UgreenNAS

Migrate Your Immich Library to External USB Storage
Quick Recap

Last month I walked through setting up Immich on a UGREEN NAS as an alternative to Google Photos. Since then, I’ve gotten a lot of good questions about using an external USB drive instead of the NAS’s internal storage as the primary location for Immich uploads. So this guide covers exactly that: setting up external storage, and migrating your existing Immich library over to it.

One thing worth clearing up first: this isn’t the same as adding a second upload location for your photos. That’s what Immich’s “External Libraries“ feature does, and it’s a different animal entirely, it indexes files in place without taking ownership of them. What you’re doing here is changing the storage location Immich itself owns and uploads every future photo to. Your existing albums and photos don’t disappear; they move with the library.

Back Up Before You Touch Anything

Your Immich folder holds three things: the postgres folder, which is the database tracking your albums and photo dates; the library folder, where all your actual media lives; and the model-cache folder, which stores the machine-learning models Immich uses for facial recognition. You can back all of this up by copying the whole Immich folder to a shared backup folder on the NAS or another external drive, or by setting up a backup task using UGOS’s “back up between pools” option. Either way, do this first — it’s the whole reason the rest of this process is low-risk.

Finding Your External Drive’s Mount Point

Plug the external drive into a USB port on your NAS. Before you can point Immich at it, you need to know its mount point — the path UGOS actually uses to address the drive.

Start in File Manager: go to External devices, double-click the drive, and note its name. Mine happens to be “Bench.” From there, you have two ways to find the actual mount point. The way I usually do it is over SSH: enable SSH under Control Panel > Terminal (make sure it’s running on port 22), SSH into the NAS from another computer, and run ‘lsblk -f‘ . That lists every block storage device on the NAS — drives, partitions, all of it — and you’re looking for an entry starting with /mnt/@usb/ that matches the drive name you noted earlier.

You don’t actually need SSH for this, though. File Manager will tell you the same thing: click the external drive under External devices and select Details in the right-hand panel, and it lists the mount point directly. Either way works — SSH just happens to be the method I default to.

Whichever way you find it, write it down, because you’ll need it in a few minutes. And keep in mind the mount point I’m using in this guide, /mnt/@usb/sde2/, is specific to my NAS and my drive. Yours will almost certainly look different — it depends on which USB port you use, what else is plugged in, and how many partitions your drive has. Always use the path you actually found, not mine.

Stopping Immich and Moving the Library

Back in the UGOS Docker app, select Stop next to the Immich project. This stops the containers so it’s safe to make changes.

Here’s the part that trips people up if they’re not paying attention: you’re only moving the library folder. Not postgres, not model-cache, not the yaml file — just library. Right-click it, select Copy/Move to, choose Move, and send it to the root of your external drive. Once it finishes, double-check that the folder and all its sub directories actually made it over before you move on. This is genuinely the step where things go wrong if you rush it — a partial copy is a much bigger headache than the ten extra seconds it takes to verify.

Editing the Compose File

Back in the Immich project, click the three dots in the upper right, select Settings, then Compose configuration. The first path under volumes is where Immich is currently uploading everything — internally, on the NAS. Comment that out with a #, then add a new line with your external path:
```
'- /mnt/@usb/sde2/library:/data'
```
The part after the colon, /data, is the container’s internal path, and it never changes — only what’s mounted behind it does. That’s really the whole trick to this entire process: Immich only ever knows about /data. What’s physically sitting behind that path is entirely up to you.

One thing worth flagging explicitly, because it’s an easy mistake: yaml files and Linux itself are case-sensitive. It doesn’t matter whether you name your folder library, Library, or LIBRARY — but whatever case you actually used when you created it has to match exactly in the compose file. I used Library with a capital L on my own drive, so my line reads /mnt/@usb/sde2/Library:/data, not lowercase. Get the case wrong and Immich simply won’t find your files.

Redeploying and Checking Everything

Scroll down and click Redeploy to feed the updated yaml in. Once it’s back up, open a browser, go to your NAS’s IP address on port 2283, log in, and you should see every album and photo exactly as you left them. You can also confirm the switch actually took by checking the storage indicator in the lower-left corner — it should now reflect your external drive’s capacity instead of your internal storage.

Then do one more sanity check: take a photo on your phone, let the Immich app sync it, and refresh the web app to confirm it shows up. Nothing changes on the mobile or web app side — same login, same IP, same everything. That’s honestly the part I find most reassuring about this whole process: you can move where the data physically lives without touching how you actually use the app day to day.

Don’t Skip the Backup Schedule

Once you’ve confirmed everything’s working, set up a regular backup schedule for the new external library location, and ideally keep more than one copy. A compose file you can rewrite from scratch in five minutes. Photos you can’t. I

One Last Thing

This turned out to be a pretty painless setup once you know where to find the mount point. If you’re one of the folks using UGOS’s built-in Photos app instead of Immich, I’d genuinely like to know how that’s working for you, and whether a migration guide from UGOS Photos to Immich would be useful. And if you hit something on your own setup that looked different from what’s here, drop it in the comments too, that’s usually how I find out what to cover next!

I also have a full PDF tutorail in my free Patreon, so please check that out!

💻 Hardware I Used: ✅ Some links on this post may be affiliate links, which help support me and help keep ads off here!
1. UGREEN DXP6800 Pro NAS: https://amzn.to/4tKmKoF
2. UGREEN DXP2800 NAS: https://amzn.to/4qxKdcI
3. 4 x 8TB Ironwolf HDD Used in DXP 6800 Pro: https://amzn.to/4diniNt
4. 2 x 4TB Ironwolf HDD Used in DXP 2800 Pro: https://amzn.to/3UxOlxg
UGREEN NAS Back up Strategy With 3-2-1 Strategy
Do you have a Backup Plan?

There are countless ways to back up your important data, from external USB drives to cloud storage and a second NAS. However, choosing the right combination can become confusing—and cloud storage can get expensive once you start protecting several terabytes of data.

In this guide, we’ll use the easy-to-remember 3-2-1 backup strategy to protect the data stored on a UGREEN NAS. We’ll create a local backup on a USB drive, back up to another NAS using rsync, and explore two options for completing remote backups between UGREEN NAS devices.

