andrebrait

@ensnare I just wrote a small tutorial on how to get ZFS native encryption to "integrate" with unRAID's own LUKS encryption: https://github.com/andrebrait/unraid-native-zfs-encryption See if that's useful to you. The net result is that the experience is identical to using unRAID + LUKS, but it auto-mounts ZFS encrypted datasets too, whe starting up the array.

Note: this is mostly about ZFS pools. I have no idea how this would work for arrays. ZFS has the ability to create encrypted datasets, allowing a more granular control over encryption. Compared to LUKS, it has some clear advantages: 1. Encryption, like compression and other features, can be controlled at the dataset level, meaning one does not have to suffer the penalty of FDE via LUKS for the entire pool. 2. Snapshotting is faster (the data structures used for snapshotting itself aren't encrypted) and snapshots can be sent without disclosing the key, meaning off-site backups stay encrypted with full secrecy (and no overhead in decrypting anything during send) LUKS also has its own advantages, but this is besides the point for this feature request, as it can never do encryption for a single dataset (which becomes a share in unRAID) nor keep backups fully secret both in flight and at rest, out of the box, for off-site backups; which already answers the question "but isn't our LUKS support enough?" Unlocking it can be done in similar ways as to LUKS (password, keys locate in some external storage, etc.) so I think this is a matter of figuring out the tooling and GUI to support this. Ideally it should work exactly like LUKS does and ask for the password on array start. Open questions: should it ever allow the array to start with an unmounted encrypted dataset? I think the answer should be "no", but input is welcomed. References: it seems I'm not the first to talk about it here, but I could not find a real feature request: https://forums.unraid.net/topic/169948-best-way-to-load-key-and-mount-zfs-native-encryption-datasets/

@Blazer8108 I just came from reading this topic here: OP uses some script to unlock the dataset on start-up, with the key located in a USB drive. I suppose you can do the same, provided you can be a bit creative with regards to how to attach the external USB stick in a way that is not apparent what it's doing.

At least using a docker folder (here /mnt/user/docker, as I have a dedicated share for it), you can do this: # This is my folder. Change it to what yours is. Also, if using an image instead, need to find out how to mount it. DOCKER_FOLDER="/mnt/user/docker" # Remove the current update status files and back it up just in case mv "${DOCKER_FOLDER}/unraid-update-status.json" "${DOCKER_FOLDER}/unraid-update-status.json.bkp" Then just re-run the update checks. It'll compare all your containers with upstream again and it should work. You can also just manually edit the file to find the right entry, make both hashes equal and change the setting.

the docker executable does not exist inside the image, it seems. you can use another image (or build your own) which has docker installed inside the image to kinda orchestrate this through the UNIX socket or probably find a better solution using some tool like Portainer. I think it has such capabilities, but I'm not 100% sure.

"Fun" fact: if you enable exclusive shares and the share only has the pool as primary storage with no secondary storage, they become 100% equivalent (except for a single symbolic link). Everything I have points to /mnt/user/<share_name>, so that way I can get good performance and not worry about paths so much.

I saw those, but I was particularly interested in enabling RFC 4193 + RFC 7217 support and using a Stable ULA for proper filtering and forwarding on my firewall.

Has this gotten any attention? Because it definitely should.

I was also getting the same error, followed by "Unable to connect to backup.unraid.net:22" Then I noticed the public key my new Unraid server has is different than the one my old server had. What worked for me was: 1. Deactivate the Flash Backup 2. Remove all entries for backup.unraid.net from ~/.ssh/config, or delete the file if that's the only server in it 3. Delete ~/.ssh/unraidbackup_id_ed25519 4. Delete ~/.ssh/unraidbackup_id_ed25519.pub 5. Delete all lines containing backup.unraid.net from ~/.ssh/known_hosts 6. Reactivate Flash Backups It seems only then it fetches/creates the new public keys. That resolved the issue. @ljm42 tagging you here because this might be the key to fixing this for good.

