NAS 与备份

1. In DSM, open Control Panel → User & Group → User → Create and name the account as follows, with a long password used nowhere else.

   dumbmonit

2. Join groups: tick administrators.

3. Assign shared folder permissions: tick No access on every shared folder.

4. Assign application permissions: Deny every application except DSM, and Active Backup for Business if you want its tasks read.

5. Keep two-step verification off for this account (Control Panel → Security → Account).

6. In DumbMonit, enter the NAS address (HTTPS, port 5001 by default) and this account's user name and password.

注意. The administrators group is required by DSM's storage API, not by DumbMonit: that is why the account gets no shared folder and no other application.

1. Open Credentials → Groups → Add, name the group as follows and give it the Local Administrator privilege.

   dumbmonit

2. Open Credentials → Users → Add, name the account as follows and make dumbmonit its primary group. Leave shell access, sudo and SSH off.

   dumbmonit

3. Open Credentials → Users → API Keys → Add, pick the dumbmonit user, name the key and copy it: TrueNAS shows it only once.

4. On TrueNAS 24.10, the path is the user menu at the top right → API Keys → Add.

5. In DumbMonit, enter the NAS address (for example nas.lan) and paste the key. Keep HTTPS.

注意. This key can change anything on the NAS, because TrueNAS offers no read-only key over its REST API: keep it for DumbMonit alone and revoke it if it leaks. TrueNAS ships a self-signed certificate: if the connection is refused, tick "Accept an unverifiable certificate" in the options.

1. On Unraid 6.12 to 7.1, install the Unraid Connect plugin from the Apps tab first. Unraid 7.2 or later has the API built in.

2. Open Settings → Management Access → API Keys and create a key named as follows, with the Viewer role.

   dumbmonit

3. Copy the key: Unraid shows it only once.

4. In DumbMonit, enter the Unraid address (for example tower.lan), paste the key as API key and choose https if the web interface is served over HTTPS.

注意. Unraid reports no temperature for a disk that is spun down, and DumbMonit never wakes one: a sleeping disk simply has no temperature until it spins up.

1. Open Control Panel → Privilege → Users → Create → Create a User and create the account as follows, with a long random password. Tick no share and no application privilege.

   dumbmonit

2. Add the account to the administrators group: QTS serves the system status, volumes and disks to that group only.

3. Optional: under Control Panel → System → Security → Allow/Deny List, allow the web interface only from the DumbMonit server's address.

4. In DumbMonit, enter the NAS address (for example nas.lan) with that user name and password. Choose http and port 8080 only if HTTPS is off.

注意. QTS has no read-only role for its system status, so the account sits in the administrators group: give it a unique password, and an account without 2-step verification. Over HTTP the password travels base64-encoded, not encrypted: prefer HTTPS.

1. Check that the dashboard is enabled and note the address of the active manager.

   ceph mgr services

2. Write a long random password to a file, and keep it: DumbMonit needs it.

   openssl rand -base64 24 | tr -d '\n' | tee /tmp/dumbmonit.pwd

3. Create the user with the built-in read-only role.

   ceph dashboard ac-user-create dumbmonit -i /tmp/dumbmonit.pwd read-only

4. Delete the password file.

   shred -u /tmp/dumbmonit.pwd

5. In DumbMonit, enter the address of the active manager (for example ceph.lan) with that user name and password.

注意. A standby manager redirects to the active one: use the address of the active manager. The dashboard ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

1. With the mc client configured for your MinIO (alias myminio), generate the token of the cluster metrics.

   mc admin prometheus generate myminio cluster

2. Copy the value after bearer_token in the output: that is the token.

3. In DumbMonit, enter the MinIO address (for example minio.lan), paste the token as Prometheus token and choose https if MinIO serves TLS.

注意. The token only opens the metrics pages, but anyone holding it can read them. If MinIO runs with MINIO_PROMETHEUS_AUTH_TYPE=public, the metrics need no token: choose No authentication.

1. Open Configuration → Access Control → User Management → Add, enter the user name dumbmonit, choose the realm Proxmox Backup authentication server, then click Add.

   dumbmonit@pbs

2. Open Configuration → Access Control → API Token → Add: user dumbmonit@pbs, token name monitor. Copy the Token ID and the Secret now, the secret is shown only once.

   dumbmonit@pbs!monitor

3. Open Configuration → Access Control → Permissions → Add → User Permission: path /, user dumbmonit@pbs, role Audit.

4. Add a second permission with Add → API Token Permission: path /, token dumbmonit@pbs!monitor, role Audit. A token has its own permissions, so both are needed.

5. Optional, to see pull sync jobs and the tape tier: repeat both permissions with role RemoteAudit on path /remote and role TapeAudit on path /tape.

6. In DumbMonit, enter the server address (for example pbs.lan:8007), the Token ID and the Secret.

注意. Both the user and the token need the permission: given to the token alone, it grants nothing and PBS reports nothing. The server uses a self-signed certificate by default: tick "Accept an unverifiable certificate" in the options if the connection is refused.

1. On the backup server, open Computer Management → Local Users and Groups → Users → New User and create the account as follows, with a long random password.

   dumbmonit

2. In the Veeam console, open the main menu > Users and Roles > Security, click Add, enter the account (for example VBR01\dumbmonit) and give it the Veeam Backup Viewer role only.

3. In DumbMonit, enter the backup server address (for example vbr.lan) and the account as HOST\dumbmonit or DOMAIN\dumbmonit, with its password.

4. Tick Accept an unverifiable certificate unless you installed your own: the REST API (port 9419) uses a self-signed one.

注意. Veeam keeps some REST API routes for the Backup Administrator role, the license among them on current versions: with the Viewer role DumbMonit shows the license as not readable and never asks for more.

1. On the machine that runs the backups, start the Kopia server with a generated certificate and its own user name and password.

   kopia server start --address=0.0.0.0:51515 --tls-generate-cert --server-username=dumbmonit --server-password=PASTE-A-LONG-RANDOM-PASSWORD

2. Check that the repository is connected to that server and that the DumbMonit server can reach port 51515.

3. In DumbMonit, enter the server address (for example nas.lan) with that user name and password.

4. Tick Accept an unverifiable certificate: the generated certificate is self-signed. If the server runs with --insecure, choose the http protocol instead.

注意. Kopia's API has no read-only account: the server password also lets its holder start and delete snapshots. DumbMonit only reads, but keep port 51515 on your local network.

1. In the Duplicati web interface, open Settings and set a long random password for the interface: Duplicati 2.1 requires one.

2. If the server only listens on the machine itself, start it with these options so that DumbMonit can reach it.

   --webservice-interface=any --webservice-allowed-hostnames=*

3. In DumbMonit, enter the Duplicati address (for example nas.lan) and paste that password.

注意. Duplicati 2.1 or later is required: version 2.0 signs in through a different mechanism that DumbMonit does not use. The password gives full access, so keep port 8200 on your local network.