What Is the 3-2-1 Backup Strategy?

The 3-2-1 strategy means keeping at least three copies of your important data. Two copies should be stored on different types of storage, such as your NAS and an external USB drive. The third copy should be stored off-site so it remains protected if something happens to your home, such as theft, fire, flooding, or another disaster.

Your original files count as the first copy, so you need two additional copies to complete the strategy. RAID can help keep a NAS running when a drive fails, but RAID alone is not a backup. It doesn’t protect you from accidental deletion, corrupted files, ransomware, or the loss of the entire NAS.

Decide What You Need to Back Up

Not every file needs the same backup schedule. Files you access and change regularly should generally be backed up daily or weekly. This might include active projects, documents, business files, and anything else that changes frequently.

Irreplaceable files such as family photos, home movies, completed projects, and important financial or medical records deserve additional protection. These are good candidates for multiple backup copies, version history, and some form of long-term archival storage.

I like to think of archival storage as a place for data that cannot easily be replaced or recreated.

Using M-DISCs for Long-Term Archival Storage

Archival-grade Blu-ray M-DISCs are one option for preserving a smaller collection of especially important files. Because the discs can be stored offline, they’re protected from ransomware, accidental deletion, and many of the problems that can affect storage devices that remain connected.

Manufacturers claim that properly stored M-DISCs may remain readable for several hundred years, with some estimates reaching as high as 1,000 years. Those figures are based on standardized accelerated-aging tests, so I would treat them as evidence of strong durability rather than a literal guarantee.

M-DISCs are not particularly cheap, and you also need a compatible Blu-ray writer. A 25GB disc typically costs around $3, while 50GB discs are often between $6 and $8 each. The 100GB BDXL versions can cost approximately $15 to $20 per disc and require a BDXL-compatible burner.

The larger discs aren’t priced strictly according to capacity because they use multiple recording layers and are more difficult to manufacture. The 25GB discs generally offer the best value, while the larger versions are convenient when you want to spread an archive across fewer discs.

Create a Local USB Backup

One of the easiest ways to create a second local copy of your data is with an external USB drive connected directly to the UGREEN NAS.

Ideally, this backup should be automated so it can run daily or weekly without requiring you to remember it. Keeping multiple versions is also helpful because it lets you recover an earlier copy if a file is accidentally changed, deleted, or corrupted.

UGOS makes this feature surprisingly difficult to find. When you open the Sync & Backup app and select Backup & Restore, there doesn’t appear to be an obvious USB backup option. However, if you create a new task and select Backup between storage pools, UGOS allows you to choose an external USB drive as the destination—even though that drive isn’t actually part of a storage pool.

Select the folder you want to protect, choose the external USB drive and destination folder, and then configure the backup schedule. You can create a one-time backup or schedule it to run automatically. If version retention is available, choose how many previous versions you want to preserve.

After the task finishes, open the UGOS Files app, select the external drive, and verify that the backup was created successfully.

This gives you a convenient second copy, but remember that a USB drive permanently connected to the NAS is still vulnerable to theft, electrical damage, ransomware, and accidental deletion. Disconnecting or rotating USB drives can provide additional protection.

Back Up One UGREEN NAS to Another

For the next part of the strategy, I used a UGREEN DXP2800 as a backup destination for my DXP6800 Pro. I first configured the backup locally and then tested it remotely with the two NAS devices on separate internet connections.

UGOS supports rsync, a widely used file-transfer and synchronization tool. If you don’t have another UGREEN NAS, the destination could instead be a Linux server, TrueNAS system, Synology NAS, OpenMediaVault server, or another device capable of receiving rsync transfers.

The setup varies between platforms, but the destination generally needs an rsync service or module, a folder with the proper read-and-write permissions, and a user authorized to access that folder. Traditional rsync daemon connections commonly use port 873, although rsync over SSH and custom configurations may use a different port.

Prepare the Destination NAS

On the destination UGREEN NAS, open Control Panel, select File Service, and enable rsync. Under the advanced settings, confirm the port being used. The default rsync daemon port is 873.

Next, create a shared folder for the backups and make sure the account that will receive the files has read-and-write access. It’s a good idea to create a dedicated backup account instead of using your primary administrator account.

Before creating the complete backup task, test the connection with a small folder. This makes it much easier to identify permission, authentication, or network problems without waiting for a large transfer.

Create the Local NAS-to-NAS Backup

On the source NAS, open Sync & Backup, select Backup & Restore, and create a new task to back up the current UGREEN NAS.

Choose rsync as the server type and enter the local IP address of the destination NAS. Enter the rsync port, username, and password, and then confirm the connection.

Once connected, select the source folder and the destination folder. Configure the schedule and version-retention policy, review the settings, and create the task. You can have UGOS begin the backup immediately or wait for the scheduled time.

After the task completes, open the destination NAS and confirm that the backup repository exists. You should also test the restore process rather than assuming that a successful status means the data can be recovered.

Plan the Initial Remote Backup Carefully

If you’re setting up a scheduled remote backup, it’s best to perform the first full backup while both devices are on the same local network whenever possible. The first transfer contains the bulk of your data and could take days over a typical internet connection.

Once the initial copy is complete, the scheduled remote jobs should generally transfer only new or changed data.

You should also check whether either internet provider has a monthly data cap. The source location’s upload speed will usually be the main bottleneck, while the destination location needs sufficient download capacity. Large transfers can consume a substantial amount of data at both locations.

What Happened with UGREENlink Remote Access

My original plan was to use the DXP2800’s UGREENlink client ID as the destination server address for a remote backup from the DXP6800 Pro.

However, the Backup & Restore portion of the app repeatedly rejected the remote client ID. After several attempts, I switched to the Sync portion of the same app, and the UGREENlink client ID worked.

I was able to create a scheduled sync task from the DXP6800 Pro to the remote DXP2800 and transfer the selected files successfully. This means UGREENlink worked for a remote sync in my testing, but it did not work as the server address for a remote backup task.

