The current NAS storage layer is based around a Synology Diskstation DS918+ 4-bay network attached storage running the Synology DSM operating system. This is actually the 3rd generation of NAS in this household and was really the tool I used to cut my teeth on home computing (after I graduated from pure laptops).
The Synology DSM is actually a pretty complete Linux operating system with an HTML interface. It does support SSH. It is definitely more of a consumer device in that it comes somewhat locked down in what you can do, but the services are fairly comprehensive and I was able to go pretty far in my basic computing needs with it.
However, the vendor lock-in is something I have been increasingly concerned about. Around 2025, Synology started enforcing (in new models) that only approved (i.e. expensive) hard drives were allowed to be installed in the NAS. And that makes staying in this ecosystem difficult. Eventually, I will need to migrate all services off.
I anticipate the most difficult app to migrate will be Drive (perhaps to Nextcloud). Photos has already been replaced by Immich, although the Synology app still runs.
There is a NAS hosted at 192.168.200.155 that is pretty much the brains of the house (although losing responsibility for key services over time). This is a Linux OS with substantial web application support to interface with the NAS. The NAS also exposes an SSH port only inside the house that can be used to gain relatively low-level access to the NAS. Commonly, this is used to deploy Docker applications to the NAS. The name of the NAS is diskstation.rachelski.internal.
The credentials for the admin account can be found in BitWarden (under DiskStation Admin).
The NAS serves its web interfaces over HTTPS using several certificates, including one from Synology's own Let's Encrypt service and the *.rachelski.internal certificate issued by Vault. How each one is renewed is on the Certificate Management page.
The NAS has 4 hard drives within it. 2 are functioning as a duplicated RAID 1 pair and go by the name volume1. This volume1 holds the users' home directories and high-value file storage.
The other 2 drives are stand-alone. The volume2 volume is primarily designated as an on-site backup target, segmented into purpose-specific shares. The volume3 volume holds docker configurations and volumes along with media such as movies and TV series. Photos are considered more private and are found in each owner's home directory held on volume1.
For what each shared folder on the three volumes is used for, see the Storage Map.
Some applications used in the household run on the DiskStation NAS. The vast majority of these applications are deployed as docker containers. See the NAS Storage page for a terse list of all applications running on the machine.
This is the primary holder of the BitWarden vaults. This becomes a central, internet hosted, storage location for password vaults accessed using the BitWarden clients. The vault holding most of the household credentials is stored under the user name mark@rachelski.net. The password is in Mark’s head, but will be shared with Leena if he were to stop logging into his mrachelski@gmail.com account (using Google Inactive Account Manager). Mark will also keep a copy of the BitWarden master password in the household safe. Mark will also begin moving key records into the M&L Household organization vault in BitWarden as he gets older to avoid locking Leena out should his memory begin to decline.
This is practically the most important application as it holds the secrets used to configure everything else in the household. At some point in the future, this may be moved to a cloud-hosted server to remove dependencies on the household infrastructure.
This is not really a separate application, but is built into the NAS. Essentially, there is a network share that can be connected to by macOS devices by the Time Machine application. This shared folder is where backups are stored.
The NAS’s iDrive backup service will keep another copy in the iDrive cloud satisfying a 3:2:1 strategy for macOS devices. The shared folder to be used on the NAS is called TimeMachine.
The Synology NAS is also running a DDNS service, dependent upon Synology to resolve to the DNS name mrachelski.synology.me. As AIS changes the household IP address, this service should update the DNS name automatically. I used to run this on the router, but I think there was an issue with the NAS managing Let's Encrypt certificates that drove me to run this service on the NAS.
Nothing depends on this service any more. UPnP has been turned off on the router, and all VaultWarden clients have been reconfigured to use other names. The DDNS service is still running on the NAS and is scheduled to be retired (see the Project TODO List).
The functionality of Synology Drive has been replaced with Nextcloud
This is a remote storage application that is composed of a server running on the NAS and various clients installed on laptops or phones. This can be used to access key files from the NAS on these devices or simplify the upload of files onto the NAS for safekeeping. It is similar in capability to Google Drive + Google Drive Desktop.
While this is currently running, network access outside of the house has been cut off with the shutdown of UPnP and I will be turning this service down after determining how to transition all of the data the service was managing.
All of Mark’s personal information he would rather not share with Google is held this way. This includes things like: medical records, tax filings, business documents and similar items.
Disaster Recovery is handled in a few different ways. First, the physical disks have been classified in 2 different forms: fully redundant or stand-alone.
/volume1 has been placed on a fully redundant RAID 1 pair of physical disks/volume2 has been placed on a single standalone disk/volume3 has been placed on a single standalone diskThe fully redundant volume (/volume1) can survive the hardware failure of a single drive. Over the years, almost every drive has failed at one time or another.
The system then runs a backup service called Kopia as described on NAS Backups.
If the whole NAS is lost, an encrypted off-site bundle in Google Drive holds what is needed to bring back VaultWarden, Vault and access to the Kopia backup. The steps are on NAS Disaster Recovery.
Furthermore, a few key folders are configured in the NAS's HyperBackup service so that they are locally copied from the standalone disk to the fully redundant disk set. HyperBackup will do a good job of compressing and deduplicating these backups so that they are very fast and use very little storage.