📖 Chapter 06 — Sharing with Collaborators

Editors, colorists, sound engineers, contractors. The right amount of access for the right amount of time.

Learning Objectives

• Decide what to share with which kind of collaborator
• Configure a per-project share with the right permissions
• Time-limit and audit access
• Use modern cloud alternatives when on-site collaborators aren't practical

Introduction

You finished the cut. Now you need a colorist. Or a sound designer. Or an editor for the next video. Or a translator for the international version.

Whoever it is, they need access to the project files. They don't need access to the rest of your NAS. They need enough access to do their job and not a byte more.

This chapter is about that.

The four kinds of collaborators

For a video project, the common collaborators are:

1. The editor: needs the source media, project files, and audio. Often the only collaborator for a YouTube video.
2. The colorist: needs the source media and project files. May need the audio for sync, but not for editing. Often works in a different NLE or a different version of the same NLE.
3. The sound designer / mixer: needs the rendered video, the original audio, and the project files (if they're mixing inside the NLE).
4. The contractor / vendor: needs the deliverables, not the project files. Examples: a YouTube agency that uploads the final video, a transcription service, a localization vendor.

For each, the access pattern is different.

The default: share the project folder, nothing else

For all four types, the principle is the same: create a per-project share with the right permissions, time-limit it, audit it.

The setup:

1. Create a dataset (or subdataset) for the project: Media/Shared/<project-slug>.
2. Create a TrueNAS user for the collaborator: collab-<name>.
3. Copy the project files into the share. (Not the entire Media/Active; just this project's folder.)
4. Set permissions: collaborator owns the share (read-write), tk owns the parent (so you can manage it).
5. Create an SMB share pointing at the folder. Allow only the collaborator user.
6. Send the collaborator the connection details (Tailscale setup + SMB path + credentials) over a secure channel.
7. Set a calendar reminder for the project's end date. On that date, disable the user.

The collaborator sees one project. They don't see the rest of the NAS. They can't see your family's photos or other projects.

The contractor / vendor pattern

For a contractor who only needs the final deliverable (a YouTube upload, a transcription, a translated version), the right tool is a public link, not a share.

• Render the final video. Upload it to a temporary file-sharing service (the conversation mentioned frame.io, Dropbox, MASV).
• Send the link with password protection and an expiration.
• When the contractor is done, revoke the link.

This is the same pattern as Volume 2, Chapter 7: least privilege, time-limited, no account needed. For most one-off vendor relationships, a public link is the right answer.

The editor pattern

For an editor who'll be working on the project for weeks or months, a real account with SMB access is the right answer. The flow:

1. Create the project dataset (as above).
2. Create the user.
3. Give the editor write access to the project folder, read access to the source media (which lives in a separate read-only share).
4. The editor connects via Tailscale + SMB, downloads what they need, works locally, uploads cuts back to the share.
5. You sync the cuts back to your Media/Active via Syncthing or a manual copy.

The conversation's recommendation: editors work on their own machines, not on the NAS. The NAS is for sharing the source and the project; the editing happens on the editor's local SSD. This is the same hybrid workflow as your own editing (Chapter 01). The editor's laptop is their scratch; the NAS is the working folder.

The colorist pattern

Colorists often have specific requirements:

• They work in DaVinci Resolve, sometimes a different version than yours
• They need the original camera RAW or the highest-quality transcoded media
• They want a specific folder structure that matches their workflow

The setup is similar to the editor pattern, but the dataset is sized larger (colorists work with high-bitrate media) and the share is set up with the colorist's preferred folder structure. The conversation's recommendation: ask the colorist what they need. They have a workflow; respect it.

The sound designer pattern

Sound designers often work in Pro Tools, Audition, or Reaper. They need:

• The rendered video (for reference and sync)
• The original audio (separated tracks if possible)
• Sometimes the project files (if they're working inside the NLE)

For a Pro Tools workflow, the project files are .ptx or .ptf, which the NAS handles fine. The audio files (WAVs at 48kHz/24bit or higher) are big but manageable.

Time-limiting access

Every collaborator account has an end date. Set it when you create the account:

• Add a calendar reminder: "Disable collab-eric on 2026-08-15."
• When the date arrives, disable the user (don't delete; disable).
• If the project extends, re-enable and update the calendar.

For a project that's done: disable the user, remove the share. The project files stay in the archive; the access goes away.

Auditing access

TrueNAS's SMB audit logging (configured in Volume 2, Chapter 7) is your friend here. It records every file open, every write, every delete. If something goes wrong ("the colorist changed a project file I didn't want changed"), the log tells you what happened.

For an extra level of protection: enable audit logging on the specific project share, not just globally. This keeps the logs focused on collaborator activity.

The Tailscale setup for collaborators

From Volume 1: Tailscale is how you reach the NAS remotely. For collaborators:

1. Create a Tailscale account for the collaborator (or share the same Tailscale network if they're family).
2. The collaborator installs Tailscale on their machine.
3. They can now reach the NAS at its Tailscale IP, exactly as if they were on your LAN.

Tailscale is the right tool for collaborators because:

• It works from anywhere in the world (their home, a coffee shop, a co-working space)
• It's encrypted end-to-end
• It doesn't require port forwarding on your router
• It doesn't expose your NAS to the open internet

The setup is the same as for you; the difference is the account. Each collaborator has their own Tailscale identity.

The "what about cloud collaboration tools" question

For some workflows, a cloud collaboration tool is the right answer:

• Frame.io (now part of Adobe): the standard for video review and approval. Comments on the timeline, version control, share with reviewers.
• Dropbox / Google Drive: for small files, project files, and round-trip review.
• Blackmagic Cloud: if you're already in the DaVinci Resolve ecosystem.

These tools have a place, but they have costs: monthly subscriptions, storage limits, and (for very large projects) bandwidth caps. For a home creator with a 50-200 GB project, the NAS + Tailscale + SMB pattern is often more cost-effective.

Use the cloud tools for what they're good at (review and approval, small file round-trip). Use the NAS for what it's good at (large files, source media, archives).

When the project ends

The project is done. The collaborator is done. Time to clean up:

1. Disable the collaborator's TrueNAS user.
2. Remove the SMB share (or just disable it).
3. Remove the project dataset (or keep it as part of the archive, depending on the structure).
4. Remove the collaborator from the Tailscale network (or move them to a "limited" group with no NAS access).
5. Verify by trying to access the share as the collaborator (should fail).

When this is done, the project is in the archive, the collaborator has no more access, and the system is clean for the next project.

Engineering Note

Summary

Create a per-project share for each collaborator, time-limited, audited. Editors work on their own machines (hybrid workflow). Colorists and sound designers have their own preferred patterns. Contractors get public links, not accounts. Disable access on project end. Tailscale for remote access. Use cloud tools for what they're good at, the NAS for what it's good at.

Checklist

• ⬜ Document the convention: "what does a collaborator get by default?" and stick to it
• ⬜ When starting a new project with a collaborator, create the share + user immediately
• ⬜ Set a calendar reminder for the project's end date
• ⬜ Enable SMB audit logging on the project share
• ⬜ Quarterly: review active collaborator accounts, disable the ones that should be

Looking Ahead

Chapter 07 is the last chapter of Volume 3. It covers when to upgrade: the signs that the storage pyramid is straining, the right time to add an SSD pool, when to upgrade to 10 GbE, when to add a second NAS, when to consider cloud offload. The chapter that makes the NAS a long-term tool, not a 3-year-then-replace project.

Ch 06 · v0.1 · drafted from the original ChatGPT conversation, July 2026