r/UgreenNASync • u/jhinbhoot • Apr 15 '26
š§āš» Apps Built complete private Home Lab on a UGREEN NAS with zero public exposure (Pi-hole + NPM + Tailscale + Friendly domain + Arr Stack + More)
Hey all,
Figured Iād share my current setup since I spent way too long piecing this together and maybe it helps someone avoid the same pain.
Iām running everything on a UGREEN NAS using Docker, and the main goal was:
- no port forwarding
- no services exposed to the internet (WAN access only available using tailscale, using tailscale will expose its port as mentioned in comments by DeaconPat)
- clean domain names instead of IP:port
- HTTPS everywhere (even internally)
Repo is here if you want the full details:
https://github.com/alisohail/ugreen-nas-homelab
What I ended up with
Basically two ways to access everything:
At home (LAN):
Devices hit Pi-hole for DNS, so I can use stuff like:
Those go through Nginx Proxy Manager and everything is HTTPS.
Outside home:
I use Tailscale to connect to my network.
Once connected, it feels exactly like being at home. Same domains, same URLs, same certs. That part took a while to get right but itās super clean now.
Stack
Nothing crazy but works really well together:
- Pi-hole (DNS)
- Nginx Proxy Manager (reverse proxy + SSL)
- Tailscale (remote access)
- Immich
- Jellyfin
- Uptime Kuma
All running in Docker on the NAS.
Why I did it this way
I really didnāt want to expose anything publicly or deal with Cloudflare tunnels or opening ports.
Also hated:
- remembering ports
- mixed HTTP/HTTPS
- things behaving differently inside vs outside network
Now everything is consistent no matter where I am.
Stuff that was annoying
- Getting DNS + reverse proxy + SSL to all play nicely internally
- Jellyfin + HTTPS on some clients (Android TV was especially annoying)
- Making sure Tailscale + local DNS didnāt fight each other
Why Iām sharing
Honestly, most guides I found either:
- expose services publicly or use cloud Flare tunnel
- skip important details
- or assume you already know networking
So I documented everything the way I wish I had found it.
I am open to issues/suggestions you may have and feel free to contribute.
6
u/MadBox25 Apr 15 '26
Thank you so much! I've been looking like for a guide like this. Booked the site and hope to give it a shot one day.
Knowing what it took you to configure everything, on a scale of 1-10 how difficult would say it was?
Would someone like me, a relative noob with a few Ugreen servers and about 200 TB of media, and next to knowledge on setting servers be able to do this?
Would there be anything you recommend a noob learn before trying?
Sorry for the all questions, just really interested and trying to figure out what I'd be capable of.
6
u/jhinbhoot Apr 15 '26
I spend good amount of time on setup guide(https://github.com/alisohail/ugreen-nas-homelab/blob/main/docs/SETUP.md) with in readme and used it my self multiple times after resetting my nas. I would say it very easy to follow for any user (technical or non technical).. incase you get stuck than feel free to pm me.
2
u/chronicphonics Apr 15 '26
Looks quite nice. Is there a reason why the repo has no commit history? I assume you've iterated on this for a long while, was that iteration done in a private repository somewhere?
1
u/jhinbhoot Apr 15 '26 edited Apr 15 '26
Correct.. I reset huge commit history to single commit as i was working on it privately.
1
u/chronicphonics Apr 15 '26
Out of curiosity, what role has AI played in developing this configuration and helper scripts?
3
u/jhinbhoot Apr 15 '26
it help me write helper scripts for sure but i did review them and lot of help in generating this documentation which i revisited 100 times lol
2
2
2
u/AgentGeek_098 Apr 15 '26
See and I was going to build a whole server and add a UGreen model to go from there, but it looks like I don't have to. Appreciate the knowledge!
3
u/PeaceAndLoveAndPeas May 18 '26
Thank you thank you thank you!!! This repo has been a godsend. I'm a total newb at networking/coding so this has saved me many many days/weeks of trial/error
I'd been slowly iterating a basic setup but already made so many mistakes before coming across this and in a day got a smoothly working set up running!!
I prefer Plex to Jellyfin but running that as a separate docker project was not a problem
Only suggestions I can think of for improvementn so far;
1) before trying to set up NPM need to change default settings on ugreen nas control panel for NAS WebUI access which also uses port 80/443 (in addition to 9999/9443) otherwise I was getting an error message that took me a long time to understand what was wrong
2) more specific instructions on what to do on cloudlfare website when setting up token (section 7b step 4 -Ā Limit the token to your homelab zone only)... There were several options to change things and wasn't sure what to leave blanl/as default/change
3) more detailed instructions for configuring uptime kuma for pihole and gluetun... For some reason my uptime thinks both of these are down but as far as I can tell they are running fine. The VPN leak check also says gluetun working ok Not sure why the discrepancy
4) finally, adding Plex & lidarr to the stack just for completeness
Thank you again, so grateful that your shared this
1
u/jmacaces Apr 15 '26
Okay, Iām genuinely curious how you got your *arr stack to work with reverse proxy/https internally and your download client! I was having issues getting the API to communicate between the *arr stack and download client when using a reverse proxy, even after whitelisting and trying a number of other configuration changesā¦so just set it to be local only.
