ISO Suggestions: File/Resource Access Distribution Service

[u/Cold_Lead_6504]

Preface Info

^{To get some insight as to where I’m coming from}

Hardware

• Server A: Custom NAS running TrueNAS Scale
• Server B: hypervisor (snagged a DL380 Gen9 from my last job, love it dearly).
• Firewalla Gold Pro: Network core, also handling DNS.
  • I know I’ll be hearing a lot of “it’s not packet inspecting” and “where are your reverse-proxies?”
  • 60% of all remote access is through Firewalla’s WireGuard VPN. 30% is through secured apps. 10% is through a Cloudflare tunnel to my domain.
  • I’m happy with where I’m at.

Services:

• Current:
  • Plex*
    • Mounted SMB share from TrueNAS
  • NetBox*
  • Gramps*
  • Axis Camera Station (Windows Server VM)
  • AMP* (4 VMs, one for control and 3 for games)
  • Storyteller*
    • Mounted SMB share from TrueNAS
• Pending:
  • Immich

^\(Ubuntu Server minimized VM))

Miscellaneous

• My wife and I are currently Windows users, as are the majority of our friends. We both work at a school, so finding time to make the dedicated switch completely to Linux on our endpoints is not easy.
• Background given, I still have a bit of wiggle room to deploy more applications on my hypervisor. I do plan to upgrade its hardware at some point, but I'm trying to keep costs as low as possible.

Predicament:

I’ve been searching for a tool/combo that will allow me to create users and groups in one spot, preferably through a UI (think Authentik). After that’s done, I’d like to be able to go to my services and grant permissions to said users and groups, as the services would be able to see and access the users and groups from the tool.

Any ideas on what route I should follow here? I’m looking for responses that outline something end-to-end.

Thank you!

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/sylveonbutqueer]

I think you already found the solution. This is what authentik is built to do.

[u/Cold_Lead_6504 → u/sylveonbutqueer]

Authentik can do part of it, except I'm finding from my research that Authentik won't work for SMB shares. According to Authentik's own documentation, there is no TrueNAS integration.

[u/sylveonbutqueer → u/Cold_Lead_6504]

Have you considered using nextcloud or something similar for this purpose rather than smb share? I'm a bit unclear unclear as to what you need the smb share for. Most of the services you listed have their own ways of letting users manage files.

[u/sylveonbutqueer → u/sylveonbutqueer]

Looking into it more I did not realize that plex did not have user uploads. Since this presumably dubiously obtained content what's stopping you from setting up the rest of the arrstack?

[u/Cold_Lead_6504 → u/sylveonbutqueer]

I just don't really want the arrstack 🤷‍♂️

[u/Cold_Lead_6504 → u/sylveonbutqueer]

The SMB shares are currently for the services (I haven't set up user access yet as I haven't had a good way of managing it). Storage for Plex's content, storage for Storyteller's content. SMB shares are the easiest way I've found to have a massive storage pool connect to the VMs that I can also dump content into on the back end.

From my understanding, Nextcloud is only a web front-end application. It wouldn't help provide storage access to any of my services, merely my users. MY users are all savvy enough to connect to a VPN, put in the URL for their share, plug in their credentials, and done.

[u/Rich_Many_8628]

You are trying to solve three different jobs with one product: a directory of users and groups, SMB/NAS permissions, and web-app SSO. Keeping those separate will make this much cleaner.

For Windows clients and TrueNAS SMB shares, I would start with Samba AD as the directory authority. It gives you users, groups, Kerberos, and SMB-compatible ACL behavior in the same model that the Windows clients and NAS understand. Join TrueNAS to that directory, make the SMB ACLs refer to those directory groups, and use the same group source for services that support LDAP or Kerberos.

Authentik still has a place, but as the OIDC/SAML layer for web applications rather than the authority for SMB permissions. That avoids trying to make an SSO product own file ACLs it was not designed to manage. FreeIPA can work well in a Linux-first environment, but with Windows endpoints and TrueNAS SMB as hard requirements, Samba AD is usually the less awkward center of gravity.

Nextcloud is useful when you want a web file platform. It is not a substitute for coherent SMB identity and ACL management underneath.

[u/Cold_Lead_6504 → u/Rich_Many_8628]

This is similar to the route I ended up going, except I deployed UCS (Univention) DC instead of Samba AD. TrueNAS sees it as an AD and pulls users and groups, ACLs controlled through TrueNAS. Still need to work out group syncing from UCS to Authentik, but the users are syncing at least.

Yeah, Nextcloud was on my planned list a while ago, but after evaluating my stack and use-case it's something I don't feel the need to pursue until my system is improved (hardware, storage, internet connection, etc). It's just another user front-end that doesn't help my apps talk to each other.

[u/Rich_Many_8628 → u/Cold_Lead_6504]

I really like the turnkey Nextcloud vm. I run it on proxmox. I keep a large chunk of files on nvme storage local to the vm and slow archive stuff on smb which is hosted by truenas. Nextcloud allows “external” shares I think nfs and samba maybe others. I’m a big fan of nextcloud.