# nh3-nas

Synology RS2418+ at the NH3 site (`PFI-NH3-NAS`, `10.100.50.50`).
Primary role is fleet storage: VM-image hosting for nh3-pve, the
NH3-side restic target, and as of 2026-04-22 the PBS-NH3 datastore
backend.

## Network

- **LAN IP:** 10.100.50.50
- **DSM web UI:** <https://10.100.50.50:5001>
- **SSH:** `ssh nh3-nas` (config alias → `syncuser@10.100.50.50`,
  key auth). The `syncuser` account was created specifically for
  automation/tooling access; `admin` retained as the DSM primary.

## Hardware

- **Model:** Synology RS2418+ (denverton platform)
- **CPU:** Intel Atom C3538 @ 2.10 GHz, 4 cores
- **RAM:** 31.3 GB
- **Kernel:** `4.4.302+` — DSM's custom kernel, not a vanilla Debian
  base. Implications: very old bash features only (4.x), BusyBox-ish
  userland for some tools, syno_acl layer on Btrfs.
- **Volume:** `/volume1`, Btrfs on `cachedev_0` (SSD-cached LVM).
  42 TB total, 27 TB used (64%), 16 TB free.

## Services running on the box

- **DSM built-in NFS server** — exports under `/etc/exports` managed
  via DSM Shared Folder UI. Active exports include:
  - `/volume1/Shared`, `/volume1/Media`, `/volume1/NetBackup`,
    `/volume1/Backup`, `/volume1/compose`, `/volume1/VMStorage`,
    `/volume1/devstor` (legacy home-lab exports; `all_squash`)
  - `/volume1/pbs` — dedicated share for PBS-NH3's datastore mount.
    Linux/POSIX mode 777, no syno_acl, `no_root_squash + no_all_squash`.
    Do NOT enable Advanced Permissions on this share — see
    `docs/runbooks/pbs-deployment.md` Phase 5.3 for the history.
- **rest-server-nh3** (Docker via DSM ContainerManager) — restic
  HTTP endpoint on port 8000, writes under `/volume1/Backup`. Serves
  nh3-docker and nh3-dev restic clients.

## What backs up to it

- nh3-docker + nh3-dev resticprofile timers (via rest-server-nh3)
- PBS-NH3 datastore (`backups-mirror`), which receives the nightly
  sync pull from PBS-ANA

## What backs up FROM it

Not currently backed up itself — the DSM side is the source-of-truth
for its own config. Future work: cross-site rsync of
`/volume1/Backup/restic/...` to the Ana NAS (`10.250.50.50`), blocked
previously on SSH-access to this host (now resolved with `syncuser`).

## DSM-specific gotchas

- **Docker:** runs via DSM's ContainerManager package, not a native
  `docker` CLI. `docker ps` over SSH returns empty; use
  `sudo synopkg list | grep -i container` and
  `sudo docker ...` (DSM aliases the binary into root's PATH).
- **Home directories:** live under `/var/services/homes/<user>/` (not
  `/home/<user>`). SSH public keys go in `~/.ssh/authorized_keys`
  which maps to the DSM home. Home dir permission must be 755 (not
  700) or sshd rejects keys silently after DSM updates reset it.
- **Btrfs mount options** include `synoacl` — POSIX permissions are
  projected through Synology's ACL layer. For share permissions to
  behave as plain POSIX, either turn off "Advanced Permissions" in
  DSM *and* flatten with `chmod 777` (which converts the share to
  "Linux mode", `synoacltool -get` will confirm), or grant explicit
  ACL entries with `synoacltool -add`.

## Refresh state

Snapshot captured via `scripts/refresh-server-info.sh nh3-nas` —
updates `system-details.txt` alongside this README.