Home server · the build
Home Linux Server
From the box on the porch to movies that land in Plex on their own.
Bought Oct 7 and 9, 2026 · VPN Oct 10 · Build day Fri, Oct 16
| When | Your part |
|---|---|
| Now to Oct 15 | Two step login on Proton and Plex. Nothing to buy (tape only if needed) |
| Sun, Oct 11 | The 1TB drive arrives. Tick it |
| Thu, Oct 15 | The RAM arrives. Read its label |
| Fri, Oct 16 | Stops 1 and 2, about 1.5 hours. Then tell Claude "the NAS is up" |
| Oct 16 to 18 | Plug in the two drives. Claude tests them for about 1.5 days |
| About Oct 18 | Shuck the drives, then say "wipe ok" |
| After that | Claim Plex, sign in on the TV, then the first movie |
Plex Watchlist → Seerr → Radarr or Sonarr → Prowlarr → qBittorrent (VPN only) → Plex + Jellyfin
Example: when Avengers: Doomsday could land on its own
Add it to your Watchlist any time. Seerr files it within 3 minutes, then Radarr waits: it only takes a movie once it is out to buy or rent at home (its Released setting), or up to 14 days before that date, since good copies often show up a few days early. Nothing downloads before that unless you press Search in Radarr or ask for it a second time in Seerr.
| When | What happens |
|---|---|
| Now | On your Watchlist. Radarr lists it as wanted. Nothing downloads |
| Fri, Dec 18, 2026 | In theaters. Radarr still waits |
| About Tue, Feb 2 to 9, 2027 (estimate) | Radarr starts looking, 14 days early. It reads new uploads every 30 minutes and takes the first good copy |
| About Tue, Feb 16 to 23, 2027 (estimate) | Out to buy or rent |
| About Mar 31 to Apr 14, 2027 (estimate) | On Disney+ |
Radarr on its own only reads new uploads, so a copy that went up before it counted the movie as out is never seen. The NAS covers that. Every 4 hours it asks Radarr and Sonarr to search again for anything wanted, out and still missing, and it clears a download stuck for a day so the app picks another copy. You do nothing.
Why those dates: the last four Marvel Studios films went to buy or rent 60 to 67 days after theaters, and to Disney+ 103 to 117 days after. December films have run later (both Avatar films took 102 days, which here would be Mar 30). If no home release date is ever listed, Radarr falls back to 90 days after the first theater date, Mar 16, and starts looking 14 days before that, Mar 2. Dates from Marvel and TMDB; the rule from Radarr's own code. Read Oct 10, 2026.
Open for you: Plex Pass. Start free; if you buy, buy in Black Friday week (about Nov 23 to 30, estimate). A daily watch pings your Discord the day a sale shows up. Before Oct 16, read the UPS model off its label. In week one, two accounts and a spare USB drive.
Build: unboxing to Plex
Seven stops. You rows are yours. Claude rows run over SSH from the tower while you watch, or while you sleep. Tick rows as you go; this page remembers per device.
Stop 0Before build day
- Claude Installer stick, done Oct 10. Claude wrote
Debian 13.7's netinst file
debian-13.7.0-amd64-netinst.iso(it matches Debian's published checksum) onto your SanDisk stick and read it back: a byte for byte match. Keep it with the NAS for build night. Why: the stick boots the installer that puts Debian on the new 1TB drive. - You What is left before build night. Nothing to buy. On the Inventory tab: two spare outlets for Oct 16 to 18, and two step login on Proton and Plex.
- You Oct 15, read the RAM label. It must say
M425R1GB4BB0-CWMorM425R1GB4PB0-CWM, the two Samsung parts on UGREEN's approved list. Anything else goes back. - Claude Tower side, done Oct 10. A login key just
for the NAS, the
ssh nasshortcut, and the app passwords saved in your.env. Nothing to do.
Stop 1Unbox and install the parts Fri, Oct 16, 30 minutes
- You Unbox the NAS. Leave the four drive bays empty tonight and both WD Elements in their boxes. Keep every box for 30 days. Why: during the install only two disks should exist, the stock 128GB UGOS drive and your new 1TB. Fewer disks, no wrong pick.
- You RAM and the 1TB drive go in.
Steps
- Unplugged. Pry out the rubber feet, remove the screws under them, lift the base off.
- Leave the small 128GB UGOS drive alone (it has a thermal pad). It is your way back to stock.
- RAM into the free slot: notch lined up, in at an angle, press down until both clips catch.
- The TEAMGROUP G50 into an empty M.2 slot on UGREEN's thermal pad. No heatsink; UGREEN does not support one.
- Base back on.
- You Plug it in. One CAT6 to a free port on the UniFi switch (not port 17, that is the access point), power through the UPS, then the cabinet's monitor and keyboard.
Stop 2BIOS and Debian Oct 16, about 1 hour
- You BIOS check. Power on and tap Ctrl+F12 (fallback Ctrl+F2). Confirm 16GB of memory and the 1TB drive. Set Advanced > Watchdog Timer > Disabled, then save and exit. Why: the Debian wiki says to. The watchdog restarts a box that never checks in with it, and on Debian nothing does.
- You Install Debian. Ctrl+F12 again, boot the
USB stick, pick Install.
Every screen that matters
- Location United States, time zone Mountain.
- Hostname
nas, domain blank. - Root password: leave it blank, so your user gets sudo.
- User
grant, with a password you will type twice more tonight. - Partitioning: Guided, use entire disk, the ~1.0 TB disk. Never the ~128 GB one. All files in one partition.
- "Force UEFI installation?" Yes. Without it the BIOS will not offer the new drive as bootable.
- Software: untick the desktop and GNOME, tick SSH server and standard system utilities.
- Reboot and pull the stick. If UGOS comes up instead, Ctrl+F12, pick debian, and move it first in the boot order.
