Moved
1.6 TB
photos, music, video, personal folders and websites, checked by file count and size
Duration
4 days
from analysis to the old NAS physically gone; everything was built and tested alongside the old NAS first
Services
10
each in its own Docker container, with its own versions and settings (since 26 October also monitoring and the photo app)
Status
Completed
DS414 switched off and removed since 25 October; everything runs on the UGREEN
On the NAS now
Loading figures…
Processor
–
Processor load
–
Memory
–
in use of 8 GB
Drives
–
hard drives / NVMe
Indexing photos (Immich)
Loading…
Immich only reads the photos on the NAS; the photos themselves are not changed. Each component may use at most 0.44 of a processor core (since 26 October 21:20, before that 0.35), so the cameras and websites take priority. Recognition runs on the graphics chip. Videos are skipped for now.
UGOS search index
Loading…
The NAS's built-in search. It runs at the lowest priority and may use at most a quarter of a processor core.
Why replace it?
- The DS414 cannot go beyond DSM 7.1.1, and Synology stopped updating that version in June 2025. So the whole operating system no longer received security updates.
- The newest PHP package was PHP 8.0, also without updates. As a stopgap, PHP 8.4 ran temporarily via Entware.
- The two hard drives had almost 80,000 running hours (more than 9 years) behind them.
- The ARM processor and 1 GB of memory were too weak for camera footage with recognition, containers and mail.
Old
Synology DS414
Released in 2013
- Processor
- Marvell Armada XP, 4 cores, 1.33 GHz (ARMv7, 32-bit)
- Memory
- 1 GB DDR3
- Drive bays
- 4 × 3.5"
- Drives
- 2 × WD Red 3 TB (WD30EFRX) in RAID1
- Capacity
- 2.7 TB, of which 1.1 TB free
- Network
- 2 × 1 Gbit/s
- System
- DSM 7.1.1, no updates since June 2025
New
UGREEN NASync DXP2800
In use since 24 October 2026
- Processor
- Intel N100, 4 cores, up to 3.4 GHz (x86-64), with built-in graphics chip
- Memory
- 8 GB DDR5
- Drive bays
- 2 × 3.5" + 2 × M.2 NVMe
- Drives
- 2 × WD Red Plus 4 TB (WD40EFZZ, CMR) in RAID1
1 × Patriot P300 512 GB NVMe - Capacity
- 3.7 TB on the hard drives + 454 GB on the NVMe
- Network
- 2.5 Gbit/s
- System
- UGOS Pro (Linux 6.18) with Docker
What ran where
| Function | Old DS414 | New UGREEN |
|---|---|---|
| Websites | Web Station with nginx and PHP 8.0 (later PHP 8.4 as a stopgap) | Caddy as web server with automatic certificates + PHP 8.4 in a container |
| Database | MariaDB package | MariaDB 11.4 in a container; all tables counted and found identical |
| Database management | phpMyAdmin (manual) | phpMyAdmin in a container, only reachable on the home network |
| WordPress sites | were with an external hosting provider | now self-hosted, with their databases |
| Synology Mail Server (outdated, no longer in use) | own mail server (Postfix, Dovecot, Rspamd) for 7 domains, all 7 with their own DKIM signing, and a spam filter; sending via a relay. Version 16 since 25 October | |
| Cameras | Surveillance Station, recording 24/7 | Frigate: detects people and cars with the graphics chip and only records events, kept for 30 days |
| Energy dashboard | metering program on Node.js 12 | metering program in a container on Node.js 22 |
| Photos | Synology Photos | Immich: search by what is in the photo (also in Dutch), face recognition, timeline and map |
| Video on the TV | Media Server (DLNA) | UGREEN's DLNA app, music and video only; deliberately no photos, because DLNA has no passwords |
| Monitoring | emails from DSM | own monitoring that checks temperatures, drives, RAID, memory, services, websites, mail, certificates, cameras and backups every minute. Alerts go out as push notifications via Homey and are spoken on the Google speakers during the day |
| File search | Universal Search | UGOS search index, throttled so it does not get in the way of the rest |
| Ad filter | none | AdGuard Home for the whole network, encrypted to Quad9 |
| Files | shared folders on 2 × 3 TB | shared folders on 2 × 4 TB (btrfs, with snapshots) |
| Removed | Download Station, Video Station, Audio Station, Apache, Python 2, QuickConnect | no longer needed or replaced |
Storage layout
Volume 1 · hard drives, RAID1, btrfs · 42% of 3.7 TB in use
Photos, music, video, personal folders, camera recordings and backups. Mirrored drives: if one fails, everything keeps working.
