# TrueNAS SCALE Update Integration Plan

## Problem

TrueNAS SCALE (192.168.0.251) is excluded from the OS update workflow because: 1. `apt` CLI is disabled on SCALE — CLI package management is blocked by design 2. Tailscale ACL blocks kaburuaibox → truenas (LAN-only, 192.168.0.251) 3. Security scanning tools (rkhunter, chkrootkit) can't be installed via apt 4. No automated update checking currently exists

TrueNAS SCALE uses the middleware API (`midclt`) for all system operations, including updates.

## Proposed Solution

### Phase 1: Verify midclt API Access via SSH ✅ VERIFIED

`midclt` works over SSH without sudo — `truenas_admin` is in `builtin_administrators` group (gid 544).

```bash ssh -i ~/.ssh/id_ed256 [email protected] 'midclt call update.available_versions' ```

Current state (2026-07-30): - Running: TrueNAS SCALE 25.10.3 - Available: 25.10.5 (released 2026-07-22) - ⚠️ SECURITY: CVE-2026-43503 (CVSS 8.8) + CVE-2026-46331 (CVSS 7.8) — local privilege escalation - Also fixes: console memory leak, drive health parsing, stalled backups, SSH key handling

Running apps: - ✅ tailscale, immich, portainer, clamav — RUNNING - ⏸️ nextcloud, searxng — STOPPED

Key API methods:

### Phase 2: Add TrueNAS to Infrastructure Update Skill

Update `infrastructure-os-updates` skill to include a TrueNAS check:

- Check command: `sudo midclt call update.check_available` - Parse: Look for non-null response = update available - Apply command: `sudo midclt call update.update` (triggers download + apply) - Reboot: `sudo midclt call system.reboot` (if required by update)

⚠️ TrueNAS SCALE updates often require a reboot. Unlike Linux kernel updates, SCALE updates are atomic (boot environment snapshot). Safer to reboot.

### Phase 3: Docker Container Updates on TrueNAS

TrueNAS SCALE runs apps as Docker containers. Check for stale images:

```bash ssh -i ~/.ssh/id_ed256 [email protected] \

'sudo docker ps --format "{{.Names}}|{{.Image}}"'

```

Compare against registry digests (same pattern as `docker-update-checker` skill).

### Phase 4: Security Scanning (Optional)

Options: - Docker-based scanners: Run rkhunter/chkrootkit as Docker containers on TrueNAS - Skip: TrueNAS is a storage server, low attack surface, no public-facing services - Recommended: Skip for now. Focus on keeping the OS and containers updated.

## Constraints

- LAN-only access: All SSH commands must go to 192.168.0.251 (not Tailscale) - User: `truenas_admin` (NOT root, NOT admin) - Key: `~/.ssh/id_ed256` (same as ubuntu-svr) - sudo required: midclt and docker commands need sudo - Reboot tolerance: TrueNAS reboots are safe (ZFS snapshots, boot environments) but should be scheduled, not automatic

## Integration with Existing Cron

Add TrueNAS check to the `security-audit` cron job (fa35b3fbe5f6): - Add a midclt update check step - Report results in the same Telegram message - Do NOT auto-apply — TrueNAS updates should be manual (Steve approves)

## Decision Points for Steve

1. Auto-check, manual apply (recommended) — cron checks and reports, Steve approves 2. Full auto — cron checks AND applies, reboots if needed 3. Manual only — no automation, Steve checks web UI periodically

## Verification After Implementation

```bash # Test midclt access ssh -i ~/.ssh/id_ed256 [email protected] 'sudo midclt call update.check_available'

# Test docker access ssh -i ~/.ssh/id_ed256 [email protected] 'sudo docker ps –format “names|image”'

# Check current TrueNAS version ssh -i ~/.ssh/id_ed256 [email protected] 'sudo midclt call system.info' | grep version ```