TrueNAS PRO + VPS + WireGuard + Dockge + Media Servers ///BUDGET 80///

TrueNAS PRO VPS WireGuard Dockge Media Servers Background
XEMPLE ALL JOB
I have:

A TrueNAS SCALE server at home LAN

A VPS with a public static IP

A domain: vpsnas.com

Goal: build a secure, professional setup where the VPS is the public entry point (HTTPS 443), connected to my home network through a WireGuard tunnel, so services (Emby/Plex/Jellyfin and optional apps) are accessible from outside without exposing TrueNAS/SMB publicly. Also, install Dockge to manage docker-compose stacks.

Work will be done via AnyDesk on my PC.

1 Main goals
1.1 Secure remote access (VPS gateway)

VPS public gateway (HTTPS 443)

WireGuard tunnel between VPS and home

Reverse proxy on VPS (Caddy recommended) to route:

emby.vpsnas.com

plex.vpsnas.com

jellyfin.vpsnas.com

add install cloud.vpsnas.com (Nextcloud)

Do NOT expose TrueNAS WebUI, SMB, or admin panels publicly.

1.2 Install & configure services

Install Dockge on TrueNAS (compose stack manager)

Install Emby Plex ellyfin with consistent mounts and library structure



(install ) Nextcloud behind cloud.vpsnas.com

1.3 Full validation & backups

Test movie/series scanning and playback on all 3 media servers

Test external access (via 4G hotspot)

Test SMB access remotely via WireGuard only

Configure and verify automatic backups (ZFS snapshots restore test TrueNAS config backup)

2) Domain / DNS (vpsnas.com)

Configure DNS A records pointing to the VPS public IP:

emby.vpsnas.com

plex.vpsnas.com

jellyfin.vpsnas.com

add install cloud.vpsnas.com

add install vpsnas.com and www.vpsnas.com

3 VPS Public Gateway
3.1 Security & firewall

Open only:

443/tcp (HTTPS)

80/tcp redirect to 443

51820/udp (WireGuard)

SSH restricted keys only preferred

3.2 WireGuard server

Use tunnel network: 10.10.0.0/24

VPS WireGuard IP: 10.10.0.1

Home WG-Gateway IP: 10.10.0.2

The VPS must be able to reach my home LAN (example 192.168.1.0/24) via the tunnel.

3.3 Reverse proxy HTTPS

Install Caddy recommended or Nginx Proxy Manager.

Automatic Let’s Encrypt certificates

Reverse proxy to home services via WireGuard/LAN:

emby.vpsnas.com → Emby LAN IP:8096

plex.vpsnas.com → Plex LAN IP:32400

jellyfin.vpsnas.com → Jellyfin LAN IP:8096 port mapping if needed

add install cloud.vpsnas.com → Nextcloud LAN IP:port

4.Home side: TrueNAS WG-Gateway VM

Create a small Linux VM on TrueNAS Debian/Ubuntu

1–2 vCPU, 1–2 GB RAM, 10–20 GB disk

Bridged NIC on LAN

Static LAN IP example 192.168.1.60

Install WireGuard client connecting to the VPS

Enable IP forwarding NAT/route so the VPS can reach the LAN through the tunnel

No inbound ports opened on the home router/ISP box target

Required tests:

From VPS: ping 10.10.0.2

From VPS: reach TrueNAS LAN IP and all home service ports .Emby/Plex/Jellyfin, etc..

5 TrueNAS datasets & permissions must be done before apps

Create datasets example pool Pool1

5.1 Media datasets (separate per library)

Pool1/Media_Movies

Pool1/Media_Series

add : Pool1/Media_TV

5.2 AppData / Docker / Transcode datasets

Pool1/AppData/emby

Pool1/AppData/plex

Pool1/AppData/jellyfin

Pool1/AppData/dockge

Pool1/Docker/stacks

Pool1/Transcode/emby

Pool1/Transcode/plex

Pool1/Transcode/jellyfin

5.3 Permissions avoid Access denied

Media_* datasets: read permissions for apps containers should mount media as read-only

AppData/, Transcode/, Docker/stacks: write permissions for apps

If I copy media via SMB, grant my SMB user write permissions to Media

6 Dockge (required)

Install Dockge on TrueNAS and use it to manage docker-compose stacks.

Store stacks in Pool1/Docker/stacks

Dockge UI should be LAN/VPN only (recommended), not public

7 Install Emby Plex Jellyfin (required)

Deploy all 3 (via Dockge stacks or TrueNAS Apps), using consistent mounts:

7.1 Standard mounts per app

/config → app’s AppData dataset (RW)

/transcode → app’s transcode dataset (RW)

/movies → Media_Movies (RO)

/series → Media_Series (RO)

(optional) /tv → Media_TV (RO)

7.2 Create libraries in each app

Movies library → /movies

TV Shows library → /series

(optional) TV recordings → /tv

7.3 Test media library (mandatory)

Import at least:

1 movie file (Movies)

1 TV episode file (Series)
Validation:

Scan OK

Titles appear

Playback OK on Emby Plex Jellyfin

8) SMB (Home sharing)

Create SMB shares for Movies/Series if needed

Never expose SMB (445/139) to the Internet

Remote SMB access must work only via WireGuard VPN

9) Automatic backups (required)
9.1 ZFS automatic snapshots

AppData/ Docker/stacks: daily or every 6 hours (recommended)

Media : daily/weekly depending on storage

9.2 Restore test

Delete a test file and restore it from a snapshot (proof required)

9.3 TrueNAS config backup

Export TrueNAS configuration

Store it in a dataset like Backups/TrueNASConfig (create if needed)

10) Final acceptance tests (must pass)

External access test (via 4G hotspot)

https://emby.vpsnas.com works (valid HTTPS)

https://plex.vpsnas.com works (valid HTTPS)

https://jellyfin.vpsnas.com works (valid HTTPS)

Playback test: movie episode plays on all 3

Dockge: stacks restart properly and data persists after container restart

SMB: works on LAN and remotely via VPN

Backups: snapshots created restore test successful TrueNAS config exported

Deliverables required

Network diagram (VPS WireGuard WG-Gateway LAN)

DNS records list firewall ports

WireGuard configs public keys can be shared private keys kept secure

Reverse proxy config Caddyfile or NPM export)

Dataset list permissions overview

Dockge stacks / compose files persistent paths

Proof screenshots/logs : external access playback snapshots/restore

Short How-To document: restart services, add a new stack, troubleshooting steps