Volume 2 · NVMe, ext4 · 4% of 454 GB in use
Docker, databases, websites and Immich's thumbnails and search data. Fast and quiet; a copy goes to volume 1 every week.
How it is set up
- Containers: every service has its own container. The settings are in version control, and deploying takes a single command.
- One folder per service: everything belonging to a service is kept together, so moving to other drives is easy.
- Reachable from outside: only the websites (via Caddy) and the mail server. Admin pages can only be reached from home.
- Certificates: Let's Encrypt, renewed automatically.
- Processor: the power limit was raised from 6 W to 15 W. That gives 24% more computing power, while consumption under full load is only 9 W.
- Sparing with computing power: heavy jobs (photo app, search index) get a fixed maximum and low priority. After an initial peak of 88 °C the processor stays at around 60 to 75 °C.
- Shielding: the router passes outside visitors on with its own address, which made the web server mistake them for home users. That is why everything coming in through the router now gets a password prompt for the test sites and the photo app.
- Switching over: everything was first built and tested alongside the old NAS. Then only the forwarding in the router was changed; rolling back was possible until the very last moment.
New automatic tasks
| When | Task |
|---|---|
| Every minute | Monitoring: an alert after two failed rounds, and another message once it is resolved. On request the NAS speaks its status through the Google Assistant. |
| Every 5 minutes | Update the figures in "On the NAS now" at the top of this page. |
| Every 2 hours | The PC with all projects is mirrored to the NAS, at low priority and without a window. The NAS user for this can only write to the backup folder. |
| Every evening 23:30 | Frozen copy (snapshot) of the backup folder: 30 days and 12 months back. The PC cannot change or delete these copies, which protects against ransomware. If the PC backup is 3 days old or reported an error, an email follows. |
| Every night | Immich: maintenance at 01:00, a copy of the database at 02:00 (14 kept), looking for new photos at 03:00. |
| Every Sunday 03:30 | Databases exported and all container folders copied from the NVMe to the hard drives; kept for 8 weeks. |
| Continuously | Renewing certificates, updating AdGuard lists, restarting containers automatically after a failure or reboot. |
| At startup | Setting the processor power limit correctly. |
Timeline
- 22 Oct · Analysis: DS414 without updates. PHP 8.4 as a stopgap, open admin ports closed, old mail server removed.
- 23 Oct · UGREEN DXP2800 with 2 × 4 TB and an NVMe ordered; migration plan written.
- 24 Oct · NAS installed, RAID1 checked, NVMe tested. Data copied (up to 60 MB/s), websites, database and mail server in containers. WordPress sites and mail brought over from the external hosting. At 19:30 all websites switched to the new NAS.
- 25 Oct · Cameras to Frigate, final check, DS414 switched off (09:15). AdGuard Home on for the whole network, DS414 physically removed, PC backup set up.
- 25 Oct, afternoon · Mail server to version 16 (a copy first, then everything tested). DLNA for the TV. Monitoring with alerts via Homey and the Google speakers. UGOS search index paused, because it kept the processor at 86 °C.
- 26 Oct, morning · Old hosting cleaned up (outdated mail and DNS records gone, stricter SPF), own DKIM key for all 7 mail domains, unnecessary mail services at TransIP cancelled. Stuttering camera stream fixed. Search index switched back on, throttled; by about 13:00 it had all 1.56 million file names.
- 26 Oct, afternoon · Immich installed and started reading in the photos. Shielding of the test sites tightened. This page now shows live figures and was rebuilt with Tailwind 4.
Still to do
- planned An off-site copy (external drive or second address). Right now everything is still in one place.
- idea Own DNS resolver (Unbound): no more middleman, checking DNSSEC ourselves, all spam lists usable.
- idea Cameras and smart devices on a separate network without internet.
- planned Cancel old hosting subscriptions and transfer domains. The mail services at TransIP have already been cancelled; the hosting package at HCWI runs until January 2027.
- planned Immich: wait for the import to finish, then test the app with a screen reader, have the phone back up to it automatically and possibly add the videos.
- idea Configure the router to pass on the real address of visitors, so no extra password is needed at home.