Jake Tuero

TrueNAS

3 min read

TrueNAS

TrueNAS provides storage to Proxmox and the Ubuntu guests. See Inventory and Services > Storage Mounts and Backups and Recovery.

For replacement-system and dataset-transfer tasks, follow Manual Steps > New TrueNAS Dataset Migration.

Use https://truenas.tuerolab.ca for the TrueNAS web UI on the LAN or through Tailscale. falador.tuerolab.ca remains the direct host name for 10.0.0.234.

Current Ansible Dependencies

ShareConsumerMount/use
backupVarrock/mnt/backup
projectsVarrock/mnt/projects
mediaArdougne/mnt/media
service-backupsArdougne/mnt/service-backups
pve-computeProxmoxCloud images and vzdump files

Ansible expects TrueNAS at 10.0.0.234, SMB 3.1.1, and valid credentials in Ansible Vault. It creates guest mountpoints and /etc/fstab entries, but it does not create TrueNAS datasets, shares, users, or ACLs.

The service-backups share contains application archives, including Uptime Kuma notification webhooks after monitoring is configured. Ardougne mounts it root-only with restrictive client modes. Configure the matching TrueNAS SMB ACL and do not expose this share to ordinary users. The current SMB account is shared across mounts, so a dedicated backup-only SMB account is needed later for TrueNAS-side credential isolation.

Dataset Plan

  • vault or documents: general documents; final name TBD
  • appdata: Docker configuration outside the current Ardougne local-appdata design
  • home: general work and programming
  • projects: canonical, browseable source trees for Varrock local workspaces
  • shared: general shared/drop-box area
  • proxmox-compute: Proxmox compute storage
  • proxmox-services: Proxmox services storage
  • media: media library and downloads
  • service-backups: Ardougne current appdata archive
  • backup-truenas: TrueNAS backups
  • backup-proxmox: Proxmox backups

Users

Create tuero as the main user. Set dataset ownership and ACLs according to each share’s consumers rather than applying one ACL blindly. Where additional users need access, add the appropriate group ACE and verify access from the consuming VM.

Dataset ownership and an @owner ACE do not recursively change the owner of existing children. Files copied from a TrueNAS root shell can therefore remain owned by root or retain source ACLs even though new files created over SMB are writable. After importing into projects, inspect the dataset path in the TrueNAS shell and repair ownership before using it from Varrock:

ls -ld /mnt/<pool>/projects /mnt/<pool>/projects/<project>
getfacl /mnt/<pool>/projects/<project>
chown -R tuero /mnt/<pool>/projects

Replace <pool> with the actual pool name. The recursive chown makes the existing @owner full-control ACE apply to tuero. If imported children have non-inheriting or explicit ACL entries that still deny access, use the TrueNAS ACL editor to reapply the projects dataset ACL recursively. Review that ACL before applying it because this replaces child ACLs. Verify from Varrock by creating and deleting a temporary file inside an imported project, not only at the share root.

Protection Still To Document

  • Pool and vdev layout
  • Encryption and key recovery
  • Dataset quotas
  • Snapshot schedules and retention
  • Replication or off-site copies
  • Scrub, SMART, and alert configuration
  • TrueNAS configuration database backup and restore
  • Tested file and dataset restore procedures

Graph View

Backlinks