LGM-OS documentation
All the NAS documentation, ordered by the moment you are going to need it. If you have just installed it, start with the administration guide; the rest are one-subject guides you only need when you face that particular topic.
Getting started
| Guide | What it is for |
|---|---|
| Administration guide | Start with "The first ten minutes": the path from switching the machine on to having disks, folders, accounts and a backup that actually works. Then the day-to-day manual, subject by subject. If you only read one, read this one. |
| Project README | What LGM-OS is, how it installs from the ISO or on top of an existing Debian, how it updates (with no need to touch the code) and what its limitations are today. |
Guides by subject
| Guide | What it is for |
|---|---|
| Backups | Getting your data off the NAS before anything happens: which folders to copy, where to (a disk, another server over SSH or the cloud) and how often, how to authorise the SSH key of the remote destination step by step and —the one thing that is not optional— how to check by actually restoring that the backup works. |
| Ransomware protection | Making sure the backups are still there when somebody encrypts the NAS: what really protects you and what does not, the lock on snapshots (the only thing that stops them being deleted, even by root) and what to do in the first ten minutes if it has already happened. |
| Cameras | Video surveillance on the NAS itself: finding the cameras on your network over ONVIF, adding them by hand when they do not support it, how much disk each one eats and why you must not open its port on the router. |
| Access from the internet | Reaching the NAS from outside your home by publishing it with your own domain: DDNS with DuckDNS, a Let's Encrypt certificate, a reverse proxy per subdomain and the security checklist to meet before touching the router. |
| Network services | Turning the NAS into the centre of your network: a WireGuard VPN (the safest way in from outside, with nothing exposed), a DNS server with local names and a DHCP server. It includes how to get the network back if DHCP leaves you with no connection: read it before turning it on and keep it on your phone. |
| Disaster recovery | What to do once it has happened: a failed data disk, reinstalling the system while keeping the data, restoring files from a snapshot, restoring the configuration and rebuilding the whole machine from the off-site backup. |
Reference
| Document | What it is for |
|---|---|
| CHANGELOG | What changed in each version, with warnings for the ones that need attention when updating. |
| allowlist.py | The closed list of commands and paths the privileged process accepts. It is the source of truth about what the panel can and cannot do to the system. |
How to choose your remote access route
This is the decision that raises the most questions, and both guides read better once you know this:
- Only you and your own devices → the VPN in the network services guide. It publishes nothing on the internet: you open one UDP port on the router and from your phone or laptop you reach the whole local network, not just the panel. It is the safest option and the recommended one.
- Sharing with other people (family, guests, an app that has to be reachable without installing anything) → Access from the internet. It publishes the NAS with a valid certificate and Apache as the only exposed service, and it requires meeting that guide's security checklist first.
You can have both at once and they do not get in each other's way.
Conventions
- Commands starting with
sudoare run on the NAS console (physically, over SSH or from the web terminal in the panel). - Paths inside the panel are written
App → Section → Tab, for exampleControl Panel → Network services → VPN. - Blocks marked with ⚠️ describe operations that can leave you without access to the NAS or without a network. Read them in full before running them.