Quick Reference
| Topic | File |
|---|
| Backup strategy, 3-2-1 rule | INLINECODE0 |
| Remote access, VPN, security |
security.md |
| Docker, home lab, apps |
apps.md |
| Media server, indexing |
media.md |
Scope
This skill covers NAS administration for Synology, QNAP, TrueNAS, Unraid, and DIY builds. For enterprise SAN/distributed storage, use specialized infrastructure skills.
Critical Rules
- 1. RAID is not backup — RAID protects against drive failure, not ransomware, fire, or accidental deletion. Always maintain off-site backup.
- 2. 3-2-1 backup rule is minimum — Three copies, two different media types, one off-site. Cloud sync to B2/S3/Glacier counts as off-site.
- 3. SMB for Windows/Mac, NFS for Linux — Wrong protocol = permission chaos. AFP deprecated. Enable only protocols you actually use.
- 4. Expose ZERO ports to internet — No DSM/QTS admin on public IP. Use VPN (WireGuard/Tailscale) or reverse proxy with auth.
- 5. Test your backups quarterly — Untested backup is not a backup. Actually restore files to verify integrity.
- 6. Disable admin account — Create named admin accounts. Default "admin" is first target for brute force.
- 7. UPS mandatory — Power loss during write = corrupted pool. Budget for battery backup that signals clean shutdown.
- 8. Snapshots are not backup — Same disks, same failure domain. Snapshots help with accidental delete, not disaster.
- 9. Calculate TRUE storage capacity — RAID overhead, reserved space, filesystem overhead. 4x8TB drives ≠ 32TB usable.
- 10. ARM NAS = limited Docker — Synology J-series, low-end QNAP run ARM. Many Docker images x86 only. Verify before buying.
快速参考
| 主题 | 文件 |
|---|
| 备份策略，3-2-1 规则 | backup.md |
| 远程访问，VPN，安全 |
security.md |
| Docker，家庭实验室，应用 | apps.md |
| 媒体服务器，索引 | media.md |
适用范围
本技能涵盖 Synology、QNAP、TrueNAS、Unraid 及 DIY 搭建的 NAS 管理。如需企业级 SAN/分布式存储，请使用专门的基础设施技能。
关键规则
- 1. RAID 不是备份 — RAID 仅能防范硬盘故障，无法抵御勒索软件、火灾或误删。务必保留异地备份。
- 2. 3-2-1 备份规则是最低要求 — 三份副本，两种不同介质，一份异地存储。同步至 B2/S3/Glacier 云存储可视为异地备份。
- 3. Windows/Mac 用 SMB，Linux 用 NFS — 协议选错 = 权限混乱。AFP 已弃用。仅启用实际使用的协议。
- 4. 零端口暴露于互联网 — 不要在公网 IP 上开放 DSM/QTS 管理界面。使用 VPN（WireGuard/Tailscale）或带认证的反向代理。
- 5. 每季度测试备份 — 未经测试的备份不算备份。实际还原文件以验证完整性。
- 6. 禁用 admin 账户 — 创建具名管理员账户。默认的 admin 是暴力破解的首要目标。
- 7. 必须配备 UPS — 写入时断电 = 存储池损坏。预算中应包含能发送正常关机信号的电池备份设备。
- 8. 快照不是备份 — 同一硬盘，同一故障域。快照有助于恢复误删，但无法应对灾难。
- 9. 计算真实存储容量 — RAID 开销、保留空间、文件系统开销。4块8TB硬盘 ≠ 32TB可用空间。
- 10. ARM 架构 NAS = Docker 受限 — Synology J 系列、低端 QNAP 采用 ARM 处理器。许多 Docker 镜像仅支持 x86。购买前请确认。
