Chapter 8
NAS and cloud architecture
8.1 Learning objectives
- Design a "NAS-first" architecture for an individual or family.
- Configure safe sync directions between the cloud and the NAS.
- Choose safe remote access: a private network (mesh VPN) instead of opening ports.
8.2 Concepts
NAS-first
The NAS (network-attached storage) is where the canonical copy lives. The laptop is where you work; the cloud only holds frequently used files for quick access on your phone. All important data must "come home" to the NAS, and from the NAS go on to backups.
NAS configuration components you should have
| Component | Purpose | Notes |
|---|---|---|
| Two or more drives, mirrored | Survives one drive failing | Not a backup |
| A file system with snapshots and checksums (e.g. Btrfs, ZFS) | Detects silent data corruption; snapshots to roll back | Enable checksums when creating shared folders |
| Volume encryption | Stolen drives cannot be read | Keep the recovery key elsewhere (Chapter 9) |
| Immutable snapshots | Cannot be deleted/modified during the lock period | Protects against malware and anyone with admin rights |
| Versioned backup software | Pushes to external drives and offsite | Enable client-side encryption |
| Email notifications | Know immediately about drive errors, unusual logins | Send to a mailbox you actually read |
Sync direction
| Direction | Risk | Recommendation |
|---|---|---|
| Two-way | Delete on one side, lost on both | Avoid for archival data |
| NAS → cloud | Malware on the NAS spreads to the cloud | Use only with versioning |
| Cloud → NAS, download only, no deletion at destination | The NAS keeps even files deleted in the cloud | Good for "bringing everything home" |
Remote access
- Local network (LAN): the main path when at home.
- Mesh VPN: your devices see each other as if on the same network, without exposing NAS ports to the Internet. Should be the default path when away.
- The NAS vendor's relay service: a backup path; enable 2FA and automatic IP blocking.
- SSH: key-only login, with the private key kept in the password manager or on a hardware key; disable password login.
- Never expose the NAS admin port directly to the Internet.
8.3 Worked example
Mr. A's architecture:
| Component | Role |
|---|---|
| NAS *** (2 drives, mirrored, Btrfs, encrypted volume, checksums on for the "Data" folder) | Canonical copy |
| Personal cloud | Frequently used files; one-way sync to the NAS, download only, no deletion at destination |
| The phone OS's cloud | Minimal; holds no unique data |
| Laptop, temporary staging folder | Copy to the NAS, compare SHA-256, only then clean up |
| External SSD | Versioned backup destination, plugged in while running |
| Offsite object storage | Second backup destination |
| Mesh VPN + backup relay service | Remote access |
Mr. A's process for moving data from the laptop to the NAS: copy (do not move) → compute SHA-256 on both sides → compare → log it → wait 30 days → clean up the source.
8.4 Common mistakes
- Using two-way sync for long-term archive folders.
- Opening the NAS admin port to the Internet "for convenience".
- Using the NAS admin account for daily work.
- Reformatting an old external drive as a backup destination while the old data on it does not yet have enough copies.
- Enabling checksums after data was already copied (they usually only apply to newly written files).
8.5 Checklist
8.6 Exercises
- Draw your data map: from which devices, to where, in which direction.
- Mark every "two-way" arrow on the map and consider changing it to one-way.
- List the open ports on your home router; does any of them point to the NAS?
8.7 Summary
- NAS-first: the canonical copy on the NAS, the cloud for convenience, backups flow out from the NAS.
- One-way sync with no deletion at the destination when bringing data home.
- Remote access through a private network, not open ports.