📖 Chapter 07 — Extending to Friends

How to share with non-family members without compromising the family system.

Learning Objectives

• Decide when to give a friend a real account vs a time-limited public link
• Apply the principle of least privilege to non-family access
• Set up scope-limited shares for specific use cases (a friend's photos, a relative's documents)
• Audit and remove access when it's no longer needed

When to extend the NAS

The original conversation covered two specific use cases:

• "Maybe one day I'll save some space for friends so they can log in with their own credentials and use my NAS." A friend wants their own account, a small amount of storage, access to share files with you.
• Extended family who might want to access shared content. Cousins, parents, in-laws who want to see the family photos without joining Immich.

There are also less common cases:

• Contractor who needs access to plans or documents for a project
• Babysitter who needs the family calendar
• Friend who needs a large file transfer (better than email)

For each case, the question is the same: what's the least access I can give them while still meeting the need?

The two patterns

Pattern 1: Real account (full or limited)

Create a TrueNAS user for the person. They log in with their own credentials, see only what their permissions allow.

Best for: recurring access, especially when the person needs to upload as well as download.

Pros: works like any other user, easy to manage, easy to revoke (just delete the user or change the password).

Cons: a real TrueNAS user is a real attack surface. If their password is weak, the attacker can log in as them.

Pattern 2: Public link (Immich, Paperless, Nextcloud)

Generate a time-limited URL that anyone with the link can use. No account required.

Best for: one-off access, especially when the person only needs to view or download.

Pros: no account to manage, easy to expire, works for non-technical recipients.

Cons: anyone with the link has access (if forwarded or discovered). Limited to apps that support public links (Immich, Paperless, Nextcloud).

Decision tree

Use this when deciding how to share:

1. Do they need a recurring login, or is this one-off? One-off → public link.
2. Do they need to upload files, or just view/download? Just view → public link.
3. Will the relationship last years (a friend, a cousin), or is it short-term (a contractor)? Short-term → public link, or real account with expiration.
4. Is the content sensitive (medical, financial, family-only)? Sensitive → real account with explicit permissions, no public link.

Default: public link unless there's a real reason for an account. The principle of least privilege cuts both ways — it means giving the minimum access, and a public link is usually less access than a real account.

Real account: setting up a friend

For a friend who wants their own storage on your NAS:

1. Credentials → Local Users → Add. Create the user. No admin privileges. Samba auth enabled. nologin shell (they're accessing via SMB only, not SSH).
2. Create a dataset for them: tank/Friends/<name>. Quota: 50-200 GB. Encryption: yes (if the data is personal to them).
3. Set the dataset permissions: owner = the user, group = the user, mode 700.
4. Create an SMB share: \\NAS\Friends\<name>. Access Based Share Enumeration on. Allow only the friend user.
5. Send the friend their username, password, and connection instructions. Use a secure channel (Signal, in person).
6. Make sure the friend changes their password on first login (Settings → Password Complexity can enforce this).

That's it. The friend has their own little corner of the NAS. They can't see anything else. You can revoke by changing the password or deleting the user.

Quota: the polite cap

Without a quota, a friend could fill the pool with their photos. Set a quota based on the size of the relationship:

• Close friend: 200-500 GB
• Casual friend: 50-100 GB
• Cousin sharing family content: 100 GB

Quotas are soft by default (they warn before they block). Use a hard quota if you really want to enforce.

When to remove access

Real-account access doesn't expire by default. You have to revoke it explicitly. Set calendar reminders:

• Quarterly: audit the list of non-family users. Are they still needed? Still in the picture?
• After a falling-out: remove access the same day, no debate.
• After the relationship naturally ends: remove access within a week.

Public link: the safe default for one-off sharing

For "send grandma the photos from the wedding" or "send the contractor the plans for the kitchen reno," the public link is the right answer. The setup, in each app:

Immich

Open the album. Click Share → Create Public Link. Set:

• Password: on, share the password through a different channel than the link
• Expiration: 30 days for a wedding album, 7 days for a contractor
• Download allowed: on (most cases), off (if you want them to view but not save)
• Show metadata: on (most cases)

Paperless

Open the document. Click Share → Create Public Link. Set password, expiration, and (optionally) allow download.

Nextcloud

Open the file or folder. Click Share. Choose "Create link." Set password, expiration, and permissions (read-only, read-write, etc.).

The right way to share the password for a public link

If you set a password on a public link, you have to communicate the password separately from the link. If both go in the same message, the protection is meaningless.

The right way:

• Link via iMessage/Signal/email (any channel)
• Password via a different channel (text message, voice call, in person)

This is overkill for a wedding album. It is not overkill for a contractor accessing plans that include the family's home address.

The right way to handle a friend who needs ongoing access

If a friend is going to be a recurring user, do these things:

1. Give them a real account (Pattern 1), not a public link.
2. Document the arrangement. "You have 200 GB on my NAS, accessible at \\<nas>\Friends\<name>, username \\<name>, password from Signal."
3. Set a quota so they don't fill the pool.
4. Add a note to your calendar to check in on the relationship quarterly. Are you still friends? Do they still need access?
5. If the relationship ends, remove their access the same day.

What NOT to do

• Don't share your admin password with anyone. Even close friends. Even family members who "just need to check one thing." Give them a separate account.
• Don't create accounts with no expiration and then forget about them. The conversation's rule: every non-family account has a "review date" attached to it.
• Don't use guest/anonymous SMB access "for simplicity." It removes the audit trail. If something goes wrong, you can't tell who did it.
• Don't put sensitive content in a share that has multiple users. If a friend has access to \\NAS\Shared and that share contains a folder of tax documents, the friend has access to the tax documents.

Logging: who accessed what

TrueNAS has built-in audit logging. Enable it for SMB shares:

1. System → Audit → Settings. Enable audit logging.
2. Choose what to log: SMB access (connect, open file, write file, delete file).
3. Where to store the logs: a dedicated dataset (or send to a syslog server if you have one).

When something goes wrong ("who deleted this file?"), the audit log answers the question. The conversation's recommendation: enable SMB audit logging from day one. The cost is small (a few MB per day). The value is enormous.

Engineering Note

Summary

Two patterns: real account (recurring access, full upload/download) and public link (one-off, view-only). Default to public links. Give real accounts only when there's a real reason. Use quotas to cap abuse. Enable SMB audit logging. Review non-family accounts quarterly. Remove access promptly when relationships end.

Checklist

• ⬜ Enable SMB audit logging on the TrueNAS system
• ⬜ For each non-family user, set a quota
• ⬜ Set a quarterly calendar reminder to audit non-family access
• ⬜ Document the convention: "what do we do when a friend needs access?" and stick to it

Volume 2 is complete

This is the last chapter of Volume 2. The NAS is now a family system: photos, videos, documents, calendar, contacts, with safe access for friends. Volume 3 takes the next step: turning the NAS into a creator's tool. Video production, project archives, the YouTube workflow. The foundation you've built supports it all.

Ch 07 · v0.1 · drafted from the original ChatGPT conversation, July 2026