How to Install and Configure TrueNAS SCALE: Building a Ransomware-Resilient ZFS HomeLab

Table of Contents

Context & Why: Why Standard NAS Setups Fail Against Ransomware

Most basic network shares leave homelabs wide open to disaster. When client-side ransomware hits a connected workstation, it crawls mapped network drives and encrypts files right where they sit. Traditional file systems like EXT4 or NTFS handle writes in place. The malware reads the original file, encrypts it in client memory, and overwrites the source with scrambled junk.

TrueNAS SCALE flips the script by pairing Debian Linux with OpenZFS. ZFS uses a Copy-on-Write (CoW) transactional architecture. It never modifies existing data blocks directly. When a client modifies a file, ZFS writes the new payload to unallocated sectors first. It only updates the metadata tree once the write succeeds.

This architecture makes snapshots immutable by design. Even if ransomware gets full write access to an SMB share and encrypts every folder in sight, it only writes fresh blocks. It cannot touch or overwrite earlier snapshots locked in the ZFS dataset. A solid snapshot schedule lets you roll back hundreds of gigabytes of encrypted files in under ten seconds.

Hardware Architecture & Planning

Get your hardware choices right early to prevent stability headaches later:

Host Bus Adapter (HBA): Pick an HBA like the LSI Broadcom SAS 9300-8i or 9207-8i flashed to IT mode. Avoid hardware RAID cards. ZFS needs direct, low-level control of every physical drive to manage data integrity, handle timeouts, and calculate parity.
Memory: Start with 16 GB of RAM as your baseline. For larger pools, plan for roughly 1 GB of RAM per 1 TB of storage. Use ECC memory if your CPU and motherboard support it. ZFS keeps its read cache (Adaptive Replacement Cache, or ARC) in RAM, and bad memory can corrupt cached writes.
Dedicated Boot Drive: TrueNAS SCALE claims the entire boot disk. Do not partition your storage drives for the OS. Grab an inexpensive 120 GB to 250 GB SATA SSD or M.2 NVMe drive. Avoid USB thumb drives; the logging overhead in SCALE burns through flash memory quickly.

Installation: Deploying TrueNAS SCALE on Bare Metal

Download the latest TrueNAS SCALE ISO and flash it to a temporary USB drive using Rufus or Ventoy.

Step 1: Running the Installer

Plug the USB installer into your server. Enter the BIOS/UEFI, enable AHCI mode, prioritize the UEFI USB boot entry, and start the system.
Choose Install/Upgrade on the initial menu screen.
Select your dedicated boot SSD (for example, /dev/sda or /dev/nvme0n1). Double-check your disk sizes so you don’t accidentally select a data drive.
Select Administrative user (admin) and set a strong, complex password.
Choose Boot via UEFI.
When the installation finishes, unplug the USB drive and reboot the server.

Step 2: Initial Console Access & Network Configuration

The console prints your DHCP address once the system boots. Assigning a static IP directly from the physical console prevents connection drops if your router reboots. Select option 1) Configure Network Interfaces:

# Physical console network setup
1) Configure network interfaces
Select an interface: enp3s0
Delete existing interface? (y/n): n
Configure IPv4? (y/n): y
DHCP? (y/n): n
IPv4 address: 192.168.1.50
IPv4 netmask: 255.255.255.0
Configure IPv6? (y/n): n
Restart network services? (y/n): y

Open your browser and head to https://192.168.1.50 to log in to the TrueNAS web dashboard.

Configuration: Hardening ZFS Pools and Snapshot Defenses

Step 1: Creating a Resilient ZFS Pool

Open the dashboard and navigate to Storage > Create Pool.

Pool Name: tank-storage
Topology Layout: Choose RAID-Z2 (dual parity, tolerating up to two drive failures) if you are running 6 to 8 spinning HDDs. Pick Mirrored VDEVs (similar to RAID 10) if you need higher IOPS for virtual machines, fast iSCSI shares, or quick rebuild times on large disks.
Select your target drives and click Create.

