📖 Chapter 10 — The Build

The complete configuration in one place. The chapter you reference when you forget how a piece works.

Learning Objectives

• Reference the exact configuration of TK's pool from one place
• Reproduce the configuration on your own hardware
• Understand the order of operations for the initial build

Introduction

This is the chapter to come back to. The previous nine chapters explain why. This one is just what. The dataset tree, the users, the shares, the snapshot policies, the apps, the maintenance schedule. Print it, bookmark it, refer to it whenever you forget "wait, did we put a quota on the PhoneUploads dataset or not?"

If you're building your own NAS, this is the chapter that walks through the actual setup in the right order.

Hardware baseline

For TK's setup, the conversation converged on this hardware profile. Yours may differ; the structure below is what to aim for.

The dataset tree

This is the entire filesystem layout for TK's NAS. The conversation went through several revisions; this is the v2.2 final:

Dataset properties

The compression, quota, and encryption settings per dataset:

Permissions matrix

The full owner / group / mode for every dataset (from Chapter 07):

Users and groups

The complete user list (from Chapter 06):

When future family members or friends need access, add them to the Family group (for shared datasets) and create a Private/<name> subdataset for their personal data.

SMB shares

The complete share list (from Chapter 05). One share per top-level dataset; private subdatasets are not shared at the top level (they're accessed via the Private parent share or individually if needed).

Snapshot policies

The full schedule (from Chapter 09):

Maintenance schedule

The automation that runs on TK's pool (from Chapter 09):

Apps (the install order)

The order in which to install apps (from Chapter 08):

1. Tailscale — for remote access (install first; you need it for everything else)
2. Immich — for the family photo library (highest-value data)
3. Jellyfin — for media streaming (the "wow" app)
4. Vaultwarden — for password management (when the family is ready)
5. Paperless-ngx — for document scanning (when the family trusts the system)

Network access

• Local access: SMB at \\<nas-name>\<share-name> or smb://<nas-name>/<share-name>. No VPN needed.
• Remote access: Tailscale. From any device signed into the same Tailscale account, use the Tailscale IP (e.g. 100.x.y.z) exactly like a local IP.
• No public SMB. Port 445 is closed to the internet. Period.
• Apps accessed remotely go through the same Tailscale network. The Immich web UI is at http://100.x.y.z:3001, for example.

The order of operations for the initial build

Don't try to do everything at once. This is the recommended order. Take a break between major steps.

Day 1: Hardware and base install

1. Assemble the hardware. Drives in the case, motherboard in the case, cables connected.
2. Connect to a monitor and keyboard. Boot from the TrueNAS installer USB.
3. Install TrueNAS to the boot SSD (or mirror).
4. Reboot. The system comes up with a web UI on a known IP (DHCP) or with a console prompt for static IP setup.
5. From a laptop, browse to the TrueNAS web UI. Complete the initial setup wizard.

Day 2: Pool and datasets

1. Storage → Create Pool. Name it tank. Choose RAIDZ2. Select all 6 drives. Confirm. Wait for the resilver to complete (15-30 minutes for an empty pool).
2. Storage → Create Dataset. Create each dataset in the tree above. Set the compression, quota, and encryption per the table.
3. Storage → Create Dataset (Child) for Private/<name> for each family member.
4. Verify the tree matches the diagram above.

Day 3: Users and groups

1. Credentials → Local Groups → Add. Create the Family group.
2. Credentials → Local Users → Add. Create tk with admin privileges, Samba auth, /bin/bash shell.
3. Create Mimi, Lai. No admin, Samba auth, nologin shell.
4. Add each user to the Family group.
5. From a laptop, try \\<nas-name>\ in File Explorer. Verify you can log in as tk and see the empty top-level shares.

Day 4: Shares and permissions

1. Shares → SMB → Add for each dataset in the share table above.
2. Set the dataset permissions per the matrix above (owner, group, mode, ABSE).
3. Test: log in as Mimi from a different laptop. Verify she can see Family/Photos/Videos/Documents/PhoneUploads/Apps/Media but NOT Private or Lab.

Day 5: Snapshot and scrub schedules

1. Data Protection → Periodic Snapshot Tasks → Add for each schedule in the snapshot table.
2. Data Protection → Scrub Tasks → Add. Pool = tank. Schedule = monthly.
3. Data Protection → S.M.A.R.T. Tests → Add. All data drives. Schedule = weekly short, monthly long.
4. Set up email alerts: System → Email. Add your address. Enable alerts for SMART failures, scrub errors, and snapshot failures.

Day 6+: Tailscale and the first app

1. Install Tailscale from the Apps catalog. Sign in. Install Tailscale on your laptop and phone.
2. Verify: from your phone on cellular, you can reach the NAS at its Tailscale IP.
3. Install Immich. Set up family users. Install the mobile app. Enable auto-upload.
4. Wait a week. Make sure Immich is working. Then move to the next app.

Week 2+: Jellyfin

1. Install Jellyfin. Set up the Media library. Stream something.
2. Wait. Make sure Jellyfin is working.

Week 3+: Vaultwarden and Paperless-ngx

1. Install Vaultwarden. Import passwords. Install browser extension.
2. Install Paperless-ngx. Start scanning.

That's a 3-week build. The discipline is what makes it feel stable. Don't skip the wait periods.

Verification checklist (before you trust it)

Before you put irreplaceable data on this NAS, run through this checklist:

• ⬜ All 6 drives are showing in Storage → Disks with healthy SMART status
• ⬜ The pool shows as "ONLINE" with no errors
• ⬜ The dataset tree matches the diagram above
• ⬜ All 4 family users can log in via SMB
• ⬜ Each user can see only the shares they're supposed to see
• ⬜ A test file dropped into Photos is visible to all family members
• ⬜ A test file in Private/Tom is visible only to Tom (and tk, the admin)
• ⬜ A snapshot is being created (check Storage → Snapshots tomorrow)
• ⬜ A scrub is scheduled (Data Protection → Scrub Tasks)
• ⬜ SMART tests are scheduled
• ⬜ Email alerts are working (send a test)
• ⬜ Tailscale is installed and you can reach the NAS from your phone on cellular
• ⬜ SMB is NOT exposed to the internet (no port forwarding for 445 on the router)

Engineering Note

Summary

One pool, one vdev, RAIDZ2, 6 × 12TB, ~44TB usable. Family group + per-user private subdatasets. One SMB share per top-level dataset. LZ4 compression everywhere, encryption on private subdatasets. Hourly/daily/weekly/monthly/yearly snapshot policies per dataset. Monthly scrubs, weekly SMART tests. Five apps in install order: Tailscale, Immich, Jellyfin, Vaultwarden, Paperless-ngx. Tailscale for remote access, no public SMB. Email alerts on SMART failures and scrub errors.

Checklist

• ⬜ Print this chapter. It's the reference you'll come back to.
• ⬜ Save the configuration tables somewhere safe (a separate file in the Lab dataset, a printout in the server room)
• ⬜ When you make changes later, update this chapter and bump the version number

Looking Ahead

Volume 1 is complete. Volume 2 — Family NAS — goes deeper into the apps and the family-facing experience: how to make Immich work for everyone, how to share albums, how to handle the family's media library, and how to add a friend or extended family member to the access list. The next volume turns the foundation into a household service.

Ch 10 · v0.1 · drafted from the original ChatGPT conversation, July 2026