# TrueNAS SCALE (Microserver Gen8)

- **Host:** HP ProLiant MicroServer Gen8 (Xeon, 16GB RAM)
- **IP:** 192.168.0.251 (LAN), 100.82.180.17 (Tailscale — blocked for kaburuaibox)
- **OS:** TrueNAS SCALE 25.10.5 (updated 2026-07-30 from 25.10.3)
- **Storage:** `/mnt/tank/` (ZFS pool, RAIDZ1)
- **SSH:** `ssh -i ~/.ssh/id_ed256 truenas_admin@192.168.0.251`
- **Mirror:** `/kaburudata/backups/` on Z840 (kaburuaibox, 192.168.0.253) — synced daily at 05:00 via `/usr/local/bin/z840-pull-backup.sh`

## Connection

- **LAN only** — Tailscale ACL blocks kaburuaibox → truenas
- **User:** `truenas_admin` (NOT root, NOT admin)
- **Key:** `~/.ssh/id_ed256` (same key as ubuntu-svr)
- **⚠️ DO NOT USE:** `/opt/hermes/config/truenas_id_ed25519` — broken/wrong key

## System Management (midclt API)

`midclt` works over SSH **without sudo** — `truenas_admin` is in `builtin_administrators` group.

| Action | Command |
|--------|---------|
| System version | `midclt call system.version` |
| Check updates | `midclt call update.available_versions` |
| Download update | `midclt call update.download` |
| Apply + reboot | `midclt call update.run` |
| Update status | `midclt call update.status` |
| List apps | `midclt call app.query` |

### REST API (for operations midclt can't do)

TrueNAS SCALE also has a REST API at `https://192.168.0.251/api/v2.0/`. Requires API key auth.

```bash
# Create temp API key via midclt
python3 -c "import subprocess,json; print(subprocess.run(['midclt','call','api_key.create',json.dumps({'name':'temp','username':'truenas_admin'})],capture_output=True,text=True).stdout)"

# Use API key
curl -sk https://192.168.0.251/api/v2.0/system/version \
  -H "Authorization: Bearer <key>"

# Reboot via API (properly regenerates GRUB config)
curl -sk -X POST https://192.168.0.251/api/v2.0/system/reboot \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"reason": "boot environment activation"}'
```

⚠️ **GRUB pitfall:** `midclt call system.reboot` does NOT regenerate GRUB config on legacy BIOS systems. After `update.run` applies a new boot environment, the system reboots but stays on the old version. Use REST API reboot (`/api/v2.0/system/reboot`) which properly handles GRUB. Or use the web UI System → Boot to activate + reboot.

## Apps (Docker containers)

| App | Status (2026-07-30) |
|-----|---------------------|
| tailscale | RUNNING |
| immich | RUNNING (pinned v2.7.5) |
| portainer | RUNNING |
| clamav | RUNNING |
| nextcloud | STOPPED |
| searxng | STOPPED |

## Security Scanning Tools

- **Status:** rkhunter and chkrootkit NOT installed (apt CLI disabled on SCALE)
- **Option 1 (preferred):** Run as Docker containers
- **Option 2 (skip):** Skip — storage server, no public-facing services, low attack surface

## Cron Jobs

- **rkhunter + chkrootkit:** NOT configured (tools not installed)
- **uptime-kuma:** Not running (memory constraints)

## Update History

| Date | From | To | Notes |
|------|------|----|-------|
| 2026-07-30 | 25.10.3 | 25.10.5 | Security: CVE-2026-43503 (CVSS 8.8), CVE-2026-46331 (CVSS 7.8) |

## Related

- [[z840]]
- [[opnsense]]