Well, on some great news, my i5-7500T on a Gigabyte GA-Z270N-WIFI with 1 stick of RAM, the WiFi module removed, 1 WD NVMe SSD and a PicoPSU + Leicke PSU is now hitting 8W on idle under pfSense.

Just be aware that the BIOSes those boards ship isn't very reliable and/or contains some pretty serious bugs (e.g. they often measure 10+W idle power consumption; won't boot from some SSDs; bad RAM compatibility; etc.) and they might not get updates at all.

Oh, my package C-state is still reaching C8 or C10 even. The only thing I added was the SSD (a WD SN570). For whatever reason, the only time I ever saw it hot 9W was without the SSD and with a USB stick with Ubuntu on it. With the SSD it reached 12W in the best case. Right now, for example, I'm on an i5-7500T and a Gigabyte GA-Z270N-WIFI with 1 stick of RAM, the same SSD and absolutely nothing else plugged, with a 90W PicoPSU and a 90W 12V PSU from Leicke. It idles at 13W. People in the forums report 6 to 8W idle with the same board. I messed with every power saving setting I can find and I just can never get it to reach that low of a power consumption. Weirdly enough, my measuring device seems accurate when used with a Raspberry Pi.

I've done it all. There's nothing else that can be squeezed out of it. Power consumption aside, the PCIe bandwidth being so finicky was enough to get me to replace the board anyway. What's the point of having PCIe at 2x if even 2x electrical cards on a 4x physical form-factor only work at 2x if they're on a real 4x slot? Also, I'm not gonna use a 12V PSU on a board where the manufacturer tells me to use 19V, even if it technically works. And I doubt my board is defective, because a lot of other users/reviewers also reported the same. I mean, given the coil whine when it's on low power mode, that wouldn't surprise me, but the absolute lowest consumption I've seen from it was 9W at some point... The problem is once I put the other devices it goes to 13W. It seems the difference is mostly due to some specific aspect of the power supply where you're measuring the power usage and what equipment you're using. Looking at other builds I have, none of them reach the numbers you see on Hardwareluxx.de. I have another build that's 100% identical (down to the very same model of PicoPSU and PSU) to another one where a user report an idle usage of 6W and the minimum I get on it is 12W, same OS, same settings, same powertop tunables, same everything. Are you on 110V? 240V? What frequency on your network? I'm on 240V 50Hz and other than that I can't find anything that would cause my power usage to be so much higher on both builds.

I'm using a Leicke 19V 65W PSU with the DC-ITX. I've now assembled a build composed of: Intel Core i5-7500T Gigabyte GA-Z270N-WIFI* 2x G.Skill 8GB RAM DDR4-2400 1x WD Blue SN570 250GB SSD** PicoPSU 90 Leicke 12V 90W *WiFi card removed **from the N100DC-ITX build That's my pfSense box, but I'll post back the power consumption figures once I have them. UPDATE: 14W idle with both NICs being used. Not as low as I hoped, unfortunately. I might try to tweak stuff and disable some onboard devices later. Unfortunately, power management on BSD is a lot worse than on Linux.

That's x16 physically, but it's still 2x electrically. It has the same issues I mentioned above. Even if you do fit a 4x, 8x or 16x card, depending on the chipset, they might be limited to 1x speeds, because despite being 2x, not all chips take 2x. The Intel X550-T2 2x 10GbE card, for example, is 4x, but it can only take 1x or 4x, not 2x, even if the slot is physically 4x or 16x (the electrical part is what counts, after all). Same for the QNAP QXG-2G2T i225-LM card. This one is even worse, because the card *is* PCIe 2.0, electrically 2x, and physically 4x, but it only works in 1x because it only takes 1x or 2x on a 4x slot and nothing in between, *including 2x on a 2x slot*, which is just hilarious. The N100 chip itself has 9 PCIe lanes. They're using 2 for the NVMe SSD, 2 for the 16x slot, 1 for the x1 slot, and a few other lanes for the onboard devices (LAN, etc.)