It’s worth remembering that synchronization and backup are not exactly the same. A sync task usually creates an accessible copy of the current files, while a backup task may preserve version history and offer a dedicated restore process.

Using Tailscale for Remote Backups

I

also tested Tailscale, which creates a private connection between the two NAS devices without requiring me to expose the rsync service directly to the public internet.

Tailscale must be installed and connected on both NAS devices. Rsync still needs to be enabled and properly configured on the destination NAS—Tailscale simply provides the private network path between them.

When configuring the remote connection, I entered the destination NAS’s Tailscale IP address in the server-address field. Unlike the UGREENlink client ID, the Tailscale IP was accepted by the Backup & Restore utility.

I was able to create and complete a remote backup task through Tailscale. The Tailscale IP also worked for remote sync tasks.

If you need help installing Tailscale on a UGREEN NAS, you can follow my UGREEN NAS Tailscale guide. The installation portion begins at approximately the six-minute mark.

Why the Backup Folder Contains So Many Files

The remote backup created a folder ending in .ubk. Inside were directories named data, index, keys, locks, and snapshots, along with a configuration file.

At first, this looked like UGOS had copied far more data than I selected. However, these folders are part of the backup repository created by UGOS. They store the backup data, indexes, metadata, snapshots, and information needed to restore files.

A .ubk backup is therefore not meant to look like a normal folder containing directly accessible copies of the original files. You use the Restore feature inside Sync & Backup to recover its contents.

Test the Restore Process

A backup is only useful if it can actually be restored, so I performed a remote restore test the following day.

Using the .ubk repository stored on the DXP2800, I created a restore task and selected a new destination folder on the DXP6800 Pro. The restore completed successfully through the Tailscale connection, and the original file appeared in the new folder.

That successful restore was the most important part of the test. It confirmed that the remote backup was not merely creating repository files—it could also return the selected data to the source NAS when needed.

What I Learned from the Remote Tests

This was one of those situations where I couldn’t know exactly how everything would behave until I tested it under real-world conditions. I don’t have two separate internet connections at home that would let me place each NAS on a different network.

Once the DXP2800 was located off-site, I could properly test the process. The UGREENlink client ID worked for remote sync tasks but was rejected by the Backup & Restore utility. The Tailscale IP worked for both remote backup and sync tasks, and I successfully restored data through the Tailscale connection.

Your results could vary with future UGOS updates, so always begin with a small test folder and verify both the transfer and restore process before relying on the setup for important data.

Build a Backup Plan That Works for You

The important thing is to maintain at least three copies of your critical data, with two copies stored on different media and one kept off-site.

Your off-site copy could be stored on another NAS at an office, a friend or family member’s house, a cloud service, or even an encrypted USB drive stored somewhere secure. The right combination depends on how much data you have, how frequently it changes, and how quickly you would need to recover it.

Whatever approach you choose, automate as much as possible, keep version history where practical, monitor your backup jobs, and periodically test a restore. A backup task showing “Successful” is reassuring, but a verified restore is what proves your backup plan actually works.

Please be sure to sign up for a free patreon membership and join my ‘Tech Fans’ community for the full 3-2-1 Backup Strategy

💻 Hardware I Used: ✅ Some links on this post may be affiliate links, which help support me and help keep ads off here!
1. UGREEN DXP6800 Pro NAS: https://amzn.to/4tKmKoF
2. UGREEN DXP2800 NAS: https://amzn.to/4qxKdcI
3. 4 x 8TB Ironwolf HDD Used in DXP 6800 Pro: https://amzn.to/4diniNt
4. 2 x 4TB Ironwolf HDD Used in DXP 2800 Pro: https://amzn.to/3UxOlxg
How to Install Open Media Vault on a UGREEN NAS
(Some links on this post may be affiliate links, which help support me and help keep ads off here!)

One of the big advantages of a UGREEN NAS is that you’re not necessarily locked into UGOS. UGREEN’s x86-based NAS hardware can also run alternative operating systems, and in this guide, I’ll walk through installing OpenMediaVault (OMV) on the UGREEN DXP2800 while preserving the original UGOS installation.

If you’re more interested in TrueNAS, I’ve also covered running TrueNAS on the UGREEN DXP4800 Pro, which provides another option for turning UGREEN hardware into a more customizable NAS platform.

What We’re Working With

The UGREEN DXP2800 features an Intel N100 quad-core processor, 8GB of DDR5 memory, 2.5-Gigabit Ethernet, two M.2 NVMe slots, multiple USB ports, and HDMI output. For a compact two-bay NAS, there’s quite a bit of hardware to work with.

For this installation, I’m using two 2TB Seagate IronWolf hard drives for storage. I purchased the DXP2800 and both drives myself, and this project is not sponsored by UGREEN.

The DXP2800 ships with UGOS preinstalled on its internal 32GB eMMC storage. Because I want to preserve that installation, I’m installing OpenMediaVault onto a separate 256GB HP NVMe SSD instead of overwriting the internal eMMC. (Affiliate links are below which I may receive commission on)

Installing the NVMe Drive

Unlike some of UGREEN’s larger NAS models, the DXP2800’s two M.2 NVMe slots are located inside the drive bays rather than underneath the NAS. You’ll therefore need to remove the hard-drive trays to access them.

The NVMe drive slides into its M.2 connector at an angle and is secured with a convenient tool-free latch, so there’s no tiny M.2 screw to deal with. Once the NVMe is installed, the two hard drives can be seated in their trays and slid back into the NAS.

Downloading OpenMediaVault

The first step is to download the latest OpenMediaVault ISO. At the time of this guide, I’m using OpenMediaVault 8.3, based on Debian 13 “Trixie.”

Using the ISO is worth distinguishing from some other OMV installations. OpenMediaVault can also be installed on top of an existing Debian installation, which is a common approach on hardware such as a Raspberry Pi. In this case, however, we’re turning the DXP2800 into a dedicated OpenMediaVault NAS.

Installing from the ISO gives OMV direct control over the system’s storage, RAID configuration, networking, and other NAS functions, making it a clean and straightforward option for this build.

Creating the OpenMediaVault Installer

Once the ISO has downloaded, flash it to a USB drive using a tool such as balenaEtcher.

