fixed ttypos

2026-04-19 11:44:58 -04:00
parent f48752afb9
commit 804a435b31
8 changed files with 406 additions and 10 deletions
@@ -99,7 +99,95 @@ Custom network: high-availability
  NginxProxyManager → NextCloud  (by name)
 ```

-This flexibility means any two unRAID servers can participate — regardless of hardware generation, CPU, drive count, or storage layout. The only requirements are matching share names, matching container names for shared services, and the same custom Docker network names.
+**Personal shares — backup without failover:**
+
+Beyond the shared media library, each user can sync personal shares to the other server purely for offsite backup — no failover container involvement, just data protection.
+
+```
+HOST1: /mnt/user/Gmer4Lfe-Personal  →  rsync nightly  →  HOST2 (encrypted backup)
+HOST2: /mnt/user/Jayred365-Personal  →  rsync nightly  →  HOST1 (encrypted backup)
+```
+
+Configure in `Master.conf`:
+```bash
+HOST1_PERSONAL_SHARES=(
+    "/mnt/user/Gmer4Lfe-Personal"
+)
+HOST2_PERSONAL_SHARES=(
+    "/mnt/user/Jayred365-Personal"
+)
+```
+
+`daily_sync.sh` automatically picks up the personal shares for the local host and syncs them alongside the media shares.
+
+**Encrypting personal shares — unRAID 7 ZFS:**
+
+ZFS native encryption in unRAID 7 means both admins can see the share exists and file sizes but neither can read content without your passphrase or keyfile. rsync copies encrypted blocks as-is — the remote server never needs your key.
+
+**Setup on HOST1 (your personal share):**
+
+**Step 1 — Create an encrypted ZFS dataset:**
+```
+unRAID UI → Main tab → click your ZFS pool
+→ Click "+ Dataset"
+→ Name: Gmer4Lfe-Personal
+→ Enable Encryption: Yes
+→ Encryption type: passphrase (simplest) or keyfile (auto-unlock capable)
+→ Enter your passphrase — write it down, if lost data is unrecoverable
+→ Create
+```
+
+**Step 2 — Create the share:**
+```
+Settings → Shares → Add Share
+→ Name: Gmer4Lfe-Personal
+→ Primary storage: your ZFS pool
+→ Use cache: Only (keeps data on ZFS pool, not array)
+→ Add
+```
+
+**Step 3 — Verify encryption is active:**
+```bash
+zfs get encryption poolname/Gmer4Lfe-Personal
+# Should show: encryption  aes-256-gcm
+```
+
+**Step 4 — Add to Master.conf and sync:**
+```bash
+HOST1_PERSONAL_SHARES=(
+    "/mnt/user/Gmer4Lfe-Personal"
+)
+```
+
+**Auto-unlock on boot (keyfile approach):**
+
+If you want the share to mount automatically after reboot without entering a passphrase:
+```bash
+# Create keyfile — on HOST1 only, never sync this file
+mkdir -p /root/.zfs-keys
+dd if=/dev/urandom bs=32 count=1 | base64 > /root/.zfs-keys/personal.key
+chmod 400 /root/.zfs-keys/personal.key
+
+# Set dataset to use keyfile
+zfs change-key -o keylocation=file:///root/.zfs-keys/personal.key \
+    -o keyformat=raw poolname/Gmer4Lfe-Personal
+
+# Add to array start script (unRAID_Essentials or User Scripts)
+zfs load-key poolname/Gmer4Lfe-Personal
+zfs mount poolname/Gmer4Lfe-Personal
+```
+
+**Manual unlock (most secure — you control when it's readable):**
+```bash
+zfs load-key poolname/Gmer4Lfe-Personal   # prompts for passphrase
+zfs mount poolname/Gmer4Lfe-Personal
+```
+
+**What the remote admin sees:**
+
+The share directory exists on HOST2. File names and sizes are visible (ZFS encrypts content, not metadata by default). File contents are unreadable without your key. To hide filenames too, enable `zfs set encryption=aes-256-gcm` with `dnodesize=auto` — this is a more advanced setup.
+
+**Current status:** The infrastructure supports encrypted personal share syncing. The ZFS dataset setup is a one-time manual step per server. Once set up it syncs automatically like any other share.

 ---