- You Note its address. Log in on the monitor, type
ip -br a, and give that address a DHCP reservation on the EdgeRouter: Services, DHCP Server, LAN1, Actions, Configure Static Map. It also asks for the NAS's MAC address; typeip -br linkand use the line with the same name. - You Hand it to Claude. On the tower, run the
handoff script with that address. It asks for your NAS password twice, then prints
HANDOFF_OK. Tell Claude "the NAS is up".The command
In Windows Terminal, from
C:\Users\Exterminator\Documents\Claude\Projects\HomeServer\nas_kitpowershell -ExecutionPolicy Bypass -File nas_handoff.ps1 -NasIp 192.168.130.X
It installs the tower's NAS key, points
ssh nasat the box, and adds a temporary sudo rule with no password that the last stop removes.
Stop 3Test both drives before opening them Oct 16 to 18, it runs alone
- You Plug both WD Elements into the NAS's USB ports, still in their cases. Each one also plugs into the wall with its own power brick. Why: this is the only window where a bad drive goes back to Amazon intact.
- Claude Base setup, then the long drive tests. Updates, a firewall that allows your home network only, key only SSH, a Quick Sync check, then a full surface test of both drives, about 1.5 days. ZFS installs while they run. Pass means "Completed without error" and zero reallocated, pending and uncorrectable sectors.
Stop 4Shuck, mirror, copy about Oct 18
- You
Shuck
both drives into bays 1 and 2.
Steps
- Guitar picks along the case seam, slide the drive out, unscrew the little USB board.
- Write down each serial number. Bag each empty case with its USB board, screws and power brick, and write that serial on the bag. WD covers these drives for 2 years (the third year is only for orders from WD). If one dies inside that, put it back in its own case before you send it.
- Into bays 1 and 2. If Claude cannot see a drive, Kapton tape over the first three pins of its SATA power connector fixes it. Pin 3 tells the drive to stay off when the power supply sends 3.3 volts.
- Claude Asks first Build the mirror. Claude shows both serials and the test results, and waits for your "wipe ok". Then the two drives become one ZFS mirror of about 18.2 TiB. Why it asks: this erases both drives. The script also refuses the boot drive, anything under 15 TB, any serial that does not match, and any drive that already holds a pool, so a reinstall later can never wipe the library. ZFS comes from Debian's stable list (2.3.9) and updates itself with the rest of the system; say "backports" before this step if you want the newer 2.4.4.
- Claude Turn on the alarms and safety nets.
The NAS posts to your Discord, as "NAS", when a drive or the pool has trouble or one of its jobs fails. First you see
a "NAS alerts are on" line and a finished test scrub.
Why before the copy: the library lands on a box that already speaks up when something breaks.
What watches what
Safety net What it does What you see Pool alarm ZFS's own watcher reports a failing or missing drive, damaged data, and every finished scrub, healthy ones too, so silence means trouble A Discord post Drive tests A short self test on each drive every night, a long one each month, the two drives two weeks apart A post only if a test or a drive reading goes bad Job alarm Any of the NAS's own jobs that fails posts its name and last words. If Discord or the internet is down, it tries again in a minute, then less often, up to once an hour, until it lands A Discord post Snapshots Each app's settings: hourly for a day, daily for two weeks, weekly for two months, monthly for six. The media: daily, kept 3 days Nothing. If an update breaks one app, Claude rolls back just that app Docker waits for the pool The apps cannot start until every part of the pool is mounted, so nothing ever writes to the boot drive by mistake A Discord post if Docker cannot start Log cap Each app's log is capped in size and rotated Nothing Tested Oct 11, 2026 on a throwaway Debian 13 with a fake Discord: 80 checks pass, and 23 bugs planted on purpose are each caught. Not run yet: a real drive, the real pool, the real Discord. Details in the Honesty log.
- Claude Copy the library off E:. A network share for
the tower, then an overnight copy of Movie Center 2 (6.2 TiB, about 17 to 18 hours), then a second pass that must find
nothing left to copy. Nothing on E: is ever changed. Movie Center 2 holds more than movies, so each kind goes to its
own shelf and every loose movie gets a folder of its own. Afterwards, leave E: as it is. Until the NAS has a backup
of its own, E: is the only other copy.
Why first: E: shows a health warning, so this copy is also the rescue.
Where each folder lands
On E: Goes to Then Movie folders, plus 148 loose movie files Movies, one folder each Radarr adopts them (Stop 6) GoT and 8 more shows (about 490 GB) TV Sonarr adopts and renames them. The commentary tracks on 34 GoT episodes (Seasons 1 to 4) come along; pick one under Audio while it plays The older Game of Thrones copy (303 GB) Its episodes stay on E: only. All 65 are already in GoT, 64 of them the same file byte for byte (the other was a mislabeled 720p copy) Its 37 extras go to the show's Featurettes folder with clean names, where Plex lists them as extras. Its pictures and notes are parked GoT Season 8 subtitles (in a Subs folder) Next to each episode, under the episode's name Plex finds them by name Music (two folders) Music Plex, Plexamp and Jellyfin Audio Books, and The Singularity Is Near Audiobooks Audiobookshelf uTorrent, an Adobe installer, a PDF Parked Not media Measured Oct 10, 2026, by
copy_plan.pyin the kit. Three movie folders hold no movie; Stop 6 says what happens to them.
Stop 5Plex and Jellyfin while the copy runs
- Claude Docker and the apps. Plex, Jellyfin, Seerr, Radarr, Sonarr, Prowlarr and Audiobookshelf start in Docker, each on an exact version, reachable from home only.
- You Claim Plex. Signed in, open plex.tv/claim and paste the code to Claude. It dies after 4 minutes. Claude then adds the movie, TV and music libraries to Plex and Jellyfin and the audiobook and podcast libraries to Audiobookshelf, makes your logins, and turns on Quick Sync in Jellyfin. Why: it ties the server to your Plex account so your apps find it.