Connect the DXP2800 to a monitor using HDMI and attach a keyboard. You’ll also need to insert the USB drive containing the OpenMediaVault installer and connect the NAS to your network using Ethernet.

Power on the DXP2800. When the UGREEN splash screen appears, hold Control and repeatedly press F2 to enter the BIOS.

Disabling the UGREEN Watchdog

Before installing anything, we need to change an important BIOS setting.

UGREEN includes a ‘watchdog‘ function designed to automatically reboot the NAS if it doesn’t detect UGOS running after a few minutes. That’s useful when you’re actually running UGOS, but considerably less useful when you’re halfway through installing a completely different operating system.

Enter the BIOS settings and disable the watchdog before proceeding with the OpenMediaVault installation.

Identifying the Correct Boot Drive

Next, open the BIOS NVMe configuration and make sure you can clearly identify the drive you intend to use for OpenMediaVault.

In my case, the distinction is straightforward: my OpenMediaVault target is the 256GB HP NVMe SSD, while UGOS is installed on the NAS’s 32GB internal eMMC.

Make a note of which device is which. This becomes extremely important during installation because selecting the wrong target could erase your UGOS installation.

Next, confirm that the NAS is configured for UEFI boot mode, set the USB installer as the first boot device, save the BIOS changes, and reboot. When the OpenMediaVault installation menu appears, select Install.

Installing OpenMediaVault

The installer begins with the usual setup questions, including your location, preferred language, and keyboard layout.

You’ll then give the NAS a host name. This is the name that identifies the OpenMediaVault system on your network. I’m simply using openmediavault.

For the domain name, I’m using internal.

The installer will then ask you to create a password for the root account. It’s important to understand that this is the administrative password used when logging into the OpenMediaVault terminal or connecting through SSH. It is not the password for OMV’s web interface, which uses a separate admin account.

After setting your time zone, the installer may warn you that multiple drives have been detected. That’s expected in a NAS with several storage devices, so continue with the installation.

Forcing a UEFI Installation

You may encounter a somewhat intimidating prompt asking whether you want to force a UEFI installation. For this setup, select Yes.

This ensures that OpenMediaVault installs its boot-loader using the UEFI boot method we confirmed earlier in the UGREEN BIOS. That gives our target drive the appropriate UEFI boot files so the DXP2800 can recognize it as a bootable device.

Next, select the drive where OpenMediaVault will be installed. In my case, that’s the 256GB HP NVMe SSD.

Be especially careful at this step. The selected drive will be erased. Do not accidentally select the internal eMMC containing UGOS if you intend to preserve the original UGREEN operating system.

You may also encounter a screen asking for an HTTP proxy. I saw this when using the same installer on another computer but not when installing it on the UGREEN. Most home networks don’t require an HTTP proxy, so you can normally leave this field blank.

First Boot Into OpenMediaVault

Once installation finishes, remove the USB installer and reboot the NAS. Keep the monitor connected for the moment because we want to identify the IP address assigned to OpenMediaVault.

At the terminal login, enter root as the username followed by the root password you created during installation.

Normally, OMV displays its web interface IP address in the upper-left corner of the console. During my installation, however, Ethernet wasn’t detected when this screen initially appeared, and the displayed address didn’t automatically refresh.

If this happens, reconnect the Ethernet cable, wait a few seconds, and run either:

ip a

or:

ip -4 -br addr

This will display the NAS’s current network address. This appears to be more of a network-detection quirk than a normal part of installing OpenMediaVault.

Logging Into the OMV Web Interface

Enter the OpenMediaVault IP address into a web browser on another computer.

The default OMV web interface credentials are:

Username: admin
Password: openmediavault

The first thing I recommend doing is changing that default password. Click the profile icon in the upper-right corner, select Account, choose Password, and create a new administrative password.

Remember that this web-interface password is separate from the root password we created during installation.

Updating OpenMediaVault

Before configuring storage, it’s a good idea to install the latest system updates.

Navigate to System → Update Management → Updates and install the available updates. Depending on when you perform the installation, there may be quite a few.

Throughout OpenMediaVault, you’ll also periodically see a yellow confirmation banner after changing settings. Be sure to click Apply when it appears. Otherwise, your configuration changes may not actually be committed.

Installing Linux MD RAID Support

Beginning with OpenMediaVault 7, the traditional Linux software RAID controls were moved out of the main interface and into an official plugin. For a NAS operating system, I personally think RAID configuration could be a little more front and center—or at least offered during the initial setup—but fortunately, installing the plugin is easy.

Navigate to System → Plugins and search for MD or RAID. Locate the Linux MD plugin and install it.

If you prefer ZFS, that’s another option. The openmediavault-zfs plugin is available through OMV-Extras and provides ZFS storage pools with features such as mirrors and RAIDZ. ZFS is extremely powerful, but it also requires a little more setup.

For this two-drive NAS, I’m keeping things simple and using Linux MD to create a traditional RAID 1 mirror.

Creating the RAID 1 Array

After installing the MD plugin, navigate to Storage → Multiple Device, click the plus (+) button, and select Mirror.

Select both hard drives and save the configuration. OpenMediaVault will then begin building and synchronizing the RAID 1 array.

Normally, the next step would be creating a file system such as EXT4 or Btrfs. My drives were previously used together in the same RAID configuration for another project, so OMV detected their existing Btrfs file system and I didn’t need to create another one.

You also don’t necessarily have to wait for RAID synchronization to finish before creating a file system, mounting the array, or configuring shared folders. Synchronization can continue in the background, although the array does not have full redundancy until synchronization is complete.

Mounting the File System

Once the file system is ready, use the Play/Mount button, select the appropriate file system, and click Save.

When the yellow confirmation banner appears, click Apply to commit the change.

Your RAID storage is now mounted and ready for OpenMediaVault to use. Next, create a user account for accessing the NAS.

Navigate to the user-management section, click the plus (+) button, and select Create. Enter the username and other requested information.

I’m also adding my user to the SSH group so the account can access the NAS remotely through a shell when needed.

Enabling SMB and Rsync

OpenMediaVault supports several network services, but two particularly useful ones are SMB/CIFS and rsync.

