# TrueNAS SCALE Update Integration Plan

## Problem

TrueNAS SCALE (192.168.0.251) is excluded from the OS update workflow because:
1. `apt` CLI is **disabled** on SCALE — CLI package management is blocked by design
2. Tailscale ACL blocks kaburuaibox → truenas (LAN-only, 192.168.0.251)
3. Security scanning tools (rkhunter, chkrootkit) can't be installed via apt
4. No automated update checking currently exists

TrueNAS SCALE uses the **middleware API** (`midclt`) for all system operations, including updates.

## Proposed Solution

### Phase 1: Verify midclt API Access via SSH ✅ VERIFIED

`midclt` works over SSH **without sudo** — `truenas_admin` is in `builtin_administrators` group (gid 544).

```bash
ssh -i ~/.ssh/id_ed256 truenas_admin@192.168.0.251 'midclt call update.available_versions'
```

**Current state (2026-07-30):**
- Running: TrueNAS SCALE **25.10.3**
- Available: **25.10.5** (released 2026-07-22)
- ⚠️ SECURITY: CVE-2026-43503 (CVSS 8.8) + CVE-2026-46331 (CVSS 7.8) — local privilege escalation
- Also fixes: console memory leak, drive health parsing, stalled backups, SSH key handling

**Running apps:**
- ✅ tailscale, immich, portainer, clamav — RUNNING
- ⏸️ nextcloud, searxng — STOPPED

**Key API methods:**
| Action | Command |
|--------|---------|
| Check updates | `midclt call update.available_versions` |
| Download | `midclt call update.download` |
| Apply + reboot | `midclt call update.run` |
| Check status | `midclt call update.status` |
| List apps | `midclt call app.query` |

### Phase 2: Add TrueNAS to Infrastructure Update Skill

Update `infrastructure-os-updates` skill to include a TrueNAS check:

- **Check command:** `sudo midclt call update.check_available`
- **Parse:** Look for non-null response = update available
- **Apply command:** `sudo midclt call update.update` (triggers download + apply)
- **Reboot:** `sudo midclt call system.reboot` (if required by update)

⚠️ TrueNAS SCALE updates often require a reboot. Unlike Linux kernel updates, SCALE updates are atomic (boot environment snapshot). Safer to reboot.

### Phase 3: Docker Container Updates on TrueNAS

TrueNAS SCALE runs apps as Docker containers. Check for stale images:

```bash
ssh -i ~/.ssh/id_ed256 truenas_admin@192.168.0.251 \
  'sudo docker ps --format "{{.Names}}|{{.Image}}"'
```

Compare against registry digests (same pattern as `docker-update-checker` skill).

### Phase 4: Security Scanning (Optional)

Options:
- **Docker-based scanners:** Run rkhunter/chkrootkit as Docker containers on TrueNAS
- **Skip:** TrueNAS is a storage server, low attack surface, no public-facing services
- **Recommended:** Skip for now. Focus on keeping the OS and containers updated.

## Constraints

- **LAN-only access:** All SSH commands must go to 192.168.0.251 (not Tailscale)
- **User:** `truenas_admin` (NOT root, NOT admin)
- **Key:** `~/.ssh/id_ed256` (same as ubuntu-svr)
- **sudo required:** midclt and docker commands need sudo
- **Reboot tolerance:** TrueNAS reboots are safe (ZFS snapshots, boot environments) but should be scheduled, not automatic

## Integration with Existing Cron

Add TrueNAS check to the `security-audit` cron job (fa35b3fbe5f6):
- Add a midclt update check step
- Report results in the same Telegram message
- Do NOT auto-apply — TrueNAS updates should be manual (Steve approves)

## Decision Points for Steve

1. **Auto-check, manual apply** (recommended) — cron checks and reports, Steve approves
2. **Full auto** — cron checks AND applies, reboots if needed
3. **Manual only** — no automation, Steve checks web UI periodically

## Verification After Implementation

```bash
# Test midclt access
ssh -i ~/.ssh/id_ed256 truenas_admin@192.168.0.251 'sudo midclt call update.check_available'

# Test docker access
ssh -i ~/.ssh/id_ed256 truenas_admin@192.168.0.251 'sudo docker ps --format "{{.Names}}|{{.Image}}"'

# Check current TrueNAS version
ssh -i ~/.ssh/id_ed256 truenas_admin@192.168.0.251 'sudo midclt call system.info' | grep version
```