- You Then sign in on the TV and phone. The Plex app finds
the server by itself. Jellyfin is at
http://<NAS address>:8096and Audiobookshelf athttp://<NAS address>:13378, both with the NAS_APP login in your.env. If either shows a setup screen instead, Claude is not done; leave it alone. On the phone: music in Plexamp. Audiobooks and podcasts in Audiobookshelf's own app on Android (beta). Its iPhone beta is full, so use an App Store app that connects to Audiobookshelf. Reddit users name Prologue, Plappa and Soundleaf (prices not checked).Why some movies play with no sound straight off a drive
Your TV is a 2020 LG CX. LG left DTS sound out of its 2020 TVs. About a third of your movies (187 of 575 files, including 12 of the 20 highest quality copies) carry only DTS sound, so the TV's own player plays them with no sound. Among the TV files, 50 of 212 are DTS only too, mostly Game of Thrones extras. Five more movies use VC-1 video inside .mkv, which LG lists for .asf and .wmv files only, so they may not open at all.
Played through the Plex or Jellyfin app on the same TV, they work: the NAS converts the sound as it plays, free in both apps. VC-1 also needs the picture converted: free with Quick Sync in Jellyfin; in Plex, Quick Sync needs Plex Pass, otherwise the processor does it. Later, if you want them right straight off a drive too, Claude can add a Dolby Digital 5.1 track to each of those files once (the DTS track stays) and convert the five VC-1 movies. Nothing else in the library troubles this TV: no 4K files, no Dolby Vision, nothing over 35 Mbps of video.
Scanned Oct 10, 2026: every video on E:, read only. Sources: Emby forum, Jul 2, 2020 (owners: the 2020 models have no DTS license), TechRadar, Mar 31, 2025 (LG dropped DTS in 2020 and brought it back in 2023), LG's webOS 5.0 format list (VC-1 for .asf and .wmv only; its sound list still says DTS, which owners and the press say the 2020 TVs dropped).
- You Your call
Plex Pass: start free. If you buy, buy in Black Friday week. Playing at home on a TV that handles the file is free. Pass adds
Quick Sync
conversion and watching away from home. Jellyfin does the conversion free, so try it first. If you buy it, turn on Plex Settings > Transcoder > Use
hardware acceleration when available.
Prices and when to buy, read on plex.tv Oct 10, 2026
When to buy. Plex put the Pass on sale in Black Friday week every year from 2020 to 2025. In 2025 it was 40% off every plan with code ANYPASS40, Nov 24 to Dec 1 (Plex's sale page that week). 2020 to 2024 were 25% off lifetime only. Nothing is announced for 2026. If Plex keeps the pattern, the sale runs Mon Nov 23 to Cyber Monday Nov 30 (estimate), so look at the plans page on Nov 23. A daily watch on the tower (on the NAS later) reads Plex's sale banner, its Plex Pass blog, Slickdeals, the news and Plex's emails to you, and pings your Discord the day a sale or code shows up. In 2025 the sale leaked on Slickdeals on Nov 21, three days early.
If 2025's 40% off repeats Sale price (estimate) Then Yearly $41.99 first year Renews at $69.99 5 years about $149.99 New plan since Jul 1, 2026, so its sale terms are unknown Lifetime about $449.99 Only if you are sure of 10 or more years If Plex goes back to 25% off lifetime only, lifetime is about $562.49 and the rest stay at list. There is no Plex Pass trial; the 14 day trial is for Remote Watch Pass only. No cart or cancel discount turned up in reports from 2022 on; the daily watch also reads Plex's emails to you in case one ever comes. Do not start a monthly to qualify: a free account already counts as new, and the credit for the unused days of a monthly comes to about $1 to $6 (Plex's upgrade rules). At checkout, type the code even if the page still shows full price, and buy on plex.tv, not in a phone app store.
Plan Price Worth it when Free $0 Home TVs play your files directly Plex Pass monthly $6.99/mo A device stutters. Try one month Plex Pass yearly $69.99/yr You keep it Plex Pass 5 years $249.99 You keep it past about 3.6 years Plex Pass lifetime $749.99 Past about 11 years of yearly. It was $249.99 until Jul 1, 2026 Remote Watch Pass $2.99/mo or $29.99/yr Away from home streaming only Away from home. Outside the house, Plex plays your own movies and shows only with a pass, and that holds in every Plex app: phone, TV, Roku, game console, computer and web. If you, the server owner, have Plex Pass, everyone you share with is covered too. Without it, each viewer needs their own Plex Pass or a Remote Watch Pass. Smart TVs, LG included, joined the rule Mar 23, 2026. Music in Plexamp is exempt. (Plex's rules, last changed Apr 10, 2026, and its Smart TV notice of Mar 11, 2026; both read Oct 11.)
Plex plans. HDR tone mapping on 13th gen Intel is reported flaky, so test one HDR movie before paying.
Stop 6Movies that add themselves
- You VPN: done Oct 10. You bought
Proton VPN Plus for 2 years, and its
WireGuard
key is already in your
.env, so on build day Claude just loads it. Downloads only ever run through the VPN; with it down, the downloader has no internet at all.Why not Avira, and the dates to watch
- Avira's VPN cannot run on the NAS. It works only inside Avira's own apps, and Avira lists Windows, Mac, Android and iOS. Avira's community manager: "there aren't any configuration profiles that can be exported". Keep Avira on your devices until it ends; Proton covers 10 devices after that.
- Why Proton. It works with gluetun (the VPN container here) on WireGuard, with port forwarding built in. Downloads are allowed only on its P2P servers (Proton: "P2P is only available on paid Proton VPN plans"), so the kit picks only those. The free plan cannot do this job.
- Oct 10, 2027: the NAS key (config "nas") expires. Renew it on Proton's downloads page before then, or downloads stop. Nothing leaks; they just stop.
- Oct 10, 2028: the 2 year price ends and the plan renews yearly at the full rate. Claude checks for a cheaper way a few weeks before, and checks that your card on file still works. Both dates are on your Google Calendar.
- Claude Wire the apps together and prove the VPN holds: the downloader's public address must be the VPN's, and with the VPN stopped it must reach nothing. Claude also sets three guards in Radarr and Sonarr: no downloads or imports once the pool is down to about 2 TB free, Radarr looks 14 days before a home release (the Doomsday example), and both post to your Discord when something lands or needs you. A test line from each shows up in Discord right then. Then Radarr's Library Import adopts the movies copied from E:, so it knows what you already own. Shows copied over later get the same from Sonarr. A few clicks; Claude walks you through it. Game of Thrones Season 7 is 720p in both copies. After the import only Season 7 stays on Sonarr's watch list, so Sonarr swaps just those episodes for 1080p and leaves the other seasons alone.