For rsync, navigate to Services → Rsync, enable the server, and leave the default port at 873 unless you have a particular reason to change it.

Next, navigate to Services → SMB/CIFS and enable SMB. SMB provides convenient network file sharing with Windows, macOS, Linux, and many other devices.

Creating a Shared Folder

With our storage mounted and services enabled, we can create a network share.

Navigate to Storage → Shared Folders, click Create, give the folder a descriptive name, and select your RAID storage. You can also change the relative folder path if you don’t want to use the default.

OpenMediaVault will display the default permissions for the folder. Administrators and users can typically read and write, while guests have more restricted access. Adjust these permissions as needed and save the configuration.

Testing the NAS From macOS

To verify everything is working, I’m connecting from a Mac.

Open Finder, select Network, and double-click openmediavault. Connect using the credentials for the user account created earlier.

Once connected to the shared folder, try creating a test directory and copying over a few files. If you can create folders and transfer files successfully, your OpenMediaVault NAS is officially up and running.

From here, you can create separate shares for backups, photos, videos, personal documents, or whatever else you want to store on your NAS.

Expanding OMV With Plugins

One of OpenMediaVault’s strengths is how much functionality can be added after the basic installation.

OMV-Extras provides access to an additional collection of community-maintained plugins. One of the most useful is the Compose plugin, which provides Docker and Docker Compose integration through OpenMediaVault. This opens the door to running self-hosted applications such as Jellyfin, Immich, Nextcloud, and many others.

The Backup plugin can help protect the OpenMediaVault system itself, while BorgBackup provides versioned, compressed, and encrypted backups of your data. There are also plugins for displaying CPU temperatures, adding two-factor authentication, and integrating ClamAV antivirus scanning.

These extras can turn a relatively straightforward file server into a much more capable self-hosting platform.

Automating Backups With Rsync

OpenMediaVault also lets you schedule commands and recurring jobs.

For example, you could configure an rsync job to copy one of your shared folders to an external USB drive every Sunday morning. The initial backup would copy the entire dataset, while subsequent runs would generally only need to transfer files that are new or have changed.

You could take this considerably further with scheduled network backups, BorgBackup, additional NAS targets, and other strategies.

Each of those topics could easily become a tutorial of its own, so for this guide, we’re sticking with getting the core NAS functionality working.

Is OpenMediaVault a Good Fit for a UGREEN NAS?

I think OpenMediaVault occupies a nice middle ground between UGOS and TrueNAS.

On one side, OMV is open source, highly customizable, and backed by a large community. It gives you considerably more freedom than a vendor-specific NAS operating system such as UGOS, although the experience isn’t always as turnkey or polished.

On the other side, OpenMediaVault can feel more approachable than TrueNAS. Its plugin architecture makes it relatively easy to add functionality as you need it, while TrueNAS provides more advanced storage capabilities out of the box, particularly around ZFS, snapshots, replication, and larger or more complex storage environments.

If you want something more flexible than UGOS without immediately jumping into the deeper end with TrueNAS, OpenMediaVault can be an excellent fit for UGREEN hardware—especially if you enjoy tinkering and want more control over how your NAS works.

If you’re new to UGREEN NAS, check out my post about why I switched from Synology NAS brand last year!

💻 Hardware I Used: ✅ Some links on this post may be affiliate links, which help support me and help keep ads off here!
1. UGREEN DXP6800 Pro NAS: https://amzn.to/4tKmKoF
2. UGREEN DXP2800 NAS: https://amzn.to/4qxKdcI
3. 4 x 8TB Ironwolf HDD Used in DXP 6800 Pro: https://amzn.to/4diniNt
4. 2 x 4TB Ironwolf HDD Used in DXP 2800 Pro: https://amzn.to/3UxOlxg
Secure Your UGREEN NAS & Access It Remotely with Tailscale
A NAS, gives you an incredible amount of control over your files, applications, backups, and media. But once you start thinking about accessing your NAS remotely, security becomes just as important as convenience.

UGREEN provides its own remote-access service, UGREENlink, but you don’t necessarily have to use it. If you prefer a platform-independent solution that works across different NAS brands, servers, computers, and mobile devices, Tailscale is an excellent alternative.

In this guide, we’ll go through several security best practices for a UGREEN NAS, including reducing unnecessary services, strengthening account security, configuring the built-in firewall, and finally using Tailscale for secure remote access.

Reduce Your NAS Attack Surface

One of the simplest ways to improve NAS security is to reduce the number of services that are available in the first place.

If you’re not using UGREEN Remote Access, you can disable it. The same principle applies to other services and applications installed on your NAS. If you don’t use something, there is little reason to leave it running.

Unused applications should also be removed, and services such as UPnP should generally remain disabled unless you specifically need them. Every unnecessary service is another potential entry point that you have to maintain and secure.

Review UGREEN’s Built-In Security Settings

UGOS includes several security controls that are worth reviewing even if many of them are enabled by default.

Inside the UGREEN Control Panel, open the Security section and review the available options.

One setting controls how long an inactive management session can remain open before you are automatically logged out. Another option can clear active user sessions whenever the NAS restarts, requiring everyone to authenticate again.

These aren’t dramatic security features by themselves, but together they reduce the chance that an unattended or previously authenticated session remains accessible.

Enable DoS Protection

UGREEN also provides built-in protection against denial-of-service, or DoS, attacks.

A DoS attack occurs when another system intentionally overwhelms a device with network traffic to the point where it slows down or becomes unavailable.

UGOS can monitor TCP, UDP, and ICMP traffic for behavior that could indicate this type of attack. Enabling all three protections gives the NAS another layer of defense against suspicious network activity.

Configure Automatic IP Blocking

Another important setting controls failed login attempts.

You can configure the NAS to automatically block an IP address after a certain number of incorrect password attempts within a specified period of time. This can help slow down automated login attempts and basic brute-force attacks.

UGOS also provides a Block List where you can review addresses that have been blocked or manually add addresses yourself.

There is also an optional Whitelist. This allows you to identify trusted IP addresses that should never be automatically blocked. For example, you might whitelist a trusted computer on your local network so repeated login mistakes don’t accidentally lock that system out.

