Synology Administration Guide#

1 Syncthing Deployment#

1.1 Synology DSM Implementation (Docker)#

1. Inotify Limit:

   echo "fs.inotify.max_user_watches=204800" | sudo tee -a /etc/sysctl.d/90-override.conf
   sudo sysctl -p /etc/sysctl.d/90-override.conf

2. User IDs: Use Task Scheduler to run id > /volume1/docker/id.txt to find UID/GID (e.g., 1027/100).
3. Docker Compose Highlights:

   environment:
     - PUID=1027
     - PGID=100
     - TZ=America/New_York
   volumes:
     - ./config:/config
     - /volume2/HP3Storage:/volume2/HP3Storage

1.2 Standard .stignore Patterns#

Create a .stignore file in the root of the sync folder:

(?i)#recycle
@eaDir
.DS_Store
.stfolder
.stignore
$RECYCLE.BIN
Thumbs.db
Desktop.ini
.SynologyWorkingDirectory

2 Storage & Maintenance Commands#

2.1 iPerf3#

sudo -i
synogear install
iperf3 -s -p 11111

2.2 Locked Folder Cleanup#

Remove Synology metadata directories when cleaning up a locked folder:

Linux - Aliases#

Quick Setup (Apply Aliases to Any Linux Machine):

1. Open your bash configuration file:

   nano ~/.bashrc

2. Append the following alias block to the bottom of the file:

   # --- Homelab Linux Aliases ---
   # System Listings
   alias ll='ls -alF'
   alias la='ls -A'
   alias l='ls -CF'
   
   # Docker & Docker Compose
   alias up='docker compose up'
   alias down='docker compose down'
   alias clean='docker system prune --all --volumes'
   
   # 1Password CLI Compose Integration
   alias 1p='op whoami >/dev/null 2>&1 || eval $(op signin); op run --env-file=".env" -- docker compose up'
   
   # Hugo Site Publishing (NAS-Mounted Scripts)
   alias push='bash /mnt/Software/Software/Scripts/Linux/publish-hugo-homelab.sh && tail -f /home/marc/hugo/homelab/logs/publish-hugo-homelab.log'
   alias pushgen='bash /mnt/Software/Software/Scripts/Linux/publish-hugo-gendash.sh && tail -f /home/marc/hugo/gendash/logs/publish-hugo-gendash.log'
   # -----------------------------

3. Save, exit, and reload the configuration:

   source ~/.bashrc

1. Core Alias Reference#

These aliases are designed to standardise navigation, Docker compose stacks, and Hugo website publishing across Linux servers.

Lab-VM Virtual Machines & Container Network Security Analysis#

VERDICT: [VERIFIED] SECURE AND HARDENED SECURITY SCORE: 97 / 100 (Grade: A+) An empirical security audit of the Lab-VM network (10.1.2.0/24, interface br12) confirms that your core application workloads — including the High Availability Pi-hole DNS cluster (10.1.2.8), Docker container hosts, Nextcloud/Owncloud private clouds, Synology DSM VMs, GPU compute nodes, LubeLogger, and virtual NAS appliances — operate on an isolated 10G SFP+ aggregated network (USW Aggregation 2) protected by Linux kernel firewall rules (iptables), gateway management isolation, active honeypot detection (10.1.2.254), and strict inter-VLAN boundary drops.

NAS Backup Pipeline: Backrest, Restic & Google Drive#

Complete configuration guide for backing up isolated TrueNAS/DSM network shares from the headless Ubuntu VM (HP1Docker) to an encrypted Google Drive repository using Backrest (a Web UI wrapper for Restic) and Rclone. For baseline Rclone installation, remote management, and CLI commands, see the RClone Guide.

1. System Architecture Overview#

• Source Data: 8 explicit network shares mounted via CIFS/SMB on the host VM at /mnt/<ShareName>.
• Backup Host: Ubuntu VM (HP1Docker - 10.1.2.202).
• Backup Agent: Backrest Docker Container running Restic 0.18.1.
• Target Backend: Google Drive (proxmox.app@gmail.com) via a dedicated Rclone remote.
• Security Model: Client-side, zero-knowledge encryption via a dedicated repository password before data leaves the local host.
• Rate-Limit Protections: Powered by a custom Google Cloud Project ID to bypass global multi-user API query restrictions during multi-terabyte data transfers.