- You Choose your sources in Prowlarr. Which sites it searches is your call; this page names none. Also add the built in Internet Archive, for a legal first test. Then tell Claude. It ticks both Fail Downloads boxes (Executables, Potentially Dangerous) on every source in Radarr and Sonarr, and a timer ticks them again on any source that lacks them, every 15 minutes. Why: fake releases that hold a program instead of a video came in four waves in 2026, the latest Oct 8 to 10. The boxes start off, and Prowlarr never ticks them on the sources it adds. To see them yourself: open a source in Radarr and click the gear at the bottom of its window (it says "Hidden, click to show").
- You The real test. Add Night of the Living Dead (1968), which is public domain, to your Plex Watchlist on your phone. It should show in Seerr within 3 minutes, then download, then appear in Plex and Jellyfin. Why this one: it is free to share, so the first run proves the whole chain with nothing to worry about.
- Claude Turn on the repeat search. After the Library Imports, Claude test runs it on your library with nothing sent, then switches it on. From then on it runs every 4 hours (the Doomsday example says why). Three movie folders hold no movie (About Schmidt, The Dark Knight Rises, Safe House). Your call on Oct 10: they stay skipped. Ask for any of them in Seerr if you want it.
- Claude Asks first
Take back Claude's sudo. Your call on Oct 10: remove it, lend it back when needed. Claude installs a lend
command first, then removes its own rule. Later, when Claude needs it, type
ssh -t nas sudo claude-sudo onon the tower, with your NAS password. Claude gets it for 4 hours, then it ends by itself, even across a reboot.ssh -t nas sudo claude-sudo offends it early. Like a key that stops working at a set time.. the lend is a sudo rule with its own end time written inside it. Tested Oct 11 on a throwaway Debian 13: 57 checks and two reboots pass.
ReferenceEverything else
The software, and what lost
Picked Oct 9, 2026 from Reddit, GitHub and each project's own pages. Every version was read from its image registry that night.
| App | Job | Version | Why this one |
|---|---|---|---|
| Plex | Plays the library on every TV and phone | 1.43.4 | Best apps everywhere. Runs from the LinuxServer.io image |
| Jellyfin | The same library, free, no account | 12.2 | Quick Sync with no subscription, and a fallback if Plex changes its terms |
| Plexamp | Plays the Music library on your phone, car and desktop | phone app | Plex's own music player, free since Jul 18, 2023 (some extras need Plex Pass) |
| Audiobookshelf | Audiobooks and podcasts. Finds a podcast, then downloads new episodes on a schedule | 2.37.1 | Plex has no audiobook library and dropped podcasts Apr 15, 2022. Jellyfin's book library gets mixed reviews |
| Seerr | Reads your Plex Watchlist every 3 minutes and files the requests | 3.5.0 | Overseerr and Jellyseerr merged into it. Overseerr was archived Feb 15, 2026 |
| Radarr | Finds the movie, picks the best copy, files it under a clean name | 6.4.4 | The standard. Nothing close |
| Sonarr | The same job for TV: finds each episode, files it by show and season | 4.0.20 | The standard for TV, and it works the same way as Radarr |
| Prowlarr | One list of search sources, shared with Radarr and Sonarr | 2.6.5 | Beats Jackett because it hands the list to both by itself |
| qBittorrent | Downloads | 5.2.4 | Radarr's best supported client |
| gluetun | The VPN the downloader lives inside | 3.41.3 | No tunnel, no traffic, by design |
Repeat search (the kit's own wanted_search.py) | Every 4 hours: searches again for anything wanted that is out, and clears downloads stuck for a day | kit | Radarr and Sonarr never go back to search on their own. A small script with no web page and no open port. How it helps |
Skip: Huntarr (a Feb 2026 flaw exposed its users' passwords and app keys), Watchtower (archived Dec 17, 2025, and auto updates fight pinned versions), Ombi (slow), Cleanuparr (three security flaws in 2026, fixed since; the kit's own repeat search clears stuck downloads).
Why downloads and the library share one folder
Downloads land in /data/torrents/movies, the library lives in /data/media/movies, and both
sit on one ZFS dataset, tank/data. That lets Radarr and Sonarr make a
hardlink
instead of a copy. Two datasets would be two file systems, and in
TRaSH Guides'
words, "You CAN'T hardlink across separate file systems". Apps, backups and camera footage keep their own datasets.
How it stays private
- Nothing on the EdgeRouter forwards to the NAS. That is the real wall.
- The firewall allows your home network only. Docker skips that firewall for the ports it publishes, so each of those is tied to the NAS's home address.
- The downloader shares the VPN container's network. No tunnel, no traffic.
- Every app has a login, and every version is pinned and updated on purpose (the NAS app rules).
Fitting it in the cabinet
From your photo: EdgeRouter 4, a UniFi switch, a CAT6 patch panel, a CyberPower UPS and PDU, the Reolink NVR, and the Dish Hopper, in an enclosed cabinet with a thermostatic exhaust fan to the attic. The DXP4800 Pro is about 7 x 7 x 10 inches, smaller than the Hopper's footprint. One CAT6 to the UniFi switch, not the router.
Your access point hangs off port 17 of that switch, jack 19 on the patch panel. Pick a different port.
The kit Claude runs, on the tower
Every step Claude runs is written and tested ahead of time in
C:\Users\Exterminator\Documents\Claude\Projects\HomeServer\nas_kit.
