Google Drive Backup#

This note documents the Google Drive mirror running on HP1Clouds (10.1.2.219) as observed on 2026-09-20. It is intended to make the setup reproducible on another VM.

This is a one-way Google Drive-to-local mirror, not a versioned or immutable backup. Google Drive is the source; the local VM copy is the destination.

The intended Google account is marc.ouellet@gmail.com. OAuth tokens and client credentials are intentionally excluded from this note.

Paperless-ngx Document Management and Backup#

This note documents the Paperless-ngx deployment on HP1Docker (10.1.2.202), its document locations, and the file-level backup path to HP1TrueNAS (10.1.2.201). It reflects the live configuration inspected on 2026-09-14.

1. Service architecture#

Paperless-ngx runs from /home/marc/docker-compose/paperless on HP1Docker using Docker Compose:

The Compose definition is stored at:

Synology Administration Guide#

1 Syncthing Deployment#

1.1 Synology DSM Implementation (Docker)#

1. Inotify Limit:

   echo "fs.inotify.max_user_watches=204800" | sudo tee -a /etc/sysctl.d/90-override.conf
   sudo sysctl -p /etc/sysctl.d/90-override.conf

2. User IDs: Use Task Scheduler to run id > /volume1/docker/id.txt to find UID/GID (e.g., 1027/100).
3. Docker Compose Highlights:

   environment:
     - PUID=1027
     - PGID=100
     - TZ=America/New_York
   volumes:
     - ./config:/config
     - /volume2/HP3Storage:/volume2/HP3Storage

1.2 Standard .stignore Patterns#

Create a .stignore file in the root of the sync folder:

(?i)#recycle
@eaDir
.DS_Store
.stfolder
.stignore
$RECYCLE.BIN
Thumbs.db
Desktop.ini
.SynologyWorkingDirectory

2 Storage & Maintenance Commands#

2.1 iPerf3#

sudo -i
synogear install
iperf3 -s -p 11111

2.2 Locked Folder Cleanup#

Remove Synology metadata directories when cleaning up a locked folder:

Linux - Aliases#

Ubuntu Workstation Configuration#

The Ubuntu workstation keeps Linux aliases in the tracked Scripts repository rather than duplicating them directly in .bashrc:

/home/marc/Scripts/Linux/Aliases/Linux-Aliases.bash

The local /home/marc/.bashrc sources this file. After pulling alias changes, reload the shell with:

source ~/.bashrc

The active workstation aliases are:

The MacOS aliases and scripts are not sourced or modified by this configuration.

Lab-VM Virtual Machines & Container Network Security Analysis#

VERDICT: [VERIFIED] SECURE AND HARDENED SECURITY SCORE: 97 / 100 (Grade: A+) An empirical security audit of the Lab-VM network (10.1.2.0/24, interface br12) confirms that your core application workloads — including the High Availability Pi-hole DNS cluster (10.1.2.8), Docker container hosts, Nextcloud/Owncloud private clouds, Synology DSM VMs, GPU compute nodes, LubeLogger, and virtual NAS appliances — operate on an isolated 10G SFP+ aggregated network (USW Aggregation 2) protected by Linux kernel firewall rules (iptables), gateway management isolation, active honeypot detection (10.1.2.254), and strict inter-VLAN boundary drops.

NAS Backup Pipeline: Backrest, Restic & Google Drive#

Complete configuration guide for backing up isolated TrueNAS/DSM network shares from the headless Ubuntu VM (HP1Docker) to an encrypted Google Drive repository using Backrest (a Web UI wrapper for Restic) and Rclone. For baseline Rclone installation, remote management, and CLI commands, see the RClone Guide.

1. System Architecture Overview#

• Source Data: 8 explicit network shares mounted via CIFS/SMB on the host VM at /mnt/<ShareName>.
• Backup Host: Ubuntu VM (HP1Docker - 10.1.2.202).
• Backup Agent: Backrest Docker Container running Restic 0.18.1.
• Target Backend: Google Drive (proxmox.app@gmail.com) via a dedicated Rclone remote.
• Security Model: Client-side, zero-knowledge encryption via a dedicated repository password before data leaves the local host.
• Rate-Limit Protections: Powered by a custom Google Cloud Project ID to bypass global multi-user API query restrictions during multi-terabyte data transfers.

