QNAP TS-453A

Intended role: dedicated backup target for photos.gf.cx — the "2" in a 3-2-1 strategy. Production source → this NAS (on-LAN, versioned, snapshotted) → B2 cloud bucket (off-site, encrypted). This box does not serve end-users; it only ingests, snapshots, and replicates.

Filesystem · btrfs, not ext4

At pool-creation time pick btrfs from the Storage & Snapshots wizard — the default is ext4, do not accept it. btrfs gives block-level checksums (silent bit-rot detection + auto-repair from parity) plus native snapshot support. Schedule monthly Data Scrubbing on the pool. This box does not support QuTS Hero / ZFS — that's TS-h series only — but btrfs is the next-best thing.

RAID · RAID 6, non-negotiable

Four bays in RAID 6 (2 data + 2 parity, ~50% usable). With the 1 GbE bottleneck and modern 12+ TB drives, rebuild after a single failure takes days. RAID 5 + a second drive dying mid-rebuild is the most common way 4-bay NAS lose data. Accept the capacity cost for archive duty.

Drives · recertified enterprise

Sweet spot is recertified datacenter pulls — usually the same silicon as retail NAS-branded drives at half the price, with 2-5 yr seller warranty:

• WD Ultrastar HC520 / HC530 12 TB — ~$110-135 each from ServerPartDeals / GoHardDrive (US) or serverstore.uk (UK). 7200 rpm, helium-filled, CMR.
• Seagate Exos X16 12 TB — same price band, equivalent spec. Buy 2× Ultrastar + 2× Exos so one bad firmware batch can't take all four down at once.
• If you want full new-with-manufacturer warranty: Seagate IronWolf 12 TB (~$180-210) or WD Red Plus 12 TB (~$200-220). Avoid plain "WD Red" — the SMR-shipped-as-CMR branding is tainted.
• Skip shucked externals — markup on WD Elements has narrowed; saving ~$20/drive isn't worth voiding the warranty, dealing with the 3.3 V pin issue, and trusting unknown drive provenance.

Drive burn-in · do not skip

Before deploying any drive (recertified or new):

• badblocks -wsv /dev/sdX — destructive write-read-verify, ~3-4 days for 12 TB. Catches infant mortality during the seller's warranty window, not after 20 TB are on it.
• Or QTS-native: Storage & Snapshots → Disks → Disk Health → Test → Extended SMART + Full bad-block scan.
• On recertified drives, check SMART Power_On_Hours on arrival. <30,000 hours is fine; >50,000 hours = RMA immediately (that's 5+ years of 24/7 already on the clock).

Memory upgrade · 4 → 8 GB

Cheap and worth doing: 2× 4 GB DDR3L-1600 SO-DIMM (~£30 / $40). btrfs and snapshot operations are noticeably happier with more RAM, and you'll want headroom for the Tailscale container and rclone/restic running on-box.

Security hardening · mandatory for this generation

TS-453A is in the generation hit by DeadBolt and Qlocker ransomware (2021-22). Treat it as a hardening project, not plug-and-play:

• Never expose to the internet — disable myQNAPcloud public access, UPnP, all port forwarding. For remote access use Tailscale (QTS Container Station package) or WireGuard only.
• Disable everything you're not using — DLNA, Media Server, Photo Station, Qsync, SMB v1, FTP, Telnet.
• Change the admin port from default 8080.
• Disable the default admin account entirely after creating a new admin user with a different name.
• Enable 2FA on every account that can log in.
• Keep QTS updated — Security Advisor in QTS flags the obvious stuff.
• Snapshot locking (WORM) — lock daily snapshots for 30+ days so a compromised admin account can't delete them.

Backup architecture · pull, don't push

Configure this NAS to pull from the photos.gf.cx source on a schedule — never the source pushing here. If ransomware compromises the production box, a push-based setup helpfully encrypts your backups too. Pull means the production box holds zero credentials to write into this NAS.

• HBS 3 (Hybrid Backup Sync) — set up an rsync or SFTP pull job from photos.gf.cx's source.
• Or restic running on the QNAP, pulling via SFTP — same outcome with content-addressed deduplication.

Snapshot policy

Off-site leg · B2 via restic or rclone crypt

This NAS-on-LAN is the "2"; the off-site copy is the "1" in 3-2-1. From the NAS, nightly:

• Backblaze B2 — S3-compatible API, ~$6/TB/month storage, with free egress to Cloudflare (Bandwidth Alliance) or free up to 3× stored data/month elsewhere. ~4× cheaper than AWS S3 Standard for this workload.
• restic for deduplicated, versioned, encrypted-on-the-NAS backups (edited file ≠ full re-upload).
• rclone crypt for a simple encrypted mirror (whole-file syncs, no dedup).
• Both encrypt before upload — B2 only ever sees ciphertext. Save the passphrase + salt in 1Password; losing either = data gone.
• Rough cost: 4 TB of photos ≈ $24/month; 10 TB ≈ $60/month.

Time Machine on this box (optional secondary role)

TS-453A can serve Time Machine via an SMB share + the per-share "Enable Time Machine support" flag. Discovery is via Bonjour / mDNS on UDP 5353 — the NAS broadcasts _adisk._tcp and Macs see it in the destination picker automatically. This is link-local only: Bonjour does not traverse routers, so a Cloudflare-tunnel hostname like timemachine.gf.cx does not make the NAS findable. For off-LAN Macs, use Tailscale and manually pin the destination:

• sudo tmutil setdestination -a smb://user@nas.tail-scale.ts.net/TimeMachine
• Cap the share with a quota (Control Panel → Privilege → Shared Folders → Edit → Quota) — otherwise TM grows until the pool fills before it ever starts pruning oldest backups. Target: 2-3× the Mac's internal disk.
• Exclude bloat at the Mac end: ~/Library/Caches, node_modules, Downloads, VM images, Docker data, iCloud-mirrored Photos libraries.

Approximate build cost