Start with RUNBOOK.md: who does what, the two places Claude asks first, the proof for each step, and how
to undo it.
| File | Does |
|---|---|
nas_handoff.ps1 | Your one command after Debian's first boot |
nas_run.py | Claude's remote control. Passwords travel hidden, never inside a command |
bootstrap.sh | The system, one step at a time: base, drive tests, ZFS, pool, share, Docker, apps |
compose.yml | The eight apps, versions pinned (Sonarr for TV added Oct 10) |
configure_apps.py | Wires the apps through each one's own API, then reads every setting back |
Typing it by hand instead: every command is in
C:\Users\Exterminator\Documents\Claude\Projects\HomeServer\BUILD_WALKTHROUGH.md
Inventory: what you have, what you need
Everything the build touches, in one list. Tick a row once it is in the house or done; this page remembers per device. Spent so far: $2,196.02 on parts, plus $71.76 and tax for two years of VPN. Space: the two 20TB drives hold the same files (a mirror), so you get about 18 TiB, and your movies use 6.2 TiB of it.
If neededNothing left to buy
- Maybe Kapton tape, only if a shucked drive does not show up about Oct 18. Some drives read a power pin as "stay off", and a strip over it fixes that (the fix). Any small roll of polyimide tape works; it takes about an inch. If it comes to that, Claude finds a link that day.
CheckBefore Oct 16
- Check Two more outlets near the NAS, Oct 16 to 18. Each 20TB drive runs on its own power brick during the 1.5 day test, before it is shucked. A power strip is fine; they do not need the UPS.
- You Read the UPS model off its label (back or bottom) and tell Claude. With it, the NAS can shut itself down cleanly when an outage outlasts the battery, instead of losing power mid write.
OrderedOn the way
- TEAMGROUP G50 1TB NVMe, $169.99. Arrives Sun, Oct 11. Holds Debian and the apps' scratch space. The only G50 size on UGREEN's approved list.
- Samsung 8GB DDR5-5600 SODIMM, $135.75. Arrives Thu, Oct 15. Makes 16GB. Read the label before it goes in.
- UGREEN NASync DXP4800 Pro and 2x WD Elements 20TB, $1,890.28 for the order. Arrives Fri, Oct 16. Intel Core i3-1315U with Quick Sync, four bays. The NAS comes with its power brick, two network cables, a screwdriver and tool free drive trays. Each WD Elements comes with its own power brick and USB cable. The drives get tested, then shucked into the mirror.
HaveAlready yours
| What | Its job here | |
|---|---|---|
| √ | Tower PC | Claude runs the build from it. Its E: drive holds Movie Center 2 (6.2 TiB), copied to the NAS about Oct 18 |
| √ | Network cabinet | Router, UniFi switch, patch panel and UPS are all in place. Where the NAS goes |
| √ | Installer stick | Debian 13.7, written and read back by Claude Oct 10. The USB step |
| √ | Claude's side of the tower | The NAS login key, the ssh nas
shortcut and the app passwords. Done Oct 10 |
| √ | Proton VPN Plus | Two
years, bought Oct 10. The NAS key is in your .env. Dates to watch |
| √ | Avira Prime | Your devices' VPN until about Thu, Jun 24, 2027 (257 days on Oct 10). Nothing renews. Proton takes over then; reminder on your calendar Jun 10, 2027 |
| √ | Monitor, keyboard and mouse | In the cabinet already. Used on build night for the BIOS and the installer |
| √ | Cabinet hookups | Checked Oct 10: an HDMI cable, with the monitor set to its HDMI input; a free UniFi switch port (not 17, the access point's); a free UPS outlet for the NAS; Cat5e cables and a crimper. A cable you crimp gets a speed check on build night |
| √ | EdgeRouter login | Works, checked Oct 10. Build night uses it once to reserve the NAS's address |
| √ | Guitar picks | Set aside. They pop the drive cases open when you shuck them, about Oct 18 |
| √ | Bitwarden | Holds the Proton and EdgeRouter logins |
| √ | Reolink camera recorder | Keeps recording to its own 2TB drive, about 16 days that loop. It records only to a drive inside it or plugged into it. To keep more, Frigate can record the cameras onto the NAS later, capped (2TB is about 17 more days) |
| √ | TV and phone | The Plex app, for the Watchlist and for watching |
AccountsLock them down
- You Proton: turn on two step login and save the recovery phrase in Bitwarden. How.
- You Plex: reset the password and turn on two step login. Plex was breached in Sep 2025. You sign in on build night to claim the server; Plex Pass can wait.
Week oneWhen Claude asks
- You A free healthchecks.io account, about 3 minutes. The NAS will check in with it every few minutes; if the NAS goes silent, it tells you by email or Discord. Why: a NAS that lost power or froze cannot post its own alarm.
- You Your call A Backblaze B2 account, about 5 minutes, card on file, pay as you go. The NAS sends it a nightly encrypted copy of the apps' settings and your music and audiobooks, about 65 GB. B2 charges $6.95 per TB a month (its own page, read Oct 11, 2026), so that is about $5 a year (estimate). Not the movies: Radarr and Sonarr can fetch those again. Why: a fire or a theft takes the NAS and E: together. This copy lives somewhere else.
- You A spare USB drive, 256 GB or more. Any one you have. It holds a second copy of the same backup next to the NAS, quick to restore from.
ReferenceHow the shopping went
Why shucking won after all
On Sep 13 a WD Elements 20TB cost $764.99, $38 per TB, and shucking looked dead. A Prime deal on Oct 7 put it at $549.99, $27.50 per TB, well under the 16TB NAS drives at $714.99, $44.69 per TB. The tradeoff: WD's warranty is at risk once a case is open, which is why both drives get the full test first.
The AI question, still settled: buy nothing
Why, in numbers, and what I would buy if the answer changes
September 2026 is the worst time in years to buy memory. AI datacenters are projected to take about 70% of the world's memory output, street prices are up about 89% year over year, and a card with a $1,999 list price sells for $5,000 and up. Sinking $2,000 to $4,700 into AI memory for AI you are not sure you want is the expensive mistake here.