Use TLS 1.2 or Later

UGOS also includes a TLS configuration option.

This particular setting does not turn HTTPS on or off. Instead, it determines which versions of the TLS encryption protocol the NAS is allowed to use when an HTTPS connection is established.

Leaving the minimum version set to TLS 1.2 or later helps prevent connections from falling back to older and less-secure encryption protocols.

Strengthen Your UGREEN Account Security

Your NAS security is only as strong as the accounts that can access it.

Use a strong, unique password and enable two-factor authentication whenever possible. Two-factor authentication adds another layer of protection because gaining access requires more than simply knowing the password.

UGOS also provides an Account Activity section where you can see which users are currently connected, how they’re connected, and information about the device or IP address being used.

If you notice an unfamiliar connection, you can terminate that session directly from the interface.

UGREEN also provides account-level blocking, which offers another method of limiting repeated failed login attempts against individual user accounts.

Configure the Firewall with Default-Deny Approach

UGREEN includes a built-in firewall that can provide another layer of protection.

If you already use a dedicated firewall such as UniFi, pfSense, or OPNsense, that device will usually remain your primary line of defense. However, enabling the NAS firewall can still provide some additional protection directly on the device.

When configuring firewall rules, I prefer a default-deny approach. Instead of asking which services should be blocked, ask which services actually need to be allowed.

For example, if you use SSH, SMB, and NFS, you can create allow rules specifically for those services.

If you don’t use services such as FTP or WebDAV, there’s usually no reason to create separate firewall rules specifically denying them. Simply leave those services disabled in UGREEN’s file-service settings.

What About Geo-IP Blocking?

UGREEN also provides Geo-IP filtering.

If you’re using a typical consumer router without advanced firewall capabilities, Geo-IP filtering can provide another useful layer of protection by blocking connection attempts from countries where you don’t expect legitimate traffic to originate.

However, Geo-IP blocking should never be treated as a replacement for strong passwords, multi-factor authentication, or secure remote-access practices.

More advanced firewall platforms such as UniFi, pfSense, and OPNsense are generally better equipped to handle Geo-IP filtering, VLAN policies, and more complex network rules.

UGREENlink vs. Tailscale

UGREEN includes its own remote-access service called UGREENlink, which provides encrypted access to your NAS from outside your home network.

There’s nothing inherently wrong with using it.

However, some users may prefer a remote-access solution that isn’t tied to a particular NAS manufacturer. That’s where Tailscale becomes particularly useful.

Tailscale uses WireGuard-based encrypted connections and creates a private network between your authorized devices. It gives you a consistent way to access not only your UGREEN NAS, but also other servers, computers, and services in your homelab.

Installing Tailscale on a UGREEN NAS with Docker

For this configuration, Tailscale runs inside a Docker container.

First, make sure the Docker application is installed on your UGREEN NAS through the App Center.

Next, open File Manager and locate your shared docker directory. Inside that directory, create a folder named:

tailscale

Inside the Tailscale folder, create another folder named:

state

I recommend keeping these directory names lowercase because the volume paths in the Docker Compose YAML file need to match the directory names exactly.

Import the Tailscale YAML File

Open the Docker application and select Project, then choose the option to create a new project.

Use the Import option and select the Tailscale YAML file.

Rather than manually creating each Docker container setting through the graphical interface, the YAML file defines the container configuration for you. Once imported, you can review and modify the configuration before deployment.

To download the yaml file I’m using, please visit my patreon!

Create Your Tailscale Account & Tailnet

If you don’t already have one, create a free account at Tailscale.

You should also install Tailscale on the device you’ll use when accessing the NAS remotely. This could be your laptop, desktop computer, tablet, or smartphone.

Once a device is connected to your account, it becomes part of your tailnet.

A tailnet is essentially the private network created between all of the devices connected to your Tailscale account.

Generate a Tailscale Authentication Key

To add the UGREEN NAS to your tailnet, log into the Tailscale web interface and open the Keys section under your account settings.

Generate a new authentication key and give it a recognizable name such as:

ugreennas

You can also configure an expiration date for the key.

Tailscale provides an option to make devices ephemeral, meaning they can automatically disappear from your tailnet after going offline. For a NAS that remains part of your network permanently, I generally leave that option disabled.

Once the authentication key is generated, copy it to your clipboard.

Add the Authentication Key to Your YAML File

Return to the Tailscale project you imported into UGREEN Docker.

Inside the YAML configuration, locate the Tailscale authorization environment variable and replace the generic placeholder key with the authentication key you just generated.

You should also carefully review the volume path.

The path on the left side of the volume mapping refers to the folders located on your UGREEN NAS. Make sure the directory names match the folders you created earlier, including capitalization.

The path on the right side represents the corresponding location inside the Docker container and generally doesn’t need to be changed.

Once everything looks correct, deploy the project.

Verify Your NAS in Tailscale

After the container starts, return to the Tailscale administration page.

Your UGREEN NAS should now appear as another connected device on your tailnet.

Tailscale will assign the NAS a Tailscale IP address and can also provide a MagicDNS hostname, which makes accessing devices easier because you don’t have to remember individual IP addresses.

Access the UGREEN Web Interface Remotely

Once both your remote device and UGREEN NAS are connected to Tailscale, you can access the UGOS management interface through your private tailnet.

Enter the NAS’s Tailscale address or MagicDNS hostname into your browser along with the port used by the UGREEN web interface.

You can then log into UGOS using your normal NAS username and password.

The important difference is that you’re reaching the NAS through your private Tailscale connection rather than exposing the NAS management interface directly to the public internet.

Access Immich Remotely Through Tailscale

The same method works for applications running on your NAS.

For example, if you’re hosting an Immich photo library on your UGREEN NAS, you can connect to it remotely using Tailscale. On your phone, enable Tailscale and open the Immich app. For the server address, enter the MagicDNS hostname or Tailscale address for your UGREEN NAS followed by Immich’s port: 2283

This allows your phone to communicate directly with the Immich server through your private Tailscale network, even when you’re away from home and using cellular data or another Wi-Fi network.

