📖 Chapter 08 — First Apps
The five services that turn a NAS into something the family actually uses.
Learning Objectives
- Understand what "apps" means in TrueNAS (Docker containers)
- Install your first TrueNAS app from the catalog
- Configure Tailscale for remote access without port forwarding
- Decide which of the 25+ available apps you actually need
Introduction
A NAS without apps is a file server. A NAS with apps is infrastructure. The five apps in this chapter are the ones that turn TK's pool from "place to put files" into "the system our family depends on."
The install order matters: each app assumes the previous one is in place. Don't skip ahead — Tailscale before Immich, Immich before Paperless-ngx. The order is the order you should deploy them.
What "apps" means in TrueNAS
TrueNAS SCALE apps are Docker containers managed by a system called Kubernetes (specifically, a lightweight distribution called K3s). When you install an "app" from the TrueNAS catalog, TrueNAS:
- Downloads the app's container image
- Creates a Kubernetes deployment that runs the container
- Mounts the app's data directory from your pool (typically
/mnt/tank/Apps/<appname>) - Exposes the app's web UI on a port (e.g. http://your-nas:3000)
- Starts the container, monitors it, restarts it if it crashes
You don't need to know Kubernetes to use TrueNAS apps. The web UI handles all of it. But knowing it's Kubernetes under the hood helps you understand why some apps have specific storage requirements, why updates are sometimes tricky, and why you might want to learn K3s later (Volume 4).
App data lives in the `Apps` dataset
Every app stores its configuration, database, and user-uploaded files in a subdirectory of your Apps dataset:
You don't have to manage this structure. The TrueNAS app installer creates it for you. But knowing where the data lives helps when you need to back it up, restore it, or move it to a new pool later.
App 1: Tailscale (do this first)
Purpose: Secure remote access to your NAS without port forwarding.
Why first: Once Tailscale is set up, you can install and manage every other app from anywhere in the world. Without Tailscale, you have to be on the home network.
What Tailscale is
Tailscale is a mesh VPN built on WireGuard. Instead of opening ports on your router, you install a small client on each device you want to connect (your NAS, your laptop, your phone). Tailscale creates a private network between them — your devices see each other as if they were all on the same LAN, even when they're scattered across the world.
It's much easier to set up than traditional VPN. There's no firewall config, no port forwarding, no certificates. Install the client, log in, done.
Why this matters
The most common security mistake on a home NAS is opening SMB (port 445) to the internet. This is a guaranteed way to get ransomware. Tailscale lets you reach the NAS from anywhere in the world without opening any ports. Your NAS is invisible to the public internet; only your Tailscale-authenticated devices can reach it.
Installation
- In TrueNAS, go to Apps → Discover → search "Tailscale".
- Install the official Tailscale app.
- Authenticate using the URL Tailscale provides. Sign in with your Google, Microsoft, or GitHub account.
- Note the Tailscale IP assigned to your NAS (something like 100.x.y.z).
- Install Tailscale on your laptop and phone, sign in with the same account.
- From your laptop, you can now reach the NAS at
100.x.y.zas if it were on your home network.
The alternative (and why not to use it)
You could open ports on your router and expose SMB directly to the internet. Don't. The conversation was explicit: never expose SMB directly to the internet. Tailscale is the right answer.
Setting up Tailscale but still using the public IP / dynamic DNS to reach the NAS. Defeats the purpose. Once Tailscale is in place, use the Tailscale IP exclusively for remote access.
App 2: Immich (your photo library)
Purpose: A self-hosted Google Photos replacement.
Why second: Photos are the highest-value data on the NAS. Immich handles them with care, and it pairs with the Tailscale install for remote access from phones.
What Immich does
- Auto-uploads photos and videos from your phone
- Organizes by date, location, person, and object (with on-device ML)
- Searches by face, place, object, time
- Shares albums with family (or with anyone, via a public link)
- Backs up to the original-resolution files on the NAS
Installation
- Apps → search "Immich" → install.
