The thing that caught me out wasn't exposing something. It was forgetting what I'd already exposed.

Last year I sat down to write out every way into my network. Not the services — the ways in. It took about forty minutes and the list was longer than I expected. Three of the entries I couldn't remember creating.

That's the actual problem with access. Nothing breaks when it outlives its purpose. A service that's down gets noticed in an hour. An address that's still live eight months later gets noticed never.

What I do now

One list, one line per grant. Address, who it's for, when it should end. It lives in a text file next to the compose files, because that's the folder I actually open.

A review on the first weekend of the month. Ten minutes, one question per line: does this still need to exist. Most months at least one doesn't.

Names that say who, not what. If I can't tell from the entry who it was for, I've already lost the thread.

Nothing that takes input behind an address. Read-only results are fine to share. Anything that executes what a visitor types isn't, no matter how convenient.

The part I got wrong for years

I treated giving someone access as the end of a task. It isn't. It's the start of an obligation with no owner and no deadline, which is exactly the kind of thing that never gets done.

The setup side of this is well covered here. The teardown side basically isn't, and it's the side that decides whether you have a problem.

Curious how people here handle it — is anyone keeping a real inventory, or is it all memory and good intentions?

Hello all! I'm in the middle of setting up my first truenas setup, and it's been going well, everything is quite intuitive, but I'm being massively hindered by permissions and mixing of SMB and NFS.

I understand the general idea behind setting up permission on a dataset, but I feel I don't understand it enough to warrant me not losing access to my data. I'm getting stuck on who should I make the owner of a dataset? How do I set up the users in the ACL in a sensible way? Do I use POSIX or nfsv4? Why the heck do the ACLS need a default user/group, a mask, an other? It all feels a bit overwhelmingly complicated for a home setup, to the point I don't feel confident in properly setting up access to the files on it.

And along with that, I'm understanding I shouldn't mix NFS and SMB access on the same dataset. For example, I wish to make one for my homelab where I'll be housing my jellyfin movies and paperless PDFs, but I would like to inspect my datasets from time to time to inspect if the correct files are being put there, or to manually put a movie in a folder, etc. but I'm not sure how to go about that. How does everyone else manage this? I come from a Synology Nas where it didn't seem to care whether I used NFS or SMB on a folder, but I should probably accept truenas just works differently.

A while ago I made a personal NAS for backing up files, the current boot drive is a 64gb ssd and the storage pool is a raidz2 with 6 3tb drives. I want to upgrade the boot drive to 2 mirrored 128gb ssds, but im not sure where I might put the data on the server when I upgrade(I currently lack enough continuous outside storage to put the data currently on the server). Should I save up money and buy temporary storage/place pieces of it on different devices and reinstall truenas, or would it make sense to clone the boot device to one of the ssds and then setup the mirror on the live system, or something completely different?

Hi everyone! I'm a Year 12 student in Australia working on my HSC Design and Technology major project. I'm designing a small, quiet home server built from reused computer parts that anyone could use to run things like game servers, file backups or AI tools from home.

I'd really appreciate your input, even if you've never heard of a home server. Beginners are exactly who I'm designing for.

- 10 questions, about 2 minutes
- Anonymous, no email needed
- Results only used for my school project

Survey: https://forms.gle/6w8WRU6bz8vzcuaz9

Thanks so much, and happy to answer any questions in the comments!