Step 2: Dataset Creation with Optimized Properties

Avoid sharing the root pool directory directly. Create dedicated datasets instead to control compression, record sizes, and permissions independently. Head to Storage > tank-storage > Add Dataset:

Dataset Name: documents
Sync: Standard (safe writes backed by system RAM cache and ZIL)
Compression: ZSTD (delivers great compression ratios with negligible CPU overhead)
Atime: Off (turns off access-time timestamps on reads, saving drive IOPS)
Record Size: Keep at 128 KiB for general file storage, or bump to 1 MiB for uncompressed video libraries.

Step 3: Building the Anti-Ransomware Snapshot Pipeline

Frequent snapshots form your core recovery strategy. If malware strikes at 2:15 PM, a clean 2:00 PM snapshot limits your data loss to fifteen minutes of work.

Go to Data Protection > Periodic Snapshot Tasks > Add and configure three distinct tiers:

Tier 1 — High-Frequency Snapshots:
- Dataset: tank-storage/documents
- Recursive: Enabled
- Snapshot Lifetime: 48 Hours
- Schedule: Custom cron (Every 15 minutes between 08:00 and 20:00)
Tier 2 — Daily Snapshots:
- Dataset: tank-storage/documents
- Snapshot Lifetime: 14 Days
- Schedule: Daily at 00:00
Tier 3 — Long-Term Weekly Snapshots:
- Dataset: tank-storage/documents
- Snapshot Lifetime: 8 Weeks
- Schedule: Weekly on Sunday at 01:00

Step 4: Configuring SMB Shares with Shadow Copies (VSS)

Windows users can restore files on their own without calling an administrator. Connecting ZFS snapshots to the Windows Volume Shadow Copy Service (VSS) enables the native “Previous Versions” tab.

Navigate to Shares > Windows (SMB) Shares > Add.
Set the path to /mnt/tank-storage/documents.
Expand Advanced Options and check Enable Shadow Copies.
Save your changes, then enable the SMB service under System Settings > Services.

Verification & Monitoring: Validating Recovery and Pool Health

Simulating an Attack & Instant Recovery

Never trust an untested backup policy. Test your rollback routine by simulating file corruption on your SMB share.

Open an SSH session or launch the TrueNAS web shell. List the available snapshot points:

# Inspect available snapshots for the documents dataset
zfs list -t snapshot -r tank-storage/documents

You will see output similar to this:

NAME                                                    USED  AVAIL     REFER  MOUNTPOINT
tank-storage/documents@auto-2026-10-03_14-00            120K      -     4.50G  -
tank-storage/documents@auto-2026-10-03_14-15            140K      -     4.50G  -

If malware corrupts your share right after 14:15, roll the dataset back to its clean state with three quick commands:

# 1. Stop the SMB service to cut active client connections
midclt call service.stop smb

# 2. Roll back the dataset to the clean snapshot state
zfs rollback -r tank-storage/documents@auto-2026-10-03_14-15

# 3. Restart the SMB service
midclt call service.start smb

The rollback finishes almost instantly. Because ZFS only swaps metadata pointers, restoring 10 TB takes the same time as restoring 10 MB.

Automated Pool Maintenance and Alerting

Drives degrade over time. Automated maintenance catches bit rot and failing sectors before they threaten your pool redundancy:

ZFS Scrub Tasks: Head to Data Protection > Scrub Tasks > Add. Run a scrub every two weeks on tank-storage to read every block and verify its checksum.
S.M.A.R.T. Tests: Go to Data Protection > S.M.A.R.T. Tasks > Add. Set up a daily Short Test at 03:00 and an Extended Test on the 1st of each month for all drives.
Alert Services: Click the Alerts (Bell Icon) > Alert Settings. Hook up a Discord webhook or an authenticated SMTP email account. You will receive instant notifications the moment a drive throws I/O errors or a pool drops into a degraded state.

You can check your storage health at any time from the terminal:

zpool status tank-storage

Look for state: ONLINE with zero errors across the READ, WRITE, and CKSUM columns. With automated snapshots, regular scrubs, and instant rollback capability, your homelab is fully prepared to withstand disk failures and ransomware infections alike.