2. Directory Structure Setup#

All configuration and container runtime files are centralized on the host under the user deployment directory.

1Password CLI & Docker Deployment Guide#

2026-08-03 Troubleshooting popups for MCP server with account tokens - To implement on VM’s using OP: agy –conversation=22663bf8-df61-4167-99ad-7a3d9884c879 1

1. Installation#

1.1. Install 1Password CLI (Linux VM)#

# 1. Add the key
curl -sS [https://downloads.1password.com/linux/keys/1password.asc](https://downloads.1password.com/linux/keys/1password.asc) | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg

# 2. Add the repository
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] [https://downloads.1password.com/linux/debian/amd64](https://downloads.1password.com/linux/debian/amd64) stable main' | sudo tee /etc/apt/sources.list.d/1password.list

# 3. Update and Install
sudo apt update && sudo apt install 1password-cli

1.2. Install 1Password CLI (LXC)#

# 1. Add the key
# 1. Ensure system initialization package is present
sudo apt update && sudo apt install systemd-sysv -y

# 2. Add the key securely
curl -sS [https://downloads.1password.com/linux/keys/1password.asc](https://downloads.1password.com/linux/keys/1password.asc) | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg

# 3. Add the official repository
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] [https://downloads.1password.com/linux/debian/amd64](https://downloads.1password.com/linux/debian/amd64) stable main' | sudo tee /etc/apt/sources.list.d/1password.list

# 4. Update repositories and install the CLI
sudo apt update && sudo apt install 1password-cli -y

1.3. Install 1Password CLI (macOS)#

# Install via Homebrew
brew install 1password-cli

2. Authentication & Account Setup#

2.1. Initial Account Setup (One-time)#

To add your 1Password account to the CLI manually:

1 Docker Installation & Management Guide#

1. Install Docker on Ubuntu#

Official Docker Documentation

apt-get install ca-certificates curl -y
install -m 0755 -d /etc/apt/keyrings
curl -fsSL [https://download.docker.com/linux/ubuntu/gpg](https://download.docker.com/linux/ubuntu/gpg) -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] [https://download.docker.com/linux/ubuntu](https://download.docker.com/linux/ubuntu) \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

apt-get update && apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

usermod -aG docker marc
newgrp docker

systemctl enable docker.service && systemctl enable containerd.service
systemctl status docker.service
systemctl restart docker
systemctl stop docker
systemctl status docker

If in Ubuntu, edit the service file so the internal firewall is not overridden and to prevent Docker from creating ghost files if SMB shares are not mounted (to deactivate, just remove the text):

Syncthing Installation & Configuration Guide#

1. #truenas TrueNAS Scale Installation#

Increase Inotify Limit#

For real-time file watching on large datasets, increase the inotify limit in the TrueNAS backend.

1. Go to System Settings > Advanced > Sysctl.
2. Add New Sysctl:
   • Variable: fs.inotify.max_user_watches
   • Value: 524288
   • Description: Increase inotify limit for Syncthing.
3. Verify persistence via Shell:

cat /proc/sys/fs/inotify/max_user_watches

App Deployment#

1. Apps > Settings > Advanced: Disable “Host Path Safety Check” (if using existing datasets).
2. Catalog: Search for and install the Syncthing Enterprise version.
3. Storage Configuration:
   • Type: Host Path
   • Host Path: /mnt/HP1-4TBSSD-Raid0/HP1Storage (or your specific data path).
   • Mount Path: HP1Storage
4. Access: Open the Web UI at http://[IP]:31000. Set an Admin password immediately.

2. Synology DSM Installation (via Docker)#

Increase Inotify Limit#

1. Connect via SSH and run:

echo "fs.inotify.max_user_watches=204800" | sudo tee -a /etc/sysctl.d/90-override.conf
echo 204800 | sudo tee /proc/sys/fs/inotify/max_user_watches

Identify User IDs (PUID/PGID)#

To avoid permission issues, run the container as your specific user.