From 74042d039fa7786690f2ba6b83274b6d2700775c Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 11:33:27 +0000 Subject: [PATCH] Keep the app data private on a NAS and in backups Make the Synology docker shared folder admin-only and hidden, turn SSH off after installing, encrypt copies of pb_data that leave the machine, leave out the Tailscale key, and wipe a disk before giving it away. --- synology.md | 9 ++++++++- updates-and-backups.md | 20 ++++++++++++++------ 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/synology.md b/synology.md index 946e141..a67719f 100644 --- a/synology.md +++ b/synology.md @@ -21,7 +21,14 @@ It asks for your DSM password, which apps you want, and a folder (`/volume1/dock default, one folder per app). The apps show up in Container Manager under **Project**, where you can see their logs, stop and start them. -You can turn SSH off again afterwards; you only need it to update. +Turn SSH off again afterwards (Control Panel > Terminal & SNMP); you only need it to +update, and an SSH login with your DSM password is the easiest way into the NAS. + +**Keep the `docker` folder private.** It holds every app's database, backups and setup +code, and anyone who can open it over the network can copy them. In Control Panel > +Shared Folder, select `docker` > **Edit**: on **Permissions**, give *administrators* +Read/Write and every other user and group No access; on **General**, tick *Hide this +shared folder in "My Network Places"*. Don't sync it with Synology Drive or Cloud Sync. ## Without SSH diff --git a/updates-and-backups.md b/updates-and-backups.md index d20b7c9..371a333 100644 --- a/updates-and-backups.md +++ b/updates-and-backups.md @@ -55,12 +55,20 @@ On a Synology without SSH: Container Manager > Image, select the app's image and Each app keeps everything in the `pb_data` folder inside its own folder, and makes a nightly backup into `pb_data/backups`, keeping the last 7. Those stay on the same disk, so also keep -a copy somewhere else: - -- **Synology:** add the `docker` folder to a **Hyper Backup** task. -- **Other NAS:** include the apps' folders in its backup or snapshot schedule. -- **Linux or a Pi:** copy the folder to another disk or computer from time to time, for - example with `rsync -a ~/selfhostit/ otherhost:backups/selfhostit/`. +a copy somewhere else. The data is private (Flowy holds health data), so encrypt any copy +that leaves the machine, and leave out the `tailscale` folder: it holds the machine's +Tailscale key, which lets whoever has it join your tailnet as that machine. + +- **Synology:** add the apps' `pb_data` folders to a **Hyper Backup** task with + **client-side encryption** turned on. +- **Other NAS:** include the apps' `pb_data` folders in its backup or snapshot schedule, + encrypted if it goes off the NAS. +- **Linux or a Pi:** copy the `pb_data` folders to another disk or computer from time to + time, for example with `rsync -a --exclude tailscale ~/selfhostit/ otherhost:backups/selfhostit/`, + to an encrypted disk. + +Selling or throwing away the machine or its SD card? Delete the apps' folders and wipe the +disk first; the data on it is not encrypted. To restore, stop the app (`docker compose down`), put `pb_data` back, and start it again (`docker compose up -d`).