The trap in the 128GB mini PCs: they read like they run huge models, and for one particular kind they do. Think of a library where you only ever need one shelf per question. Those boxes fetch a shelf fast. A dense model wants the whole library read for every single word, and there the memory speed puts a hard ceiling on it, roughly 6 to 7 words per second, which is slower than you can comfortably read.
| Option | Price | What it actually does |
|---|---|---|
| Your RTX 3080 Ti, already owned | $0 | Models up to about 34B on demand. Covers it |
| Used RTX 4090 24GB in a used tower | $1,800 to 2,400 | If AI becomes a real yes, this is the value buy |
| 128GB unified mini PC | $1,899 to 2,299 | Fast on the models that load one shelf at a time, slow on the dense ones. Only if you know which you need |
| NVIDIA DGX Spark | $3,999 to 4,699 | Same ceiling as above, triple the price |
| RTX 5090 | $5,000 to 5,800 | A 150% premium over list. No |
Correction worth keeping: a lab reported 22 words per second on a dense 70B model on the DGX Spark. That is faster than its memory can physically feed the chip, so something else was going on. The honest number is 6 to 7.
The Sep 13 research, superseded by the Oct 7 order
Kept for the record. The pick then was the DXP4800 Plus. On Oct 7 the Pro won: the same box with a faster chip (Core i3-1315U instead of the Pentium Gold 8505) for about $116 more.
The Sep 13 buy list
Prices and ratings fetched Sep 13, 2026, 12:03 AM Denver from organic Amazon listings, sponsored results dropped. Amazon began blocking automated price reads on Sep 19, 2026, so treat every number here as "check it in the cart" rather than live.
| Item | Price | Owner rating | Why this one |
|---|---|---|---|
| UGREEN NASync DXP4800 Plus (diskless) | $619.99 | 4.6 stars, 618 ratings, 4% one star | Passes every requirement. Quick Sync, 64GB ceiling, 4 bays, fits the cabinet, and people have run Proxmox on this exact model for months |
| Seagate IronWolf 8TB x2 | $289.99 ea | 4.2 stars, 315 ratings | CMR, which is what you want in a mirror. Best cost per terabyte found at $36 |
| Crucial P310 1TB NVMe | $179.00 | 4.7 stars, 11 ratings | Only if you wipe to Debian or Rocky. A 500GB is cheaper and plenty |
| Total with the mirror | ~$1,200 | $910 if you start with one drive |
Do not buy a BarraCuda 8TB for this. It is $249.99 and looks like a deal, but it is SMR and will crawl in a mirror.
Why the Plus, and what lost
UGREEN NASync DXP4800 Plus THE PICK
Pentium Gold 8505, Quick Sync with 48 execution units, 8GB in one of two DDR5 slots and a 64GB ceiling per Intel's own spec page, four 3.5 inch bays plus two M.2, about 7 x 7 x 10 inches. In stock at two sellers when this was verified.
The full ranking, and why each one lost
From a 13 agent research run on Sep 13, 2026: six sweepers, six verifiers, one critic, 349 tool calls across 77 websites. Sponsored listings, "Amazon's Choice" badges and affiliate "best of" articles were excluded as evidence on purpose.
| # | Box | Rating | Verdict |
|---|---|---|---|
| 1 | UGREEN DXP4800 Plus | 4.6 (618, 4%) | BUY. Passes every gate |
| 2 | UGREEN DXP2800, $369.99 | 4.5 (916, 6%) | Budget alt. Its N100 chip is capped at 16GB of RAM forever, so it can never grow. Fine for Plex plus two or three scrapers |
| 3 | TerraMaster F4-424 Pro | 4.1 (61) | Too few reviews and a history of security holes in its own OS. You would wipe it immediately |
| 4 | Synology DS225+ / DS423+ | 4.5 (224) | Locked to their own OS, so your Linux never goes on it |
| 5 | QNAP TS-464 | 4.4 (254) | Ransomware hit their systems in 2021, 2022 and 2024 |
| 6 | Asustor Lockerstor 4 Gen2 | 4.3 (122) | Below the rating bar, 4GB of RAM to start |
| 7 | Used Lenovo Tiny + external drive box | DAS 4.2 (373) | Cheapest, and your comfort zone, but it is two boxes and a USB bridge. You ruled that out |
| 8 | Aoostar WTR Pro / Minisforum N5 Pro | 3.8 (28) / 4.6 (9) | The AMD versions cannot hardware transcode Plex on Linux, the Intel version is out of stock, and the ratings are too thin to trust |
| 9 | HPE MicroServer Gen10 Plus v2 | n/a | Its server firmware switches Quick Sync off on every chip option |
| 10 | Build it yourself, Jonsbo case + N100 | n/a | Hours of work, same 16GB ceiling, and owners complain about cooling |
| x | Beelink ME Pro | 3.9, 16% one star | You rejected this on Sep 12, 2026, and you were right |
What the reviewing agent caught and changed
- Blocking. The cheaper DXP2800 was ranked first with an empty box next to the RAM requirement. Intel's spec page caps its N100 chip at 16GB, so it fails. Demoted to budget alternative, the 4800 Plus promoted. I reread Intel's page myself to confirm.
- The Aoostar was scored with the AMD model's memory and the Intel model's video chip, which no single box actually has. Fixed.
- One verifier marked dimensions and power "verified" against a vendor page that does not list them. Downgraded.
- Note: the two retailer rule for ratings could not be met by any box on the market, since Newegg has single digit review counts. The 4.6 with 4% one star is what separates the winner.
The drive market, Sep 13, 2026
On Sep 13, shucking looked dead. Buying a cheap external drive and pulling the disk out used to beat buying a bare drive. That day a WD Elements 20TB runs $764.99, which is $38 per terabyte, worse than the NAS drives.
| Drive | Price | Per TB | Note |
|---|---|---|---|
| Seagate IronWolf 8TB CMR | $289.99 | $36 | Best cost per terabyte for a real NAS drive that day |
| WD Red Plus 12TB | $459.99 | $38 | 4.0 stars, 373 ratings |
| Seagate One Touch 16TB | $509.99 | $32 | Cheapest per terabyte, but it is not built for a NAS |
| WD Elements 20TB external | $764.99 | $38 | $549.99 on Oct 7, and that is what you bought |
NAS day extras
For the day the NAS is on the network and Plex works. Ranked: your data first, then the safety rule, then moving the tower's jobs, then new features, then two leads. Tick a row when it is done. The steps stay closed until you want them. From the GitHub sweep, rechecked Sep 28, 2026, 10:22 PM Denver. What was and was not checked is in the Honesty log.