- Choose the dataset:
tank/Apps/immich. - Set an admin email and password during install.
- Once running, visit
http://your-nas:3001(or via Tailscale) to log in. - Install the Immich mobile app on each family member's phone. Sign in with the NAS URL + their credentials.
- Enable auto-upload. The phone will start backing up photos in the background.
Why this over the PhotoUploads landing zone
Earlier in the conversation, TK considered using a `PhoneUploads` dataset where phones would auto-upload via SMB. He decided against it (didn't want to waste bandwidth on junk — screenshots, memes, etc.). Immich is a better answer: it does the auto-upload, but it lets the user curate the library. The phone's full photo roll is preserved; the curated library is what shows up when you browse.
App 3: Jellyfin (your media server)
Purpose: Stream movies, TV shows, and music to every device in the house.
Why third: After Tailscale and Immich, you have the rhythm of installing an app. Jellyfin is the next one that gives the most "wow" per minute of setup time.
What Jellyfin does
Jellyfin is a free media server. Point it at a folder of videos or music, and it:
- Indexes everything with metadata (titles, posters, episode lists)
- Transcodes video on-the-fly for whatever device you're watching on
- Tracks what you've watched, where you stopped, what's next
- Streams to browsers, smart TVs, phones, tablets, Roku, Apple TV, etc.
Installation
- Apps → search "Jellyfin" → install.
- Mount your media library:
/mnt/tank/Media(or a subdirectory). - Add library folders through the Jellyfin web UI: Movies, TV Shows, Music, etc.
- Create user accounts for each family member (or one shared "Family" account for a TV).
- Install the Jellyfin app on whatever device you want to watch from.
Hardware note
Jellyfin can transcode video using your NAS's CPU. For 4K HDR content, this can be heavy. If you have an Intel iGPU with QuickSync, configure Jellyfin to use it (the TrueNAS app has a setting for this). For 1080p content, CPU transcoding is usually fine on modern hardware.
App 4: Vaultwarden (your password manager)
Purpose: A self-hosted Bitwarden-compatible password manager.
Why fourth: Once you have a password manager for the family, you can use long random passwords everywhere without having to remember them. This is the single biggest security upgrade you can make for the family.
What Vaultwarden does
Vaultwarden is an unofficial, lightweight implementation of the Bitwarden server API. It's compatible with all official Bitwarden clients (browser extension, mobile app, desktop app). You get all the benefits of Bitwarden (encrypted password vault, password generation, autofill, secure notes) without paying for the hosted service.
Installation
- Apps → search "Vaultwarden" → install.
- Set the data path to
/mnt/tank/Apps/vaultwarden. - Sign up for a Vaultwarden account (the first user becomes the admin).
- Install the Bitwarden browser extension and mobile app on every device.
- Point them at your Vaultwarden URL:
https://your-nas/vault(or your Tailscale IP). - Import your existing passwords (most password managers can export CSV).
Why this matters
Strong, unique passwords for every site, generated and stored automatically. The family only has to remember one strong master password (the Vaultwarden password). For a family, this is the single highest-leverage security improvement you can make.
App 5: Paperless-ngx (your document archive)
Purpose: Scan, OCR, and search your paper documents.
Why fifth: Once your family is comfortable with the previous four apps, adding the fifth is a natural extension. It's also the one with the highest long-term payoff: years of scanned receipts, contracts, manuals, and warranties, all searchable.
What Paperless-ngx does
You send a scanned PDF or photo of a document to Paperless-ngx (by uploading, by email, or by an integrated scanner app). Paperless:
- OCRs the document (makes the text searchable)
- Auto-tags it based on content (date, document type, correspondent)
- Stores the original + the OCR text + the tags
- Lets you search across all of it: "show me the warranty for the dishwasher"
Installation
- Apps → search "Paperless-ngx" → install.
