Backing up to a QNAP NAS
Store backups on your own QNAP NAS through QNAP's QuObjects app, which makes the NAS speak S3.
QuObjects is a free QNAP app that turns a shared folder on the NAS into S3-compatible storage. VPS Snaps connects to it like any S3 bucket, so it works for SSH servers, the agent, WordPress sites, Railway and Render databases, Kubernetes and DNS zones. Backups go to your NAS; nothing is kept by VPS Snaps.
Before you start
- QuObjects runs on every x86 QNAP NAS and on the ARM models in the TS-x32 series and the TS-1635AX, with QTS 5.0.0 or later.
- Your servers upload straight to the NAS. It must be reachable from the internet at a public address over HTTPS, with a valid certificate. A home-network address (192.168.x.x) or a Tailscale address will not work, because neither a server in a data centre nor VPS Snaps can reach it.
- Rather not open the NAS to the internet? Back up to cloud storage as usual and have the NAS pull a copy home. See the guide linked at the end.
Step 1 — Install QuObjects
Sign in to the NAS as an administrator, open App Center, search for QuObjects and install it. In QuObjects, go to Server Settings, choose Standalone server, HTTPS and port 8010 (the default), and click Apply.
Step 2 — Make a storage space and a bucket
In QuObjects → Storage Space, click Create and name a new storage space (it becomes a shared folder on the NAS). Then in Buckets, select that storage space, click Create, name the bucket, and leave it Private.
Give backups a storage space of their own, so the key you make next can reach nothing else on the NAS.
Step 3 — A user and an access key
Make a NAS user just for backups in Control Panel → Users, and give it no other shared folders. In QuObjects → User Management, click Add User, add that user, and create an access key for it. Edit the storage space and grant the user permission. The key's Key Details window shows the S3 service endpoint, the access key and the secret key.
Step 4 — Reach the NAS from the internet
Pick one of these.
- A Cloudflare Tunnel (no ports opened on your router): run cloudflared in Container Station and send a hostname such as s3.example.com to https://localhost:8010. Cloudflare supplies the certificate, and your endpoint is https://s3.example.com. Cloudflare limits each request to 100 MB on its Free and Pro plans: servers, the agent and the WordPress plugin (version 1.3.0 or later) upload in parts well under that. An older plugin sends a site's archive in one request, so update it in WordPress if the site is over 100 MB.
- Forward one port: forward TCP 8010 on your router to the NAS, give the NAS a name with myQNAPcloud, and put a certificate for that name on the NAS. Your endpoint is then https://<name>:8010.
Forward only the QuObjects port. Never open the NAS's own sign-in ports (8080 and 443) to the internet: QNAP devices reachable that way have been hit by ransomware. Keep QTS and QuObjects updated.
Step 5 — Add it to VPS Snaps
In Storage → Add destination, choose QNAP NAS (QuObjects). Fill in the bucket name, us-east-1 as the region, your endpoint from Step 4, and the access key and secret key from Step 3, then select Save & test connection. VPS Snaps writes, reads and deletes a test file before it saves anything.
A copy at home instead
You can also leave your backups in cloud storage and have the NAS download a copy on a schedule with Hybrid Backup Sync. The NAS opens no ports, and you get one more copy in another place.