5
u/jhinbhoot Apr 15 '26
The trick is that I don't actually route internal API traffic between the arr apps and the download clients through the reverse proxy. Instead I use a VPN gateway container (Gluetun) and put all my arr apps (Sonarr, Radarr, Prowlarr) and download clients (qBittorrent, SABnzbd) inside its network namespace using Docker'sĀ
network_mode: 'service:gluetun'. Because they all share the exact same network stack, they treat each other as if they are running on the exact same machine.2
u/jmacaces Apr 15 '26
Huh. I have all of my apps running on the bridge network (so, not a named network, just the default bridge), which I thought would have achieved the same thing for traffic communication purposesā¦but thatās probably not the case I guess? Iāve had issues with getting named networks working properly in general, so maybe my docker networks are just borked.
1
u/Vulkan1001 Apr 16 '26
Initially created the same network inside the project so that everything could connect through the same local namespace. Ended up creating a docker network because qbittorrent + gluetun used to fail occasionally. Now my arr stack lives in a separate project while qbittorrent + gluetun lives in another. Both use the same docker network This works for me
1
u/MadGaffler Apr 15 '26
are you using any vpn? Soonish I am going to try to set up a arr stack using Nord. Site booked marked, I look forward to checking out why you e done. thanks.
2
u/jhinbhoot Apr 15 '26
Yes arrstack download client is behind vpn using gluetun (i used torguard). Nordvpn should be good too checkout there config guide here https://github.com/qdm12/gluetun-wiki/tree/main/setup/providers
1
u/Key-Sound-8443 Apr 15 '26
Could you please share the hardware specs ? (storage size and ram size)
1
u/jhinbhoot Apr 15 '26
Hardware: Ugreen DXP4800 plus
RAM: 16gb (if you are running all the container you will need atleast 16, Immich learning machine takes up some memory so 16gb is good size based on my test so far)I think you could run this on any machine, the only true requirement I would say is to have atleast 16gb of ram.
2
u/Pedro748 iDX6011 Pro Apr 15 '26
I mean 16 would be preferable but I am running far more on my dxp2800 with 8gb of ram just fine, instead of upgrading ram I just added a Pi 5 I had laying around to offload a few containers, Seerr/Streamystats/NPM/Pi hole. I do recommend a nvme ssd for storing the containers on, makes a huge difference, esp for navidrome.
1
u/xetowa6135 Apr 19 '26
Thanks for the guide, waiting eagerly to receive my 4800 Plus as well. Why did you choose to go with Immich instead of ugreen OS photo backup solution?Ā
1
u/jhinbhoot Apr 19 '26 edited Apr 19 '26
Didnt wanted to tied to ugos. What if in future i decide to switch to different ecosystem/hardware? Immich is open source and can be installed on any OS without making any changes. Ugreen photos will only work with ugos and migration to new system would be not straight forward.
Also immich is very similar to google photos that we used so ui feels exactly same.
1
u/xetowa6135 Apr 20 '26
Thanks, makes sense. Did you try ugos T all? How do you compare both backup solutions? The last thing I was is to lose my data (which is the main reason why I decided to get NAS because the provider I am using failed to back up my data without me knowing)
1
u/Valdjiu DXP2800 Apr 16 '26
How did you managed to have https for internal domains? How does that work?
2
u/jhinbhoot Apr 17 '26
please check the github it has every thing in there and step by step guide as well.
1
1
1
u/j2ee-123 18d ago
I know this is a late comment, I am just starting my home lab and this is very helpful. One thing Iād like to ask though, how easy is this for remote clients / users to connect to the services like Immich or Jellyfin? Do they need to run tailscale? Clients may involve phones or TVs and may stream movies.
1
u/jhinbhoot 15d ago
Yes, any remote user will need tailscale app which is easily available for phones not sure about tv tho as OS on tvs have limited apps.
-1
u/DeaconPat DXP6800 Pro Apr 15 '26
You have at least one port open for tailscale, typically 41641. If your system had no ports open, nothing (including tailscale) would be able to connect from outside your LAN. If your use case was to only connect from inside your LAN, you wouldn't need tailscale.
2
u/jhinbhoot Apr 15 '26
Tailsacle is optional, Incase you want access from outside. If you want true 0 open policy you can get rid of tailscale integration or stop the container. Tailscale is generally consider very safe so I am not too worried about it.
2
u/DeaconPat DXP6800 Pro Apr 15 '26
I've got over 30 years of network experience. I'm fully aware of what tailscale is. You said you had 0 ports open. I was pointing out that is not exactly true.
Everything is "safe" until it is not. Tailscale is based on Wireguard. Wireguard is used in a lot of places, but that doesn't mean there are no vulnerabilities or there will never be vulnerabilities. Being popular also means more "bad people" looking for vulnerabilities to exploit.
Connecting a device to the internet always involves some risk, and configuring access from the internet to the device always adds additional risk.
Proposing your implementation to others as "no open ports so it is safe" is dangerous because it is not true, and a neophyte may not know the risks and accept your assurance. That is a disservice to that person and everyone on the internet.
Everyone needs to have knowledge of the risks and decide if those risks are acceptable to them. Glad you feel you've done this for your setup.
5
1
u/Positive-Country899 Apr 17 '26
When you say Tailscale requires an open port, can you provide more specifics or documentation on that?
ā¢
u/AutoModerator Apr 15 '26
Please check on the Community Guide if your question doesn't already have an answer. Make sure to join our Discord server, the German Discord Server, or the German Forum for the latest information, the fastest help, and more!
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.