- Set the data path to
/mnt/tank/Apps/paperless. - Create an admin user.
- Start uploading scans (or set up the email-import feature).
- Configure a "consume folder" — drop scans in there, and Paperless will pick them up and process them automatically.
What about the other 20+ apps?
The conversation listed a "Top 25 apps" for a home NAS. The five above are the priority set. The rest, with brief notes:
| App | What it does | When to install |
|---|---|---|
| Nextcloud | Self-hosted Google Drive (files, calendar, contacts) | When you want to drop Google Drive |
| Syncthing | Continuous file sync between devices | When you need multi-device file access without SMB |
| Home Assistant | Smart home hub | When you start automating the house |
| AdGuard Home | Network-wide ad blocker (replaces Pi-hole) | Soon — it makes the whole network faster |
| Grafana + Prometheus | Monitoring dashboards | When Volume 4 lands |
| Nginx Proxy Manager | Web UI for managing reverse proxies | When you have 3+ web services to expose |
| Cloudflare Tunnel | Expose services publicly without port forwarding (alternative to Tailscale for public services) | When you want to host a public website from home |
| Gitea | Self-hosted Git server | When you have code to host (Volume 5) |
| BookStack / Wiki.js | Documentation wiki | When you want a knowledge base |
| Stirling PDF | All-in-one PDF toolbox | Convenience, install when convenient |
| Calibre-Web | E-book library and reader | When you have a lot of ebooks |
| Homarr / Heimdall | Customizable dashboard for all your services | When you have 5+ services and want one page to link to all of them |
| Miniflux | Self-hosted RSS reader | When you want to ditch Feedly |
| Frigate | AI-powered NVR for security cameras | When you add cameras |
| Mealie / Tandoor | Recipe manager | Family taste-dependent |
| Calibre | E-book organizer (desktop-grade) | Power readers only |
The install order
Strict order, with reasons:
- Tailscale — needed to manage the other apps from anywhere
- Immich — handles the highest-value data (family photos)
- Jellyfin — first "wow" app; family will actually use this
- Vaultwarden — once everyone has accounts, you can issue strong passwords
- Paperless-ngx — once the family trusts the system, document scanning
- Nextcloud (optional) — when you're ready to drop Google Drive
- AdGuard Home (optional) — when the network needs cleaning
Engineering Note
Each app is a new service that needs updating, monitoring, and securing. The conversation's principle of "build incrementally, never install five new services at once" is the right discipline. Don't install all five on day one. Install Tailscale, wait a week, make sure it works, then install Immich. Wait another week. Make sure Immich works. Then Jellyfin. The discipline is what makes a home NAS feel stable; the lack of it is what makes a home NAS feel like a science project.
Summary
TrueNAS apps are Docker containers managed by Kubernetes. They live in the `Apps` dataset, each in their own subdirectory. Install in this order: Tailscale (remote access), Immich (photos), Jellyfin (media), Vaultwarden (passwords), Paperless-ngx (documents). Don't expose SMB to the internet. Tailscale is the right way to reach the NAS from anywhere. The other 20+ apps in the catalog are great — install them when you have a real use for them, not before.
Checklist
- ⬜ Install Tailscale, set up a Tailscale account, install on your laptop and phone
- ⬜ Verify: from a coffee shop on your phone's Tailscale, you can reach the NAS
- ⬜ Install Immich, set up the family members as users, install the mobile app on each phone
- ⬜ Verify: a photo taken on a phone appears in Immich within a few minutes
- ⬜ Install Jellyfin, set up one media library, stream something to a TV or laptop
- ⬜ Install Vaultwarden, import your existing passwords, install the browser extension
- ⬜ (Optional) Install Paperless-ngx, scan a few documents, verify they're searchable
Looking Ahead
Chapter 09 covers snapshots and scrubs — the time-machine and monthly-maintenance features that protect your data even when the apps above accidentally delete it. Snapshots are the single most powerful feature in ZFS.