# nasmon

Lightweight NAS health monitor: web dashboard on port 8090 with CPU, memory
(incl. ZFS ARC), temperatures, physical disks with SMART, ZFS pools and datasets;
periodic SMART/ZFS checks with e-mail alerts.

* Web UI:      http://<host>:8090
* Settings:    http://<host>:8090/settings  (also /etc/nasmon/config.json)
* State:       /var/lib/nasmon/nasmon.db  (SMART history, alert log)
* Service:     systemctl status nasmon ; journalctl -u nasmon -f
* JSON API:    /api/status, /api/history?hours=24, /api/disks/<serial>/history?days=30

## ZFS datasets from the UI

The ZFS page (http://<host>:8090/zfs) can create datasets in a pool — name (nested
names like media/video are fine), owner uid:gid for the mountpoint, compression,
dedup, optional quota — and destroy datasets that are empty (no data, no children, no
snapshots; the check is repeated against the live system before "zfs destroy").
Each pool card also shows the dedup ratio and can turn dedup on/off on the pool
root dataset (`zfs set dedup=on|off <pool>`, inherited by child datasets; only new
writes are affected, and the dedup table needs a lot of RAM).

nasmon runs sandboxed (ProtectSystem=strict → own mount namespace), so these
commands are executed on the host through transient units:
`systemd-run --wait --pipe --collect zfs create …`. Every action is logged
(journalctl -u nasmon).

nasmon has no authentication: keep port 8090 on the LAN only.

## SMB / NFS shares from the UI

http://<host>:8090/shares manages Samba shares (guest or per-user, files always
written as the data owner uid 1000), SMB users (smbpasswd; a login-less Unix
account is created when needed) and NFS exports (host/IP/CIDR clients, rw/ro,
squash). A share can point to any existing folder (ZFS dataset, USB disk under
/mnt or /media, /srv…) except system directories (/etc, /usr, /var, /boot…),
also after resolving symlinks. Definitions are stored in
/etc/nasmon/shares.json; nasmon regenerates
/etc/samba/smb.conf (whole file, header "Managed by nasmon") and
/etc/exports.d/nasmon.exports, validates with testparm, then reloads smbd /
exportfs -ra. A rejected config is rolled back to the .bak copy. Daemons are
enabled while at least one share exists and disabled otherwise. "Allow legacy
clients" in the SMB settings turns on SMB1 + NTLMv1 (server min protocol = NT1)
for IPMI/BMC virtual media and other old devices; it is off by default.

Alerts: the × on an open alert acknowledges it (hidden and not mailed until the
problem changes or clears); the × on a resolved alert removes it from the log.
Resolved alerts older than 7 days are hidden by default, older than 90 days
deleted.

## Shares of other services

Other software on the host can publish shares without fighting over the
config files nasmon owns:

* SMB: drop a fragment into /etc/samba/smb.conf.d/<name>.conf. nasmon appends
  "include = <file>" for every *.conf there to the smb.conf it generates.
* NFS: write /etc/exports.d/<name>.exports.

nasmon lists these shares read-only on /shares and keeps smbd / nfs-server
enabled while any of them exist, even with no nasmon shares (previously it
disabled the daemons and took such shares down). When SMB is switched off in
nasmon, only nasmon's own shares are removed.

## RepoISO integration

Settings → Integrations → RepoISO URL (e.g. http://127.0.0.1). nasmon then
polls <url>/api/integration/status every minute and

* shows a RepoISO card on the dashboard (images, publications, jobs, Proxmox
  exports, worker heartbeat) and a "RepoISO" menu link;
* alerts: crit when the portal does not respond, warn when its worker has no
  heartbeat, when jobs failed in the last 24 h or publications are not mounted.

The status endpoint answers only on loopback, so use the local address.