I would cd into the user folder that you want to add / remove files from and see what the ownership is to begin with and simply replicate ownership to match what’s already there.

Generally, in my experience, modifying the backing storage for a nextcloud instance is more of a PITA than its worth. I would just mount the webDAV in your file manager. This way the nextcloud db stays in sync with the backing storage.

If you are going to be making direct modifications to the backing storage, check this form post on modifying the nextcloud config to have it look for changes on the filesystem.

As for the permission side of things, run ls -lh in the folder that you want to make changes and see what the user:group is for ownership of the existing files and make sure your new files match. Chmod and chown will be your friends here and chmod has a --reference option that let’s you mirror permissions from an existing file, a real time saver.

Hopefully this helps!

For container management I use portainer CE and for the rest I use CheckMK.

I dont know if this qualifies as a “toaster” but Ive used this docking bay in the past for a NAS and it served my purposes decently well. One thing to keep in mind is that random IO will be lacking with a usb interface. Also, this particular chipset does powercycle all the drives when one is removed so drive swaps end up requiring you to power the entire system off to perform. Also no integrated cooling may be a deal breaker as you illuded to.

If I was basing a nas build off of a PI, I would look to use the PCIe 1x2.0 interface on the pi 5 as a HBA.

It depends on the size of your budget (if it exists at all). Your probably better off doing some e-waste dumpster diving. Shoot for something with a 3rd gen i3 / i5 or newer and at least 4gb of RAM.

That generation is when Intel added MPEG hardware encoder so it opens up a lot of options for self-hosting media servers.

Highly recommend restic. Simple and flexible. Plus I’ve actually used it on two occasions to recover from dead boot drives.

Have you looked into policy-based decryption? Here’s an knowledge base page on the RHEL customer portal that goes over it well. I’m not sure if this will work on freebsd but it does offer a solution that allows for zero-touch reboots.

CGNAT = Carrier Grade Network Address Translation. It makes it practically impossible to open ports to the public internet and in some extreme instances make zerotier very unstable. Typically you only have CGNAT if your internet connection is 4G or fixed wireless.

OpenVPN is just a VPN protocol. Roughly comparable to wireguard. It has been the gold standard for VPN technology for the past decade or so. Wireguard by comparison is much newer, and lighter to run. This typically results in faster throughput from a computational standpoint and devices where power is limited (cell phones), uses much less power by leveraging modern CPU encryption methods.

If you have the option to port forward on your home internet connection, its possible to setup a VPN connecting in a straight shot from your home to your roaming device. If you can’t port forward, you will need a main in the middle (the VPS) to establish and route the connections through.

Zerotier works off of a PTP style network and the free plan allows up to 50 devices when last I checked. I’m not sure on the availability of zerotier or wireguard on truenas as the last time I used TrueNAS was Scale 22.

My recommendation would be some kind of VPN. If your looking for something plug and play and free, look into zerotier.

If your home internet connection sits behind CGNAT, like me, just buy a cheap vps and set up your own wireguard network.

Both solutions avoid exposing your services directly to the public internet which reduces attack vectors and adds an extra layer of encryption.

If my understanding of how “force SSL” works for most proxies, it just simply issues a HTTP 300 redirect message for all http traffic coming in on port 80. It then sends everything to port 443 https.

Do you get a 502 when you try to connect with the force SSL turned off? It might me less of an issue with SSL and more that your proxy is not pointing to the right host / port of your nextcloud server.