Does it work? Server can reboot and use TPM to unlock rootfs? What about /boot - encrypted and tamper proof? Resists evil maid attack?
Rabbit hole, I know, but so fascinating if you solved it all :)
But in reality that will never happen and the only actual attack you need to be worried about is junkies breaking in and flogging the drives on facebook marketplace. For which, this level of security is fine.
For this you dont need TPM. Just a LUKS key in rootfs /etc. He said TPM :)
A previous hoster once gave me someone else's drives without wiping them. I don't want random customers snooping around on my data if a similar mistake happens with my disks.
For home use, I run without disk encryption. If I ever need to do data recovery, it's not going to be possible with encrypted disks and one point of a centralized NAS is to have stable long term storage.
> Rabbit hole, I know, but so fascinating if you solved it all :)
Encrypting `/boot/` is the wrong thing to do. One can just replace it with something that logs the encryption key instead (and sends it off to somewhere). You actually need to verify that what you expect to be there is actually there and a encryption isn't gonna do that for you.
A reasonably secure boot chain looks roughly as follows: bootloader is checked by the UEFI (read secure-boot), bootloader chain loads a signed UKI which also uses secure boot verification (or just skip the bootloader if you only have a single kernel with no fallback), this then loads a signed dm-verity `/usr/` which brings you to the login screen. Root is just data (e.g. mounted `noexec`) and is encrypted using e.g. PCR 11 so that it only unlocks if the UKI is the one that is expected (with some other backup unlock method).
This is basically #2 of the "Design Goals" of Poetterings "Fitting everything together"[0]. It's a good read if you are looking to designing your own Linux image and are looking for some inspiration. There is ParticleOS[1] which somewhat dogfoods this kind of system, though I don't think it is anything remotely considered for a production system.
[0]: https://0pointer.net/blog/fitting-everything-together.html
That under-states the matter. It is a terrible time, price-wise, to build a NAS.
I'd almost rather have no AI whatsoever and have storage 1/10 the price of pre-AI times.
(If there were a magical choice between having AI and significantly more expensive storage, and having no AI and some program to dump that investment money into getting and somehow leveraging significantly more available storage, that is.)
Seriously, if arts and creativity is what sets humans apart from other animals, then AI has almost completely displaced our capacity to even consider doing these activities ourselves. People reach for AI when they should be composing a birthday greeting themselves.
People cannot be relied upon to provide accurate birthdays but nobody would suffer the social faux pas of an incorrect birthday congrats note. Nor would they send it to a spam catching email, but rather are guaranteed to send it to a regularly checked address. They know the persons birthday after all.
You can then sell high quality birthday information correlated to contact information to ad agencies.
Fuck this current internet. So dystopian.
Like seriously, outside of some close friends and family, are you sitting there deliberating over a message for your coworker Steve in the Slack chat or a cousin you barely talk to outside of a birthday and Christmas card?
> or that people have almost completely lost the ability to consider making art
They haven't lost it, no, but there's a lot of financial incentive to stop paying people to do it.
I built a 24 TB HDD NAS in a 36 bay chassis for around $1000 all-in: mb, ram, rails, chassis, rack, disks, hba, nic
Awful Watts/TB but the plan is to run it and the GPU rig on solar.
The nice thing about the array being big is that I can just RAID 1 it instead of worrying about tinkering with RAID 5, and leave a drive as a hot spare.
PCIe 2.5G NIC for the uplink, and then it can serve over SMB or iSCSI. The main use case for this thing, incidentally, is it just is a caching proxy that holds Docker images, models off of Huggingface, and so on.
I fell in love with the silly idea of squeezing 10G NIC + 10G writes (to a 2x12 RAID 10 HDD array) on the thunderbolt bus of my 12 year old macbook pro.
Then I got distracted with the server mb and truenas and ZFS.
Can't you get that in a single disk that costs less than a kilodollar?
Almost? ALMOST!?!?!
If you handed me a button that would make it like LLMs had never existed I'd be slamming that button so hard Sam Altman's clothes would spin around.
Return memory and storage prices to normal, undo the sloppification of ~everything, remove all these annoying "features" that are so useful they have to force them upon people, and make scammers actually have to put in a slight bit of effort, all at the "cost" of real human developers, artists, writers, etc. getting paid for their work....
If this is a hard decision for you, you are the problem.
They (probably) don't want to stop progress (especially unqualified like this) in general. They'd like a world where LLMs didn't come to exist.
