Hey everyone,
I recently purchased a 4-bay NAS (UGREEN DXP4300 Plus) to centralize about 5TB of raw video footage for my production workflow. I have a team of a few remote video editors who need to download/upload large video files locally to their machines.
I’ve made a few architecture decisions based on research, but since I am also planning to store highly sensitive personal data on this machine, I’d love to get a sanity check from the security experts here.
My Current Setup:
- Drives: Starting with 2x 10TB drives.
- File System: Btrfs.
- Remote Access: I bypassed UGREEN's remote link/relay service and avoided Port Forwarding. Instead, I deployed Tailscale via Docker on the NAS.
- Permissions: I created a specific NAS user/password for each editor, restricting them to read/write access only on the shared video folder. They're connecting via the Tailscale IP and map the network drive via SMB.
My Questions:
- Tailscale Security: Is running Tailscale in a Docker container and having remote editors connect via SMB the most secure industry standard for this? I want to ensure my local home network isn't exposed to the public web.
- Mixing Business and Highly Sensitive Personal Data: This is my biggest concern. I want to use the remaining space on the NAS as an automated, one-way local backup of my personal Google Drive (tax returns, medical records, etc.) in case my Google account is ever compromised.
- I plan to create a separate personal non-shared folder for this personal backup, grant access only to my master admin account, and explicitly "Deny" the remote editors' user group.
- The Risk: How risky is it to have remote editors tunneled into the exact same physical NAS that holds my most sensitive personal data? If an editor's machine gets ransomware, can it jump the Tailscale tunnel and attack the NAS OS? Should I use folder-level encryption for my personal vault, or is mixing these two worlds on one machine fundamentally a bad idea?
Appreciate any advice or constructive criticism on this setup!