Objective
Provide reliable, well-separated storage for service data, shares, and backup copies, with minimal permissions for each use.
Architecture
The NAS exposes network shares on a segment dedicated to storage or servers, with separate volumes for service data, personal files, and the backup target. The disks are organized in an array with redundancy; periodic snapshots and integrity checks (scrubs) protect against failures and silent errors.
Details
Data organization
The NAS separates data by use: volumes for service data, for personal files, and for the backup target, each with minimal permissions and accessible only to the systems that need it. The shares are reachable from a dedicated network segment or from the server segment. Access is based on users and groups dedicated to individual services, not on a shared account.
Protection and maintenance
Important
Disk redundancy protects against the failure of a drive, not against deletions, mistakes, or ransomware: it is not a substitute for backup.
To reduce the risks I use:
- a file system with checksums and periodic integrity checks (scrubs);
- scheduled snapshots, with rotating retention;
- monitoring of the SMART status of the disks and of space alerts;
- an orderly shutdown in case of a power outage.
The NAS also hosts the second copy of the backups, following the strategy described in 3-2-1 backup strategy with Proxmox Backup Server and a NAS.
Current setup
- Model: QNAP TS-231P.
- Array: two disks in a ZFS mirror (RAID 1, tolerates the failure of one disk without losing data), with a periodic scheduled scrub.
- Snapshots: scheduled on a rotating basis (e.g. hourly for the current day, daily for the last week, weekly for the last month), so I can roll back even on mistakes noticed late.
- Disk monitoring: SMART status checked periodically, with an alert on reallocated sectors or errors that precede a failure.