2342.

Meanwhile: docker ps says Up, Portainer is green, ss -ltn on the host shows :2342 LISTEN — but your browser gets ERR_CONNECTION_RESET / Connection reset by peer. Because host-side docker-proxy accepts the connection and then tries to forward to a port inside the container that has no listener, the kernel sends back an RST.

Fix: just remove or empty that one line. If you already pass /dev/dri/renderD128 via devices:, the host’s drivers and userland libraries are perfectly usable from the container — there’s nothing to “install” in there.

When a Seagate IronWolf Pro Throws a SMART Alert: My Full Path from Diagnosis to a Free RMA

Sat, 13 Jun 2026 08:00:00 +0800

Short version

A single line in a Synology alert — “Bad sector count on Drive 10 has increased” — was the starting point. The drive that triggered the alert wasn’t the one that actually scared me, and the drive that did turn out to be in trouble turned out to be a Taiwan-boxed IronWolf Pro still under Seagate’s 5-year warranty. This post walks through the entire path I took: SMART triage, fault classification, identifying a hidden link-layer problem on a different drive, the international region-transfer request, the email I actually sent, and the packaging lessons you only learn by reading Seagate’s return policy. If you ever get a similar alert, this is the playbook I wish I had on hand.

A bit of context first: my home NAS is a Synology DS3617xs running DSM 10, up 7x24 with four 10 TB drives — two WD helium “white-label” drives, an HGST Ultrastar He10, and a Seagate IronWolf Pro 10 TB. The day the alert came in, everything had been quietly humming for almost three years.

[Transfer] Installing and Configuring an ImmortalWrt Bypass Router

Mon, 11 May 2026 21:10:55 +0800

This article is a full English translation of Egg Targaryen’s “ImmortalWrt旁路由安装与配置”. The original article is published under the CC BY-NC-SA 4.0 license. The operation order and screenshots are preserved, with minor formatting adjustments for this site.

Adding Proxmox VE local-lvm Usage and Link-Speed Monitoring to Uptime Kuma

Tue, 05 May 2026 17:20:00 +0800

Short version

Proxmox VE local-lvm is usually an LVM-thin pool, not a normal mounted directory, so df -h is not enough to catch it before it becomes full. Network link speed is another quiet failure mode: services may stay online while a NAS or router uplink falls back to 100 Mb/s and turns large file transfers into a crawl. A practical fix is to feed both checks into the Uptime Kuma you already use: expose a small HTTP health endpoint for local-lvm, and push link-speed status from the Proxmox host with an ethtool script.

This article walks through the design, the problems in a naive implementation, improved scripts, systemd units, Uptime Kuma configuration, verification steps, and safety notes. All addresses, tokens, host names, and environment-specific values are placeholders. Replace <PVE_HOST>, <KUMA_URL>, <PUSH_TOKEN>, and <INTERFACE> with values from your own environment.

Integrating Synology Operations as an OpenClaw / HermesAgent Skill: From One Sentence to Auditable NAS Automation

Tue, 05 May 2026 12:20:00 +0800

I have already written two Synology CLI references on this blog:

Those posts answer the question: “What commands can a human run on a Synology NAS?” This article answers a different question: if I already use OpenClaw / HermesAgent, how can I turn those commands into an operations Skill so that I can ask the agent, in one sentence, to inspect the NAS, summarize evidence, prepare a maintenance plan, and execute approved commands only when the risk is acceptable?

The short answer is: yes, but the Skill must not become an unrestricted root shell. The right design is:

Make Synology SSH access controlled, testable, and revocable.
Put common Synology CLI operations into a Skill, together with command categories, risk levels, and output rules.
Allow read-only diagnostics by default.
Require explicit approval for service restarts, permission changes, user changes, network changes, deletion, and storage operations.
Preserve commands, output, and reasoning so each operation remains auditable.

If you only want the big picture, the diagram below summarizes the whole article.

[Transfer] Synology NAS CLI Administration Guide

Thu, 30 Apr 2026 18:20:04 +0800

This guide contains command tools that allow your applications to make use of the resources on Synology DiskStation and also includes a list of Synology Error Numbers for reference.