- Pin an exact version. Never stable or latest, and no auto updater.
- Update on purpose. Read the release notes first, and back up the app's config before every upgrade.
- LAN only, the app and any share it uses.
- Make the NAS your backup target. Use
Kopia, free backup software that
encrypts everything before it leaves the tower.
Why: nothing on the tower has a second copy. D: logs disk retries and E: shows a health warning.
Careful steps
- Tower first, if it is not done yet. Download the v0.23.1 Windows zip from the official release. Before you run it, check the gpg signature on checksums.txt, the SHA256 and the Windows code signature. Make one repository on F:. Skip KopiaUI, the desktop app.
- Give Kopia its own spot on the NAS. One shared folder just for backups, and a NAS user that only Kopia uses.
- Copy the F: repository to the NAS with Kopia's
sync command,
repository sync-to filesystem. The copy stays encrypted, so the NAS only ever holds scrambled pieces. - Back up the F: folders to the NAS too. Homes and Family on F: have no second copy. Until NAS day the plan snapshots them to C:. On NAS day, point that snapshot at the NAS.
- Run it from the dispatcher like every other job. No new Task Scheduler task.
- Keep the backup password off the tower too, on paper somewhere safe. If it only lives on the tower and the tower dies, the backup is locked for good.
- Test one restore of a single folder from the NAS copy before you trust it.
- Follow the NAS app rules. For Kopia, every upgrade also gets the signature check from step 1.
- Run every robot in the same locked box. A container template borrowed
from OpenMuse. Skip the app
itself: it will not start without CopilotKit's cloud key.
Why: if a robot goes wrong, it is stuck in the box and can reach nothing outside it, with one listed exception.
Careful steps
- Start from this template. It is a standard
Compose file.
Swap ROBOT for your robot's image and DIGEST for its sha256.
services: robot: image: ROBOT@sha256:DIGEST user: "65534:65534" read_only: true cap_drop: [ALL] security_opt: - no-new-privileges:true network_mode: none mem_limit: 512m memswap_limit: 512m cpus: 1 pids_limit: 128 tmpfs: - /tmp:rw,noexec,nosuid,nodev,size=64m - What each line buys you. It runs as nobody, it cannot change its own files, and it holds none of root's capabilities. It has no network, 512 MB with no swap, 1 CPU and 128 processes. Its /tmp holds 64 MB, and nothing written there can run.
- No mounts and no secrets. Hand the job in, read the answer out.
- Stop every run at 30 seconds and keep only the first 128 KB of its output.
- Pin each image by its digest, not a tag. The NAS app rules cover the rest.
- One allowed exception. A robot that must check OSV, the open database of known software holes, gets a network to that one site only, through a proxy that allows nothing else. That proxy is not in this template. OpenMuse itself gives its box no network at all.
- What does not go in the box. The browser scrapers, which need the web and more memory. Frigate, which has its own row below, and the media apps on the Build tab.
- Start from this template. It is a standard
Compose file.
Swap ROBOT for your robot's image and DIGEST for its sha256.
- Move the tower's scheduled jobs to the NAS. The NAS stays on and the tower
does not. 14 of the tower's 19 jobs can move. The four backup jobs stay and point at the NAS
instead, and the agent box stays too. You and Claude move them one at a time, after Plex works.
Why: while the tower is off, its jobs wait, and nothing watches the store.
The plan
- One timer on the NAS runs a Linux copy of the job runner every 15 minutes, with only the keys those jobs need.
- For each job: copy it, fix its paths, try it once, compare with the tower's run, then switch it off on the tower.
- Never on both machines at once for anything that posts to Discord or touches the store.
The full list:
C:\Users\Exterminator\Documents\Claude\Projects\HomeServer\TOWER_JOBS_TO_NAS.md - Add person and car alerts to the cameras. Use
Frigate, a self hosted
camera recorder that runs on the NAS.
Why: the four cameras only sense motion. Frigate tells a person or car from blowing leaves, with no cloud.
Careful steps
- Wait for the NAS. Its object detection runs on the i3-1315U's built in graphics through Frigate's OpenVINO detector.
- If you must trial it on the tower, open Docker Desktop, go to Settings > Resources >
WSL Integration,
and untick the default distro and agentbox. Then confirm
dockeris not found inside agentbox. Docker's own page says the integration is on for the default distro out of the box. - Start with one camera. Add the others one at a time, once its alerts look right.
- Give Frigate its own camera login. A User level account on the NVR with no admin rights. Test it on that one camera first.
- Follow the NAS app rules. Frigate's versions are on its releases page.
- Pass in only the video chip. Try it without privileged mode first.
- Cap the recordings at a few days to start, so they cannot fill the pool.
- Recheck Beszel before you try it.
LEAD, NOT VERIFIED
Beszel is a health dashboard to run on the NAS.
Why: nothing about it could be verified, and three of the first plan's four choices broke your rules.
Careful steps
- Check its facts first, the day the NAS arrives.
- If it passes: the NAS app rules, on the NAS only, one user, and no link to Paperclip (the agent company on your tower) or any other agent.
- Compare NetAlertX with your own LAN scanner.
LEAD, NOT VERIFIED
NetAlertX spots the devices on the home network.
Why: it came from one read with no checks. Add it only if it beats the scanner you built.
Careful steps
- Read its repo and check its facts first.
- If it wins: the same rules as Beszel.
Honesty log
What was checked and what was not, newest first.
Safety nets, sudo lend and app guards, Oct 11, 2026
- Tested on a throwaway Debian 13 box (systemd 257) with a fake Discord and a fake Radarr and Sonarr: the alarms, the snapshot plan (sanoid 2.2.0), the Docker guard and both timers, 80 checks; 23 bugs planted on purpose, each caught by the check meant for it. The sudo lend: 57 checks and two reboots; 12 planted bugs caught.