If you want to see my blog post about configuring immich on the UGREEN NAS, click here!

Security Is About Layers

There isn’t one setting that suddenly makes a NAS secure.

Good security comes from combining multiple layers.

Disable services you don’t need. Keep UGOS, applications, and Docker containers updated. Use strong passwords and multi-factor authentication. Enable automatic blocking and firewall protections where appropriate. Avoid exposing NAS management ports directly to the internet.

And when you need remote access, a private networking solution such as Tailscale can provide a much safer and more flexible alternative to simply forwarding ports through your router.

The goal isn’t to make your NAS impossible to reach. It’s to make sure that only the people and devices you trust have a path to it!

Please be sure to sign up for a free patreon membership and join my ‘Tech Fans’ community for the full tutorial for configuring Tailscale on UGREEN NAS

💻 Hardware I Used: ✅ Some links may be affiliate links, which help support me and help keep ads off here!
1. UGREEN DXP6800 Pro NAS: https://amzn.to/4tKmKoF
2. 4x 8TB Ironwolf HDD Used in 6800 Pro: https://amzn.to/4diniNt
3. 256 Kingspec NVMe Drive: https://amzn.to/4ukfJvG
How to Install Jellyfin on a UGREEN NAS
Jellyfin is a free, open-source media server that lets you organize and stream your own movies, television

shows, music, and home videos. Unlike some competing platforms, Jellyfin does not require a paid

subscription to unlock hardware-accelerated transcoding.

In this guide, we will install Jellyfin through the Project section of UGREEN’s Docker app. The overall

process is similar on other UGREEN NAS models that support Docker, although hardware-acceleration

options can vary by processor.

Two Ways to Install Jellyfin on UGREEN

UGREEN offers two practical installation routes:

• App Center: The fastest and simplest option. UGREEN handles most of the container setup for you.

• Docker Project: A more flexible deployment that lets you edit the Compose YAML, choose ports and

storage paths, pass hardware devices into the container, and redeploy after making changes.

The App Center version may be sufficient for many users. However, this guide uses a Docker Project because it

provides more control and makes future changes easier.

Before You Begin

Before installing Jellyfin, make sure the NAS has been initialized and its storage is ready. You will need:

• A compatible UGREEN NAS running UGOS Pro

• At least one configured storage pool and volume

• The UGREEN Docker app, installed from the App Center

• Administrator access to the NAS

• Folders containing your movies, television shows, or other media

It is a good idea to decide where your media will live before creating the project. You can change the paths

later, but planning your folder structure first makes the setup cleaner.

Create the Jellyfin Docker Project

Open the Docker app in UGOS Pro, select Project, create a new project, and give it a recognizable name

such as jellyfin. Paste the following Compose configuration into the project editor, replacing the media pathswith the actual locations on your NAS.

Example Docker Compose YAML for an Intel-based UGREEN NAS. Replace the placeholder media paths with the paths used by your

own storage pool and shared folders.

For a more detailed line-by-line explanation of the YAML file, see my free Patreon membership post: Mackey Tech – Jellyfin Docker YAML Breakdown

Understanding Volume Paths

Docker volume mappings use the following format:

NAS path : container path

The path on the left points to the real folder on the UGREEN NAS. The path on the right is where Jellyfin sees

that folder inside its container. When adding a library in Jellyfin, you select the container path, not the original

UGOS file-system path.

For example, if this mapping is used:

*/path/to/Media/Movies:/media/movies:ro

Jellyfin will browse the folder as /media/movies. The optional ‘:ro’ makes the mount read-only, allowing

Jellyfin to scan and play the files without modifying or deleting them.

Where Should You Store Your Media?

The relative paths used for Jellyfin’s configuration and cache keep those files inside the Docker Project

directory. This is convenient and makes the application easier to manage.

For a permanent media library, it is usually better to store movies and television shows in separate shared

folders outside Docker’s default project directory. This keeps your personal media separate from the

application files and makes it easier to:

• Access the media through SMB or the UGREEN File Manager

• Back up the media separately from the Jellyfin application

• Rebuild or replace the Jellyfin container without moving the library

• Allow other applications to access the same media collection

A sensible arrangement is to keep /config and /cache with the Docker Project while mapping your existing

Movies and TV Shows shared folders into the container.

Deploy the Project and Open Jellyfin

YAML is indentation-sensitive, so use spaces rather than tabs and verify that each section is aligned

correctly. Deploy the project and confirm that the Jellyfin container is running.

The example port mapping is:

* 8900:8096

The first number is the port used on the NAS. The second number is Jellyfin’s internal HTTP port. If the NAS

has the local IP address 192.168.1.100, open: http://192.168.1.100:8900

You may replace port 8900 with another unused NAS port. The internal port normally remains 8096.

Complete the Jellyfin Web Setup

The first time you open Jellyfin, the setup wizard will guide you through the basic configuration:

• Select your preferred language.

• Create the administrator account and choose a strong password.

• Create separate libraries for Movies, Shows, Music, Home Videos, and other content types.

• Select the container-side folder paths, such as /media/movies and /media/tv.

• Choose the preferred metadata language and country.

• Decide whether Jellyfin should allow remote connections.Allowing remote connections in Jellyfin does not automatically make the server securely accessible from the internet. Avoid directly forwarding the Jellyfin port unless you understand the security implications. A private-access service such as Tailscale is often a simpler option.

Organizing Movie Libraries

The release year helps Jellyfin distinguish remakes and similarly named movies. Giving each movie its own

folder also makes posters, subtitles, extras, and alternate versions easier to manage.

Organizing TV Show Libraries

The most important part of an episode filename is the season-and-episode identifier, such as S01E01.

Specials are commonly placed in a Season 00 folder, and a file containing multiple episodes can use a

format such as S01E01-E02.

Direct Play and Transcoding

Direct Play sends the original file to the playback device without converting it. This uses relatively little

processing power. Transcoding occurs when Jellyfin must convert the video, audio, container, resolution,

bitrate, or subtitles for the client device.