[Transfer] Synology DiskStation Administration CLI Guide: Reading Notes and Command Cheatsheet

Thu, 30 Apr 2026 18:14:05 +0800

Short version

Synology’s official CLI administration guide is not a beginner manual for the DSM web interface. It is a compact reference for scripting, automation, and system integration. The useful parts cover local users, local groups, shared folders, network configuration, service management, Windows workgroup or ADS domain settings, and DSM error numbers.

This post is an English reading note and command cheatsheet based on Synology’s official PDF, CLI Administrator Guide for Synology NAS. Because the original PDF is a copyrighted Synology document, this post does not reproduce or translate the full document verbatim. Instead, it reorganizes the material into a bilingual blog-friendly guide for quick reading and daily operations. For exact wording, parameter definitions, version-specific behavior, and legal notices, use the official PDF linked at the end.

Why a NAS hostname with `speedtest` can sometimes be much faster

Fri, 24 Apr 2026 09:00:00 +0800

Short version

If your NAS is painfully slow when accessed from outside your home, and you control both your domain name and your reverse-proxy entry, putting speedtest into the subdomain can sometimes make a dramatic difference.
This is not magic and it is not guaranteed, but it often appears to hit a more permissive carrier policy path for “speed-test-like” traffic.

This post was inspired by a discussion on the fnNAS forum. The original thread makes a very direct claim: some home broadband lines seem to throttle ordinary NAS access quite aggressively, but once the hostname contains speedtest, the connection can suddenly behave much better.

I am not repeating the forum post word for word. Instead, I am turning the idea into a longer-lived technical note that answers three questions:

Why this trick can work
How to set it up with the least amount of moving parts
When it will not work, or is not worth the effort

When Docker Networks Collide with the Home LAN: Moving Auto-Allocated Subnets Back to 172

Mon, 13 Apr 2026 08:00:00 +0800

This post records a very practical Docker networking failure: the number of containers kept growing, Docker’s auto-assigned user-defined bridge networks eventually started landing in 192.168.x.x, and those networks began colliding with the real home LAN. The symptoms were not dramatic at first. Nothing looked “broken” in the usual sense. Containers were still running, the host was still alive, and the dashboard still looked normal. But parts of the home network became unreliable, and once I dug into it on my NAS, the root cause turned out to be the Docker network allocation strategy rather than any single bad container.

The fix was straightforward in principle, but important in practice: I moved Docker’s automatic network pool to 172.16.0.0/12, migrated the existing 192.168.* networks onto the 172 private range, and made sure future networks created through Portainer, Dockhand, or plain docker compose would follow the same rule.

On the Importance of Mac Computers and TimeMachine

Tue, 14 Sep 2021 16:55:10 +0800

Today is September 14, 2021. As of today, I have been using MacOS as my main system for about 2 years. I have to say that I am deeply in love with MacOS now. If I need to buy my next laptop, I will definitely buy the MacBookPro high-end configuration. #Main differences between MacOS and Windows 1. Shortcut keys Windows The well-known Ctrl + C and Ctrl + V below MacOS becomes Command(Win key) + C and Command(Win key) + V

Overview of home network architecture based on PVE + soft routing + NAS (for technical personnel)

Fri, 03 Sep 2021 09:50:49 +0800

Home Network Overview The home network will not separate the “business plane”, “management plane” and “data plane” like a regular virtualization platform. What home networks need is convenience, so the three planes mentioned above need to be integrated together to share the network in order to facilitate management. The security of the home network is also very important. No one wants the network door at home to be open to the outside world all the time.

China Telecom, How to Contact Customer Service to Apply for a Public IP

Mon, 25 Jan 2021 22:12:32 +0800

Currently, among the three major carriers in China, China Telecom has the most abundant 公网IP. However, as global IPv4 resources have been completely exhausted, even the wealthy families are running out of grain.

How to Run N2N on Synology (DSM) - Compilation Guide

Fri, 15 Jan 2021 13:18:07 +0800

Synology (abbreviated as DSM below) is currently the most famous NAS system, bar none. How to run N2N directly on DSM? Of course, cross-compilation is needed again 😂. The following cross-compilation operations require a basic understanding of Linux and proficiency in vim operations.