Chance is the keyword. You can have an amazing drive... Or not. What price are you seeing on the 8TB one? If you really just want a 2 drive system or something, akin to an entry level Synology, you better grab one of those N100 boards and go with it. If you plan on doing more than that, then the recommendations I gave are probably the wisest plan due to expandability. Well, something else you can do (and it is what I've done, but now I'm expanding, so if you want to, you can even buy it from me) is to buy a used computer. I bought an i5-7600 with 16GB of RAM on an ASRock H110 ITX for €75. It's my unRAID machine, currently sitting on a Jonsbo N1. It even has an Intel NIC. It's currently handling 5 enterprise HDDs (via a PCIe ASM1166 card) and 4 SATA SSDs. The only thing missing is an M.2 SSD, but if you plan on not using the PCIe slot, you can always put one there. Anything past 7th Gen should have an M.2 slot available for NVMe storage, or even higher end (think H170 or H270 and above) 6/7th gen should too. Well, technically you could use the WiFi slot for an M.2 SSD, but it would be capped to PCIe 3.0 1x speeds (in my case, that is).

In general, not an amazing idea if that's going to be your main storage. For backup it's ok, but honestly, looking at the prices for certain Enterprise HDDs at TrueBase and other stores via Tweakers, internal drives have been pretty competitive on the price per TB area. Tip: Tweakers, on the desktop version, lets you sort drives in €/TB, so you can look up the best drives on that metric, and filter out the types you don't want. Just a word of warning regarding their filters: "geschikt voor NAS" doesn't mean an unRAID NAS, but the likes of Synology and whatnot. There are plenty of Enterprise HDDs which are amazing NAS drives but are excluded by that filter. Back to the WD Recertified drives: I say "no" not because they're recertified, that part is ok, but because they're often SMR drives and normally they put their worse batches in the USB enclosures and given them shorter warranty periods. It's not 100% guaranteed to be a bad drive, but when they have a batch with higher-than-acceptable defect levels for the Enterprise or Desktop segments, they just redirect the entire batch to the External Storage segments, where they can give not-so-strict guarantees regarding warranty, bytes written and whatnot.

The issue with SMR is that, the second the drive starts needing trimming, it absolutely crawls. I'm talking "my 200mbps internet is faster than the drive and my torrents stall" slow.

Just a word of caution regarding the N100 boards: they use more power than they should. I have an AsRock N100DC-ITX, using it as a pfSense box, and even on Linux (which uses a couple watts less than pfSense itself, similar to what Unraid would use) I can only get it as to as low as about 13W while completely idle. That's a lot more than many of the PicoPSU + Core i3/i5/i7/i9 we see on Hardwareluxx.de and their spreadsheet. Some builds there use 5W, or 8W while idle, etc. Power consumption is highly connected to the motherboard, btw, so the same i3-12100 can use 8W on one board but 17W on the other. Either way, they're both better than the N100DC-ITX in that regard. Also, the ASRock board only has one PCIe 3.0 4x (2x electrical) slot, but because of how some PCIe cards are built, they never run as 2x, only at 1x (that's the case for network cards like the QNAP QXG-2G2T i225-LM and the Intel X550-T2) because, even though they might be 2x, they somehow require the slot to be 4x. Makes no sense to me either, but it is what is it. You put them on a 16x slot and they happily run at 2x and 4x respectively. So my tip is to go for a regular i3-12100 (*not 12100F*) build with a regular motherboard. If you're staying on Gigabit LAN, some H610 boards already come with Intel controllers, which are usually more stable than Realtek (but both under Linux are fine) like the ASRock H610 ITX and the Gigabyte H610i. I'm also from the Netherlands, btw. Amazon has some nice deals on Ram sometimes. As for HDD, stay away from 2.5" as they're almost all gonna be SMR and you *really* don't want an SMR drive. That includes WD Red (not Plus and not Pro) 3.5" drives as well, as well as cheap Seagate Barracuda Compute, etc. Always check the drive type to ensure it's CMR or PMR.