OVH VPS (3 IP) + TrueNAS SCALE: WireGuard + Nginx Proxy Manager + Dockge + Emby/Plex/Jellyfin + Nextcloud + Backups (Full setup) -- 2

I need an experienced Linux/TrueNAS engineer to build a secure remote-access architecture for my home TrueNAS SCALE server using an OVH VPS as the public gateway.

Environment: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::: is exemple ::::::::::::::::::::::::::::::::budget 80////////////////////////

TrueNAS SCALE at home (LAN)

OVH VPS (image: Debian 12 – Docker)

Domain: vpsnas.com (DNS managed in OVH panel)

3 public IPs available on the VPS

Work via AnyDesk on my PC (I will provide access/credentials)

Goal:
The VPS must be the only public entry point (HTTPS 443). A WireGuard tunnel connects VPS ↔ home LAN so services are accessible externally without exposing TrueNAS WebUI/SMB/admin panels publicly.

Important: Installation alone is NOT accepted. Everything must be installed AND fully configured, tested end-to-end, and delivered with proof.

Required Scope of Work
1) OVH Configuration (IPs + DNS)

Configure/use the 3 VPS public IPs and ensure Debian can bind services to specific IPs.

Configure OVH DNS zone for vpsnas.com:

A records → IP1 (WEB) for:

vpsnas.com, www.vpsnas.com

emby.vpsnas.com, plex.vpsnas.com, jellyfin.vpsnas.com

cloud.vpsnas.com

(optional) vpn.vpsnas.com → IP2 (WireGuard)

2) VPS Debian 12 (Docker) — 3 IP Best Practice

Use the 3 IPs like this:

IP1 = WEB/public: only ports 80/443

IP2 = VPN/WireGuard: only 51820/UDP

IP3 = ADMIN/private: SSH + admin panels VPN-only (recommended)

Tasks:

System hardening + firewall (UFW strict rules)

Install/configure WireGuard server on VPS

Tunnel: 10.10.0.0/24 (VPS 10.10.0.1, home gateway 10.10.0.2)

Install/configure Nginx Proxy Manager (Docker):

Bind 80/443 to IP1

Bind Admin UI (81) to IP3 (VPN-only)

3) Home Side: TrueNAS + WG-Gateway VM

Create a small Linux VM (Debian/Ubuntu) on TrueNAS as WG-Gateway

Configure WireGuard client + routing/NAT so VPS can reach my LAN through tunnel

No inbound ports opened on the home router (target)

4) TrueNAS Datasets + Permissions (critical)

Create datasets (example pool Pool1) and set correct ACL/permissions:

Pool1/Media_Movies, Pool1/Media_Series (+ optional Media_TV)

Pool1/AppData/{emby,plex,jellyfin,nextcloud,dockge}

Pool1/Docker/stacks

Pool1/Transcode/{emby,plex,jellyfin}

Pool1/Backups/TrueNASConfig

Media mounts must be read-only in containers; AppData/Transcode/Stacks must be read-write. No “Access denied”.

5) Install & Configure Apps on TrueNAS (Required)

Install Dockge (LAN/VPN only)

Install/configure Emby + Plex + Jellyfin with consistent mounts:

/config (RW), /transcode (RW), /movies (RO), /series (RO)

Install/configure Nextcloud and publish via cloud.vpsnas.com

SMB shares if needed, but SMB must never be exposed publicly (VPN/LAN only)

6) No GPU / Transcoding policy (important)

I have no dedicated GPU currently (CPU-only).

Disable hardware acceleration in Emby/Plex/Jellyfin

Configure to prioritize Direct Play/Direct Stream and minimize transcoding

7) Test Media (LEGAL only)

Use only legal/open licensed test media (no piracy).
Minimum test items:

2 Movies + 2 TV episodes + 1 x 4K test file
Verify scan + playback on all 3 media servers.

8) Backups (Required) + Restore proof

Configure automatic ZFS snapshots (AppData/stacks + media)

Perform restore test (delete a test file and restore from snapshot) — proof required

Export TrueNAS config and store in Pool1/Backups/TrueNASConfig

Final Acceptance Tests (Must Pass)

WireGuard stable; VPS can reach home LAN services

External test via 4G hotspot:

https://emby.vpsnas.com valid HTTPS

https://plex.vpsnas.com valid HTTPS

https://jellyfin.vpsnas.com valid HTTPS

https://cloud.vpsnas.com valid HTTPS

Movies + Series appear and playback works on Emby/Plex/Jellyfin

4K test file remote playback confirms Direct Play (not transcoding)

SMB works on LAN and remotely via VPN only

Backups configured + restore proof + TrueNAS config exported

Deliverables Required

Network diagram (VPS IP1/IP2/IP3 ↔ WireGuard ↔ WG-Gateway ↔ LAN)

OVH DNS record list (screenshots preferred)

Notes on VPS 3-IP configuration on Debian

Firewall rules + open ports list

WireGuard config summary (public keys ok; keep private keys secure)

NPM screenshots: proxy hosts + SSL certificates

Dataset list + permissions overview

Dockge compose stacks + persistent paths

Proof screenshots/logs: external access, playback, Direct Play, snapshots/restore

Short How-To doc: restart services, add a proxy host, add a stack, troubleshooting, restore steps