And whether LLMs are progress at all remains to be proven.
Which is 100% what this has felt like to work with, all spring and summer.
So we're in a slop phase, it'll pass. The first few years of youtube gave no hints that we'd get stuff like Veritasium.
Ignore the slop and use the tools to create something you never thought you could do. That's what it's for!
I had a drive go bad in my 4 year old home-built NAS a few weeks ago, and it cost 2x what it originally did to buy the same capacity drive, and that was going to a grey-market importer on eBay, it was more on "reputable" sites.
Like I’m already giving up two full drives for redundancy (which saved my ass - I recently had two drives fail on me in quick succession — both SSDs from what looks like an identical batch) but then the advice is kinda saying I need to keep at least another drive worth of space free for the pool to perform well and not crap itself. That hurts with current prices for sure.
I'm not entirely sure, but it seems to me that free space (and the 20% reservation) is mostly a proxy for fragmentation, and you can therefore better look at fragmentation directly. That would mean that if you mostly store large files, there shouldn't be a lot of fragmentation even at high utilization. The whole "ZFS changes allocation algorithm from 80% usage on" is something of 10+ years distant past, and lots of things around the allocator have been improved. It's also something that probably isn't too different from the performance of other filesystems at high utilization, so it shouldn't be exaggerated.
Well, other filesystems can defragment.
ZFS will definitely degrade write performance gradually from 90% utilization, and will hit a stronger cliff at 95%+. Same with SSD, using a consumer SSD above 90%+ utilization would rapidly degrade its lifetime. The effect will be smaller for very large pools and very large files, but the effect is stil there.
I'm repeating this so that people who set up these drives know what is actually going to happen.
Maybe because your statement about SSDs is incorrect. Consumer SSDs have spare blocks too, and wear leveling prevents the scenario you're describing.
[edit] also snapshots aren’t really workable for large files. Remux a movie file and now it occupies twice the space.
Instead the math can be different e.g. it's ok to lose some data but not all. Therefore you might prefer the unraid approach over zfs where losing more than parity doesn't kill the whole pool.
I don't want to lose 26TB just for a mirror, and I have a spare 8TB USB HDD. I'm torn between unraid and just Debian, and I'm torn between just two separate devices and one RAID 1 partition one RAID 0
This is a common claim, but honestly, citation needed.
We can't just apply bit error rates from the datasheet that haven't been updated in 15 years. I'm sure a 2-day rebuild is a little more risky than a 4-hour rebuild, but I'm not convinced it's by all that much. Especially if you had a monthly scrub going to prevent disk rot and disks secretly getting super fragile.
> I've had to resilver 2-3 times over the past 10 years, and never lost a byte of data.
And how many times did you have a read error on one of your other disks during a resilver?
> This is a common claim, but honestly, citation needed.
FWIW, here's the quick & dirty argument for that:
Assume:
- We're working within a given generation of disk technology, with comparable drive and interface tech.
- The drives' I/O speed is relatively constant, not scaling with the drive capacity.
- The chance of any given bit (of data on a disk) going bad, in a given time interval, is relatively constant.
- The drives, regardless of size, will be some fixed-ish percentage full. (If nothing else, the boss won't sign off on overspending for unneeded capacity.)
From there - the time needed for resilvering scales linearly with the drive size. As does the number of non-redundant bits that could go bad in any given second of the resilvering. Linear time linear - so the chance of data loss during resilvering rises with the square of the disk size.
We can't just assume this, though. Especially for data that's being checked regularly, because the drive can see how many pre-ECC bits have gone bad and rewrite iffy sectors.
And even if it's true, it's normal to go years without errors. If you have a 15% chance of getting an error each year, and your degraded array has 4 drives without redundancy, then the chance of getting an error in 4 hours is .02% and your chance of getting an error in 48 hours is .3%. Having that risk show up once every few years is pretty negligible compared to everything else that could go wrong with your array.
On top of that, if you don't have a hot spare and it takes 5 days to get a new drive, the difference in resilvering speeds is now 5.2 days versus 7 days and that barely matters.
The main situation where you have to worry about extra drives failing is when you think the resilvering process will greatly accelerate drive deaths. And that depends very much on the specific numbers you have in mind.
This is based on the data I had available 10 years ago when I set up this array… If you have data that points to drives having fewer read errors per GB in recent years, I'd love to see that citation.
> And how many times did you have a read error on one of your other disks during a resilver?
I don't know, because I have RAIDZ2, so that read error would probably be corrected without it being reported to me.