Transcoding may be required when a client does not support the original codec, the available bandwidth is

limited, a lower streaming quality is selected, subtitles must be burned into the video, or HDR tone mapping is

required.

Intel Quick Sync on the DXP6800 Pro

This demonstration uses the UGREEN NASync DXP6800 Pro, which has an Intel Core i5-1235U processor

with integrated Intel graphics. Intel Quick Sync Video can accelerate supported video decoding and encoding,

reducing the load on the CPU during transcoding.

The /dev/dri:/dev/dri device mapping gives the Jellyfin container access to the compatible graphics

device. After the initial setup, open: Dashboard > Playback > Transcoding

For this Intel system, Intel Quick Sync or VA-API will usually be the relevant hardware-acceleration options.

Do not enable every codec simply because it appears in the menu; supported formats depend on the

processor generation and driver configuration.

AMD Ryzen and ARM-Based UGREEN Models

Other UGREEN models use AMD Ryzen or ARM-based processors. Jellyfin can support hardware

acceleration on compatible AMD and Rockchip hardware, but the exact method and container configuration

may differ from the Intel example in this guide.

Actual hardware-transcoding support depends on the specific processor, its integrated media engine, the

available Linux drivers, whether UGOS exposes the graphics device to Docker, and whether the Jellyfin

image includes the required support. These systems can still use Direct Play even when hardware

transcoding is unavailable.

Library and Naming Media

• Keep movies, television shows, music, and home videos in separate libraries.

• Include release years in movie and series folder names.

• Use consistent SxxExx episode numbering.

• Organize the files before the initial library scan whenever possible.

• Correct any mismatched metadata from Jellyfin’s identification tools.

• Back up the Jellyfin configuratioUn folder as well as your media.

Backing up only the media will not preserve user accounts, watch history, library settings, custom metadata,

or server preferences. Include the NAS folder mapped to /config in your regular backup strategy.

Updating Jellyfin

A Docker Project makes future changes straightforward. Edit the YAML and redeploy whenever you need to

modify a path, port, device mapping, or another setting. Before major updates, back up the configuration

folder, verify the volume paths, and review the release notes.

The container itself should be treated as replaceable. The persistent configuration and media must remain

outside the container so they survive an update or redeployment.

Final Thoughts

Installing Jellyfin from UGREEN’s App Center is the fastest route, but deploying it through the Docker app’s

Project section provides greater control over storage, ports, hardware access, and future changes.

The key concept is understanding the difference between the real path on the NAS and the path Jellyfin sees

inside its container. Once the paths are mapped correctly and the media is organized using consistent

naming conventions, Jellyfin can build a polished and easy-to-browse personal streaming library.

My UGREEN NAS Overviews

Why I walked Away from Synology after 15 years!

I Swapped UGOS For TrueNAS On the UGREEN DXP 4800 Pro, Here’s What Happened!

💻 Hardware Used:

✅ Some links may be affiliate links, which help support me and help keep ads off here!
1. UGREEN DXP6800 Pro: https://amzn.to/4tKmKoF
2. 4x 8TB Ironwolf HDD Used in 6800 Pro: https://amzn.to/4diniNt
3. 256 Kingspec NVMe Drive: https://amzn.to/4ukfJvG

UgreenNAS

Migrate Your Immich Library to External USB Storage

Quick Recap

Back Up Before You Touch Anything

Finding Your External Drive’s Mount Point

Stopping Immich and Moving the Library

Editing the Compose File

Redeploying and Checking Everything

Don’t Skip the Backup Schedule

One Last Thing

UGREEN NAS Back up Strategy With 3-2-1 Strategy

Do you have a Backup Plan?

What Is the 3-2-1 Backup Strategy?

Decide What You Need to Back Up

Using M-DISCs for Long-Term Archival Storage

Create a Local USB Backup

Back Up One UGREEN NAS to Another

Prepare the Destination NAS

Create the Local NAS-to-NAS Backup

Plan the Initial Remote Backup Carefully

What Happened with UGREENlink Remote Access

Using Tailscale for Remote Backups

Why the Backup Folder Contains So Many Files

Test the Restore Process

What I Learned from the Remote Tests

Build a Backup Plan That Works for You

How to Install Open Media Vault on a UGREEN NAS

What We’re Working With

Installing the NVMe Drive

Downloading OpenMediaVault

Creating the OpenMediaVault Installer

Disabling the UGREEN Watchdog

Identifying the Correct Boot Drive

Installing OpenMediaVault

Forcing a UEFI Installation

First Boot Into OpenMediaVault

Logging Into the OMV Web Interface

Updating OpenMediaVault

Installing Linux MD RAID Support

Creating the RAID 1 Array

Mounting the File System

Enabling SMB and Rsync

Creating a Shared Folder

Testing the NAS From macOS

Expanding OMV With Plugins

Automating Backups With Rsync

Is OpenMediaVault a Good Fit for a UGREEN NAS?

Secure Your UGREEN NAS & Access It Remotely with Tailscale

Reduce Your NAS Attack Surface

Review UGREEN’s Built-In Security Settings

Enable DoS Protection

Configure Automatic IP Blocking

Use TLS 1.2 or Later

Strengthen Your UGREEN Account Security

Configure the Firewall with Default-Deny Approach

What About Geo-IP Blocking?

UGREENlink vs. Tailscale

Installing Tailscale on a UGREEN NAS with Docker

Import the Tailscale YAML File

Create Your Tailscale Account & Tailnet

Generate a Tailscale Authentication Key

Add the Authentication Key to Your YAML File

Verify Your NAS in Tailscale

Access the UGREEN Web Interface Remotely

Access Immich Remotely Through Tailscale

Security Is About Layers

How to Install Jellyfin on a UGREEN NAS

Two Ways to Install Jellyfin on UGREEN

Before You Begin

Create the Jellyfin Docker Project

Understanding Volume Paths

Where Should You Store Your Media?

Deploy the Project and Open Jellyfin

Complete the Jellyfin Web Setup

Organizing Movie Libraries

Organizing TV Show Libraries

Direct Play and Transcoding

Intel Quick Sync on the DXP6800 Pro

AMD Ryzen and ARM-Based UGREEN Models

Library and Naming Media