- Tested on the tower: the system script's dry run, 28 cases, 13 planted bugs caught; the Radarr and Sonarr guards against a fake copy of both apps, 24 checks, 12 planted bugs; the Fail Downloads keeper, 18 checks, 10 planted bugs.
- Read in Radarr's and Sonarr's source code: each settings page saves whole, so the script sends every field back; both apps show the Discord address in plain text to anyone with the app's key, so the script never prints it; Sonarr's Import Complete posts once per download, not once per episode.
- Plex's away from home rule, read Oct 11 in Plex's support article and its Smart TV notice (both quoted on the Plex Pass row).
- One outside review, Oct 11: nothing blocking. Its three fixes are in: the job alarm tries again while Discord is down, both timers start only after the keeper's first run works, and the keeper gets 10 minutes a run instead of 5.
- Not run yet: the real NAS, real drives, the real pool, the real apps and the real Discord. Build day is the real test.
Build tab and software stack, Oct 9 to 10, 2026
- Verified from primary sources, Oct 9, 2026: every app version exists on its image registry (Sonarr's on Oct 10); Overseerr's archive date and the Seerr merge (GitHub); Plex Pass prices (the rendered plex.tv page, Oct 10; the lifetime price history from Plex's blog); the hardlink rule (TRaSH Guides, quoted); gluetun's port forwarding list (gluetun wiki); the Internet Archive search source (Prowlarr's own definitions).
- Read in each project's source code, Oct 9 to 10: every setting Claude's setup script changes in Radarr, Sonarr 4.0.20 (added Oct 10), Prowlarr, qBittorrent, Plex, Jellyfin 12.2 and Seerr 3.5.0, including Seerr's Watchlist sync for movies and TV, and that a show on the Watchlist asks for every season.
- Tested on the tower, without the NAS: the system script ran every step as a dry run against fake Linux tools, 17 of 17. The app setup script ran three times against a fake copy of all seven apps, the last run created nothing new, and the fake caught every bug planted in it on purpose (five so far, three of them for TV). Passwords were confirmed to travel without showing in any command.
- Not run on the real box. Nothing has touched real hardware yet. The fakes prove the scripts' logic, not that the real apps answer the same way. Build day is the real test.
- Inferred: the Pro's BIOS menu names (the Debian wiki tested the DXP4800, not the Pro by name); Plex's hardware conversion switch is set by hand because its setting name is undocumented; that the test movie's name parses cleanly in Radarr.
- Verified Oct 10: Proton prices on its live checkout, the NAS key in
.env(read back, never shown), and the key's Oct 10, 2027 expiry on Proton's page. - Inventory, checked Oct 10: each WD Elements Desktop ships with its own AC adapter and USB cable (retailer kit lists; a 3.5 inch drive needs 12 volts, which USB cannot supply); the DXP4800 Pro box holds two CAT7 network cables, the power brick, a screwdriver and two thermal pads, and the NAS has one HDMI port and four USB A ports (IT-Connect review; the Plus's box matches, per this review), with tool free, lockable trays (NASCompares). Avira's end date is your own reading of 257 days left on Oct 10.
- Not checked: how the box sounds inside the cabinet, how long the Pro's network cables are, and whether its bays need the Kapton fix at all (no reports either way).
Sep 13 box research: verified at send time
- DXP4800 Plus: 4.6 stars, 618 ratings, 4% one star, $619.99, in stock at Amazon and Newegg.
- Intel's spec pages for both chips: the 8505 reaches 64GB and has Quick Sync, the N100 stops at 16GB.
- Every buy list price and rating, read off organic listings with sponsored cards dropped.
- The Dish Hopper's dimensions, used as the cabinet fit test.
Sep 13: verified by a research agent, not rerun by me
- A Proxmox forum thread describing this exact model running for months.
- The physical dimensions, the 8GB of installed memory, and the Newegg review counts.
- That HPE's firmware blocks Quick Sync, from two independent forums.
Sep 13: not verified
- Idle power. Sources range from 24 to 45 watts. Noise is not published at all.
- Whether installing your own Linux keeps the hardware warranty. UGREEN said yes through a reviewer, said something different in 2024, and their warranty page is silent. Keeping UGOS on the internal storage sidesteps it.
- The claim that UGOS phones home. Community reports only.
- Micro Center Denver stock, and price history. Both sites block automated reads.
Sep 13: not checked at all
- The text of the one and two star reviews. Amazon requires a login to read them.
- Used prices on eBay, and how the fan behaves inside a sealed cabinet.
NAS day extras, checked Sep 28, 2026, 10:22 to 11:39 PM Denver
- Verified from GitHub, Sep 28, 2026, 10:22 PM Denver: the three picks and OpenMuse exist, and the licenses match (Kopia Apache 2.0, Frigate MIT, Jellyfin GPL 2.0). Kopia v0.23.1 is the latest release and ships a signed checksums file. A critic reviewed the sweep report before this section was written.
- Checked against the live pages, Sep 28, 2026, 10:45 to 11:11 PM Denver: every link in the section opens, and each step that cites one of these pages matches it: Docker's WSL page, Kopia's sync docs, Jellyfin's Intel guide, Frigate's detector docs and the Compose spec. The link checker opened every link on this page again at 11:39 PM Denver.
- Checked against OpenMuse's code, Sep 28, 2026, 11:10 PM Denver, in its sandbox file. The box's limits match it. Two differences are on purpose: the template runs as nobody, not user 1000, and it mounts nothing. The OSV exception is the sweep's plan for your NAS. OpenMuse has no such robot.
- Not verified: Beszel and NetAlertX. Their rows carry the lead tag.
- Not tested. Nothing in the section was installed or run.
- Claude's own extras, not sweep findings. For Kopia: its own NAS user, the restore test, upgrading on purpose and LAN only. For Frigate: its own NVR login, the version pin, the config backup, LAN only, no privileged mode and the recording cap. The video chip rule, the robot box's user 65534, digest pin and no swap line, and the NetAlertX rules are Claude's too. So are keeping the browser scrapers out of the robot box, Beszel's "or any other agent", the paper copy of the Kopia password, and the one NAS app rules list.