Data you collected or data you found? Any idea where it was?
I've only seen oversimplified math, not real data, and different versions of the math make different assumptions.
> I don't know, because I have RAIDZ2, so that read error would probably be corrected without it being reported to me.
Zpool status gives you a per-disk error count. I kind of assumed someone doing a resilver would use that command.
I think it was a lengthy blog post citing manufacturer data, found via the FreeNAS forums. The added safety of RAIDZ2 was a good tradeoff. Someone else on this thread reports they lost two SSDs in rapid succession, which I hear happens sometimes with drives from the same batch. In any event, I felt no need to launch an independent investigation of the math and underlying assumptions.
> Zpool status gives you a per-disk error count. I kind of assumed someone doing a resilver would use that command.
Yes, I did indeed use zpool to do the resilver… I don't recall if there were any read errors on other drives at the time of those failures, but probably not, as the scrub probably would have flagged it. They've all been replaced with higher capacity drives, so at the moment I see "No known data errors"
Also to reply to your other comment: Personally one extra drive is a small price to pay for the peace of mind.
I achieve peace of mind via backups. For each copy, once I get the AFR below 2% I'm not too fussed about pushing it lower.
Technically true.
Practically? There are several other major factors - such as the quality of your drives, whether you periodically run zfs scrubs and/or disk read tests, and how long a resilver takes to complete.
Behind those are the eternal duo - size of budget and cost of failure.
Is it not the case that if you don't have ECC memory, ZFS could end up writing a checksum that does not match the data if you get a bitflip in just the right (wrong) spot?
The myth, popularized by a notorious thread on the TrueNAS forums [1], is specifically that ZFS requires ECC RAM, and will do worse than other filesystems without it, because scrubbing will multiply a single bitflip into a failed pool.
A ZFS core developer says that that isn't the case [2]. Here's some more reasoning [3], also about many other myths.
[1] https://www.truenas.com/community/threads/ecc-vs-non-ecc-ram...
But everything is actually quite sensitive.
We’ve accepted lack of ECC because Intel decided it would be a product line differentiator, and serious customers who didn’t want random crashes or to lose data would buy chips with ECC.
It’s actually less of an issue these days because DDR5 has (by spec) some in-line ECC; won’t help with multi-bit errors but its an improvement on what came before.
AMD has been allowing ECC on lots of regular hardware for a long time.
People don't tend to buy ECC for desktop use because it costs significantly more (used server ram is/was often cheap... but it often doesn't work in desktop boards), and the performance specs are poor.
My home servers are mostly retired desktops, so they get my old desktop ram and I don't want to pay premium prices for jedec speed ecc ram on my desktops, thanks.
Since DDR5 doesn't include reporting on bit errors (afaik), it likely means much fewer single bit errors, but most experienced errors will be multi-bit. Although, I dunno what proportion of bit errors is on the ram chips and what's on the bus... there's no protection from bus errors.
If there were reporting, you could replace chips with high error rates, but without reporting you'll keep running them until they fail enough to notice.
Often unsupported or untested by the motherboard manufacturer, because the precedent set quite a while ago has stood so strongly.
> because it costs significantly more [...] and the performance specs are poor
Because it's niche. If a large share of the desktop market was using ECC memory, the extra cost would have been 10-12%, and a typical kit would push the clocks and timings at least as much as non-ECC memory.
> Since DDR5 doesn't include reporting on bit errors (afaik), it likely means much fewer single bit errors, but most experienced errors will be multi-bit. Although, I dunno what proportion of bit errors is on the ram chips and what's on the bus... there's no protection from bus errors.
Yeah that sucks. I'm really hoping that DDR6 standardizes a light form of end to end ECC. (Bursts are 24 bits wide and 24 bits deep, so on top of the 512 bits of payload there's a bunch of extra bits that can be used for ECC. If memory chips would just store 4 extra bits per 128, that's enough for reasonable ECC on a per-burst basis.)
I wasn't really around for it, but I appreciate the early penny pinchers that developed fake parity ram. The IBM PC required a parity bit per byte?, but you could add an xor chip to calculate it at read and save out on the expensive ram chip.
I wouldn't mind paying a little more for ECC, what with the extra chip and a little more circuitry, but desktop ECC often starts at 50% more, which I'm way too cheap to pay for.
[1]: https://arstechnica.com/civis/threads/ars-walkthrough-using-...
[2]: https://en.wikipedia.org/wiki/ZFS#2004%E2%80%932010:_Develop...