2. Directory Structure Setup#

All configuration and container runtime files are centralized on the host under the user deployment directory.

1Password CLI & Docker Deployment Guide#

2026-08-03 Troubleshooting popups for MCP server with account tokens - To implement on VM’s using OP: agy –conversation=22663bf8-df61-4167-99ad-7a3d9884c879 1

1. Installation#

1.1. Install 1Password CLI (Linux VM)#

# 1. Add the key
curl -sS [https://downloads.1password.com/linux/keys/1password.asc](https://downloads.1password.com/linux/keys/1password.asc) | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg

# 2. Add the repository
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] [https://downloads.1password.com/linux/debian/amd64](https://downloads.1password.com/linux/debian/amd64) stable main' | sudo tee /etc/apt/sources.list.d/1password.list

# 3. Update and Install
sudo apt update && sudo apt install 1password-cli

1.2. Install 1Password CLI (LXC)#

# 1. Add the key
# 1. Ensure system initialization package is present
sudo apt update && sudo apt install systemd-sysv -y

# 2. Add the key securely
curl -sS [https://downloads.1password.com/linux/keys/1password.asc](https://downloads.1password.com/linux/keys/1password.asc) | sudo gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg

# 3. Add the official repository
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] [https://downloads.1password.com/linux/debian/amd64](https://downloads.1password.com/linux/debian/amd64) stable main' | sudo tee /etc/apt/sources.list.d/1password.list

# 4. Update repositories and install the CLI
sudo apt update && sudo apt install 1password-cli -y

1.3. Install 1Password CLI (macOS)#

# Install via Homebrew
brew install 1password-cli

2. Authentication & Account Setup#

2.1. Initial Account Setup (One-time)#

To add your 1Password account to the CLI manually:

1 Docker Installation & Management Guide#

1. Install Docker on Ubuntu#

Official Docker Documentation

apt-get install ca-certificates curl -y
install -m 0755 -d /etc/apt/keyrings
curl -fsSL [https://download.docker.com/linux/ubuntu/gpg](https://download.docker.com/linux/ubuntu/gpg) -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] [https://download.docker.com/linux/ubuntu](https://download.docker.com/linux/ubuntu) \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

apt-get update && apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

usermod -aG docker marc
newgrp docker

systemctl enable docker.service && systemctl enable containerd.service
systemctl status docker.service
systemctl restart docker
systemctl stop docker
systemctl status docker

If in Ubuntu, edit the service file so the internal firewall is not overridden and to prevent Docker from creating ghost files if SMB shares are not mounted (to deactivate, just remove the text):

Syncthing Installation & Configuration Guide#

1. #truenas TrueNAS Scale Installation#

Increase Inotify Limit#

For real-time file watching on large datasets, increase the inotify limit in the TrueNAS backend.

1. Go to System Settings > Advanced > Sysctl.
2. Add New Sysctl:
   • Variable: fs.inotify.max_user_watches
   • Value: 524288
   • Description: Increase inotify limit for Syncthing.
3. Verify persistence via Shell:

cat /proc/sys/fs/inotify/max_user_watches

App Deployment#

1. Apps > Settings > Advanced: Disable “Host Path Safety Check” (if using existing datasets).
2. Catalog: Search for and install the Syncthing Enterprise version.
3. Storage Configuration:
   • Type: Host Path
   • Host Path: /mnt/HP1-4TBSSD-Raid0/HP1Storage (or your specific data path).
   • Mount Path: HP1Storage
4. Access: Open the Web UI at http://[IP]:31000. Set an Admin password immediately.

2. Synology DSM Installation (via Docker)#

Increase Inotify Limit#

1. Connect via SSH and run:

echo "fs.inotify.max_user_watches=204800" | sudo tee -a /etc/sysctl.d/90-override.conf
echo 204800 | sudo tee /proc/sys/fs/inotify/max_user_watches

Identify User IDs (PUID/PGID)#

To avoid permission issues, run the container as your specific user.