Which means all copies of the data will be corrupted. This can be anything from an irrecoverable file to complete filesystem corruption.
But generally, yeah, not any more dangerous than any other filesystem, and ECC used to be cheap so it was a no-brainer, you should have backups anyway TBH if we're being honest about storage resiliency.
What has been debunked is the "scrub of death" issue, on a scrub a bad bit flip would cause an error, which would be copied over with good data -- well it was technically good before. It would be statistically difficult to have a fault on a read, then a clean read, then a second bit flip destroying the data.
ZFS without ECC is no more risky than any other file system / software RAID without ECC.
As no one owes you an explanation, it would take you five seconds to Google this and discover:
1. It's been disproven, with one of the original ZFS developers chiming in.
2. The original source of the rumor was a forum post that somehow became canon.
...(after much longer) that it's a rabbit hole with nuance. https://news.ycombinator.com/item?id=18481910
You have SATA or SAS to pick from. The CPU requirements for a storage server are not high. On a typical ATX board you have motherboard SATA and can put SAS controllers in the spare PCIe slots.
My first "NAS" was two 22TB hard drives in a ZFS pool on my motherboard SATA
I recommend staying away from SATA drives (huge consumer rush) and look for SAS drives on eBay, particularly HC520 Helium drives from HGST/WD. Need a SAS3008 PCIe adapter ($20) and a SFF-8643 splitter ($30). No backplane is required. Huge lots of decommissioned drives frequently appear. I bought Qty 10* of HC520 (12TB) SAS drives for $1000 about 3 weeks ago, avg age is about 2.5 years, still well within its rated lifetime.
Yea may be some of the stuff is fear mongering and cargo culting. I was told ECC is necessary for ZFS. When the article was written, it was cheap af (2024) to buy ECC RAM so not much consideration was given to it.
-- (*) I have no idea what to do with it. Anyone has any good idea for using 120TB space? I have about 40TB unused bandwidth in the datacenter, may be host a Debian mirror? Donate storage/bandwidth to Internet Archive? Please contact me, appreciate it.
That's cheap indeed. Enough headroom for some failing disks too. How is the noise and power usage? I didn't look at SAS drives at all, because my impression was that they're very noisy. I can place my NAS in a closed off room, but it's not too far away and I was afraid SAS drives would be audible through the wall.
I think they're same as SATA drives, just different interface. AFAIK they have the same physical dimensions and same internals.
Also something people forget for home nas or figuring out cost for a nas, the power draw of the entire system times your electricity price you then have to multiply this times 2x to 4x times if your climate requires cooling air conditioning of any kind
https://www.samsung.com/us/memory-storage/nvme-ssd/990-pro-p...
Is part of this publicly available? After seeing, - https://words.filippo.io/frood/ - https://0pointer.net/blog/fitting-everything-together.html
I've been looking at setting something up with mkosi/systemd for my home server/NAS - it's interesting seeing how different setups are solving the problem for inspiration.
I ended up on shucking 4x the 14 TB WD Elements Desktop. They contain helium drives, the WD140EDGZ in my case, and are about a third cheaper than 4x the 12 TB WD Red Plus drives (which are air-filled). The shucking was easier than I expected too, and the performance seems very comparable. The warranty is a definite downside (European, so no Magnuson-Moss), but I think I can even get them back in their enclosure should they fail during the 2-year warranty period.
I've put some second hand 256 GB M.2 SSDs in there as boot drives. It was a bit of a struggle to get it to work in a way that failure of one of the drives doesn't hold up booting, combined with LUKS, TPM keys and ZFS on root. Learned a lot about systemd-boot which I have never used before, but feels a lot saner to me than grub ever was. So now I have a large script which debootstraps a Debian based NAS into being.
I noticed that there are a lot of ZFS myths and cargo culting. For example TFA mentions ECC RAM, which in some circles is a must-have because ZFS would wreck your pool during a scrub otherwise, which is a myth. It's also very expensive, especially this year. You also don't need much RAM for ZFS, L2ARC doesn't use much RAM at all, to name a few others.
Still doubting about setting `dnodesize=auto` (which is the default), because there are some horror stories about that [1]. And it seems impossible to find a cloud storage provider with reasonable prices that supports `zfs send`. Rsync.net upped their minimum order to 10 TiB recently, which is far too much for my use case.
[1] https://github.com/openzfs/zfs/issues/11353
[2] https://www.rsync.net/products/zfsintro.html